diff --git a/forge/db/models/Application.js b/forge/db/models/Application.js
index cf5c0fc559..d6e757ef86 100644
--- a/forge/db/models/Application.js
+++ b/forge/db/models/Application.js
@@ -185,6 +185,135 @@ module.exports = {
                     return await M.Project.count({
                         where: { ApplicationId: this.id }
                     })
+                },
+                getChildren: async function ({ includeDependencies = false } = {}) {
+                    const application = this
+                    const children = new Map()
+                    const instances = await application.getInstances(includeDependencies ? { include: [M.ProjectStack] } : undefined)
+                    const devices = await application.getDevices()
+                    for (const instance of instances) {
+                        children.set(instance, { model: instance, type: 'instance' })
+                        const instanceDevices = await app.db.models.Device.getAll(undefined, { ProjectId: instance.id })
+                        if (instanceDevices?.devices?.length) {
+                            for (const device of instanceDevices.devices) {
+                                devices.push(device)
+                                children.set(device, { model: device, type: 'device', ownerType: 'instance', ownerId: instance.id })
+                            }
+                        }
+                    }
+                    for (const device of devices) {
+                        if (children.has(device)) {
+                            continue
+                        }
+                        children.set(device, { model: device, type: 'device', ownerType: 'application', ownerId: application.id })
+                    }
+
+                    if (includeDependencies) {
+                        const storageController = app.db.controllers.StorageSettings
+                        for (const instance of instances) {
+                            const child = children.get(instance)
+                            const deps = {}
+                            deps['node-red'] = {
+                                semver: instance.ProjectStack?.properties?.nodered,
+                                installed: instance.ProjectStack?.properties?.nodered
+                            }
+                            if (instance.ProjectStack?.replacedBy) {
+                                const replacementStack = await app.db.models.ProjectStack.byId(instance.ProjectStack.replacedBy)
+                                deps['node-red'].semver = replacementStack?.properties?.nodered
+                            }
+                            const settings = await instance.getSetting(KEY_SETTINGS)
+                            if (Array.isArray(settings?.palette?.modules)) {
+                                settings.palette.modules.forEach(m => {
+                                    deps[m.name] = {
+                                        semver: m.version
+                                    }
+                                })
+                            }
+
+                            const projectModules = await storageController.getProjectModules(child.model) || []
+                            projectModules.forEach(m => {
+                                deps[m.name] = deps[m.name] || {}
+                                deps[m.name].installed = m.version
+                                if (!deps[m.name].semver) {
+                                    deps[m.name].semver = m.version
+                                }
+                            })
+                            child.dependencies = deps
+                        }
+                        // a helper function to get the semver Node-RED version for a device.
+                        // It takes into account the agent version, any editor settings, and the active snapshot
+                        // This is a workaround due to having no direct access to the package.json of the device
+                        const getDeviceNodeRedVersion = async (dev, snapshotModules) => {
+                            const ssNodeRed = snapshotModules?.find(m => m.name === 'node-red')
+                            if (ssNodeRed) {
+                                return ssNodeRed.version
+                            }
+                            const editor = await dev.getSetting('editor')
+                            if (editor?.nodeRedVersion) {
+                                return editor.nodeRedVersion
+                            }
+                            return dev.getDefaultNodeRedVersion()
+                        }
+                        for (const device of devices) {
+                            const child = children.get(device)
+                            const deps = {}
+                            if (device.ownerType === 'instance') {
+                                // use the instance's dependencies as a starting point
+                                const instance = instances.find(i => i.id === device.ProjectId)
+                                const parent = children.get(instance)
+                                Object.assign(deps, parent.dependencies)
+                            }
+                            const targetSnapshot = device.targetSnapshotId ? await device.getTargetSnapshot() : null
+                            const activeSnapshot = device.activeSnapshotId ? await device.getActiveSnapshot() : null
+                            const targetModulesSemver = Object.entries(targetSnapshot?.settings?.settings?.palette?.modules || {}).map(([name, version]) => ({ name, version }))
+                            const activeModulesSemver = Object.entries(activeSnapshot?.settings?.settings?.palette?.modules || {}).map(([name, version]) => ({ name, version }))
+                            const activeModulesInstalled = Object.entries(activeSnapshot?.settings?.modules || {}).map(([name, version]) => ({ name, version }))
+                            const defaultModules = device.ownerType === device.getDefaultModules()
+                            if (activeModulesInstalled?.length) {
+                                activeModulesInstalled.forEach(m => {
+                                    deps[m.name] = deps[m.name] || {}
+                                    deps[m.name].installed = m.version
+                                })
+                            }
+                            if (targetModulesSemver?.length) {
+                                targetModulesSemver.forEach(m => {
+                                    deps[m.name] = deps[m.name] || {}
+                                    deps[m.name].semver = m.version
+                                })
+                            } else if (activeModulesSemver?.length) {
+                                activeModulesSemver.forEach(m => {
+                                    deps[m.name] = deps[m.name] || {}
+                                    deps[m.name].semver = m.version
+                                })
+                            } else if (device.ownerType === 'application' && !targetSnapshot && !activeSnapshot) {
+                                // if the device has no snapshots, use the default snapshot data
+                                Object.entries(defaultModules).forEach(([name, version]) => {
+                                    deps[name] = deps[name] || {}
+                                    deps[name].semver = version
+                                })
+                            }
+
+                            // some devices dont get informed of the @flowfuse/nr-project-nodes or '@flowfuse/nr-assistant' to install due being included
+                            // via nodesdir or other means. In this case, we will use the installed version as the semver
+                            if (deps['@flowfuse/nr-project-nodes'] && deps['@flowfuse/nr-project-nodes'].installed && !deps['@flowfuse/nr-project-nodes'].semver) {
+                                deps['@flowfuse/nr-project-nodes'].semver = deps['@flowfuse/nr-project-nodes'].installed
+                            }
+                            if (deps['@flowfuse/nr-assistant'] && deps['@flowfuse/nr-assistant'].installed && !deps['@flowfuse/nr-assistant'].semver) {
+                                deps['@flowfuse/nr-assistant'].semver = deps['@flowfuse/nr-assistant'].installed
+                            }
+
+                            const noderedVersionInstalled = await getDeviceNodeRedVersion(device, activeModulesInstalled) || '*'
+                            const noderedVersionSemver = await getDeviceNodeRedVersion(device, targetModulesSemver) || '*'
+                            deps['node-red'] = {
+                                semver: noderedVersionSemver,
+                                installed: noderedVersionInstalled
+                            }
+
+                            child.dependencies = deps
+                        }
+                    }
+
+                    return Array.from(children.values())
                 }
             }
         }
diff --git a/forge/db/models/Device.js b/forge/db/models/Device.js
index 8a262f8950..444efccef7 100644
--- a/forge/db/models/Device.js
+++ b/forge/db/models/Device.js
@@ -4,6 +4,8 @@
  */
 const crypto = require('crypto')
 
+const SemVer = require('semver')
+
 const { DataTypes, Op } = require('sequelize')
 
 const Controllers = require('../controllers')
@@ -205,6 +207,21 @@ module.exports = {
                         limit: 1
                     })
                     return snapshots[0]
+                },
+                getDefaultNodeRedVersion () {
+                    let nodeRedVersion = '3.0.2' // default to older Node-RED
+                    if (SemVer.satisfies(SemVer.coerce(this.agentVersion), '>=1.11.2')) {
+                        // 1.11.2 includes fix for ESM loading of GOT, so lets use 'latest' as before
+                        nodeRedVersion = 'latest'
+                    }
+                    return nodeRedVersion
+                },
+                getDefaultModules () {
+                    return {
+                        'node-red': this.getDefaultNodeRedVersion(),
+                        '@flowfuse/nr-project-nodes': '>0.5.0', // TODO: get this from the "settings" (future)
+                        '@flowfuse/nr-assistant': '>=0.1.0'
+                    }
                 }
             },
             static: {
diff --git a/forge/db/views/Application.js b/forge/db/views/Application.js
index 6a94dad5fb..6a5f922b30 100644
--- a/forge/db/views/Application.js
+++ b/forge/db/views/Application.js
@@ -151,6 +151,17 @@ module.exports = function (app) {
         }))
     }
 
+    app.addSchema({
+        $id: 'ApplicationBom',
+        type: 'object',
+        properties: {
+            id: { type: 'string' },
+            name: { type: 'string' },
+            children: { type: 'array', items: { $ref: 'dependant' } } // dependant is defined in BOM.js
+        },
+        additionalProperties: true
+    })
+
     return {
         application,
         applicationAssociationsStatusList,
diff --git a/forge/db/views/BOM.js b/forge/db/views/BOM.js
new file mode 100644
index 0000000000..d6f10a84ec
--- /dev/null
+++ b/forge/db/views/BOM.js
@@ -0,0 +1,72 @@
+let app
+
+module.exports = {
+    init: (appInstance) => {
+        app = appInstance
+        app.addSchema({
+            $id: 'dependency',
+            type: 'object',
+            properties: {
+                name: { type: 'string' },
+                version: {
+                    type: 'object',
+                    properties: {
+                        semver: { type: 'string' },
+                        installed: { type: 'string', nullable: true }
+                    }
+                }
+            }
+        })
+        app.addSchema({
+            $id: 'dependant',
+            type: 'object',
+            properties: {
+                id: { type: 'string' },
+                name: { type: 'string' },
+                type: {
+                    type: 'string',
+                    enum: ['instance', 'device']
+                },
+                ownerType: {
+                    type: 'string',
+                    enum: ['instance', 'application'],
+                    nullable: true
+                },
+                ownerId: { type: 'string', nullable: true },
+                dependencies: { type: 'array', items: { $ref: 'dependency' } }
+            }
+        })
+    },
+
+    dependency (name, semverVersion, installedVersion = null) {
+        const result = {
+            name,
+            version: {
+                semver: semverVersion,
+                installed: installedVersion || null
+            }
+        }
+        return result
+    },
+
+    dependant (model, dependencies) {
+        const type = model instanceof app.db.models.Project ? 'instance' : model instanceof app.db.models.Device ? 'device' : null
+        if (type !== null) {
+            const dependenciesArray = Object.entries(dependencies || {}).map(([name, version]) => app.db.views.BOM.dependency(name, version?.semver, version?.installed))
+            if (type === 'device') {
+                const { hashid, name, ownerType } = model
+                let ownerId = null
+                if (ownerType === 'instance') {
+                    ownerId = model.ProjectId
+                } else if (ownerType === 'application') {
+                    ownerId = model.Application ? model.Application.id : app.db.models.Application.encodeHashid(model.ApplicationId)
+                }
+                return { id: hashid, name, type, ownerType, ownerId, dependencies: dependenciesArray }
+            } else if (type === 'instance') {
+                const { id, name } = model
+                return { id, name, type, dependencies: dependenciesArray }
+            }
+        }
+        return null
+    }
+}
diff --git a/forge/db/views/index.js b/forge/db/views/index.js
index 4fdc01ca34..03a1691fcd 100644
--- a/forge/db/views/index.js
+++ b/forge/db/views/index.js
@@ -14,6 +14,7 @@ const modelTypes = [
     'AccessToken',
     'Application',
     'AuditLog',
+    'BOM',
     'Device',
     'DeviceGroup',
     'Invitation',
diff --git a/forge/ee/lib/index.js b/forge/ee/lib/index.js
index 2919d6d843..519d78d75a 100644
--- a/forge/ee/lib/index.js
+++ b/forge/ee/lib/index.js
@@ -17,6 +17,8 @@ module.exports = fp(async function (app, opts) {
         app.config.features.register('mfa', true, true)
         // Set the Device Groups Feature Flag
         app.config.features.register('deviceGroups', true, true)
+        // Set the Bill of Materials Feature Flag
+        app.config.features.register('bom', true, true)
     }
 
     // Set the Team Library Feature Flag
diff --git a/forge/ee/routes/bom/application.js b/forge/ee/routes/bom/application.js
new file mode 100644
index 0000000000..229306b939
--- /dev/null
+++ b/forge/ee/routes/bom/application.js
@@ -0,0 +1,47 @@
+const applicationShared = require('../../../routes/api/shared/application.js')
+
+module.exports = async function (app) {
+    app.addHook('preHandler', applicationShared.defaultPreHandler.bind(null, app))
+
+    /**
+     * Get the application BOM
+     * @name /api/v1/application/:applicationId/bom
+     * @memberof forge.routes.api.application
+     */
+    app.get('/:applicationId/bom', {
+        preHandler: app.needsPermission('application:bom'),
+        schema: {
+            summary: 'Get application BOM',
+            tags: ['Applications'],
+            params: {
+                type: 'object',
+                properties: {
+                    applicationId: { type: 'string' }
+                }
+            },
+            response: {
+                200: {
+                    type: 'object',
+                    $ref: 'ApplicationBom'
+                },
+                '4xx': {
+                    $ref: 'APIError'
+                }
+            }
+        }
+    }, async (request, reply) => {
+        const teamType = await request.application.Team.getTeamType()
+        if (!teamType.getFeatureProperty('bom', false)) {
+            return reply.code(404).send({ code: 'unexpected_error', error: 'Feature not enabled.' })
+        }
+
+        const dependants = await request.application.getChildren({ includeDependencies: true })
+        const childrenView = dependants.map(child => app.db.views.BOM.dependant(child.model, child.dependencies))
+        const result = {
+            id: request.application.hashid,
+            name: request.application.name,
+            children: childrenView
+        }
+        reply.send(result)
+    })
+}
diff --git a/forge/ee/routes/index.js b/forge/ee/routes/index.js
index 003598c56a..b6e75a483d 100644
--- a/forge/ee/routes/index.js
+++ b/forge/ee/routes/index.js
@@ -12,6 +12,7 @@ module.exports = async function (app) {
     await app.register(require('./sharedLibrary'), { logLevel: app.config.logging.http })
     await app.register(require('./pipeline'), { prefix: '/api/v1', logLevel: app.config.logging.http })
     await app.register(require('./deviceEditor'), { prefix: '/api/v1/devices/:deviceId/editor', logLevel: app.config.logging.http })
+    await app.register(require('./bom/application.js'), { prefix: '/api/v1/applications', logLevel: app.config.logging.http })
 
     await app.register(require('./flowBlueprints'), { prefix: '/api/v1/flow-blueprints', logLevel: app.config.logging.http })
 
diff --git a/forge/lib/permissions.js b/forge/lib/permissions.js
index 0a9c55b273..40ccc687b0 100644
--- a/forge/lib/permissions.js
+++ b/forge/lib/permissions.js
@@ -120,6 +120,9 @@ const Permissions = {
     /**
      * EE Permissions
      */
+    // Application
+    'application:bom': { description: 'Get the Bill of Materials', role: Roles.Owner },
+
     // Device Groups
     'application:device-group:create': { description: 'Create a device group', role: Roles.Owner },
     'application:device-group:list': { description: 'List device groups', role: Roles.Member },
diff --git a/forge/routes/api/application.js b/forge/routes/api/application.js
index 38958a93e6..5e4dfaadbe 100644
--- a/forge/routes/api/application.js
+++ b/forge/routes/api/application.js
@@ -1,30 +1,7 @@
-module.exports = async function (app) {
-    app.addHook('preHandler', async (request, reply) => {
-        const applicationId = request.params.applicationId
-        if (applicationId === undefined) {
-            return
-        }
-
-        if (!applicationId) {
-            return reply.code(404).send({ code: 'not_found', error: 'Not Found' })
-        }
-
-        try {
-            request.application = await app.db.models.Application.byId(applicationId)
-            if (!request.application) {
-                return reply.code(404).send({ code: 'not_found', error: 'Not Found' })
-            }
+const applicationShared = require('./shared/application.js')
 
-            if (request.session.User) {
-                request.teamMembership = await request.session.User.getTeamMembership(request.application.Team.id)
-                if (!request.teamMembership && !request.session.User.admin) {
-                    return reply.code(404).send({ code: 'not_found', error: 'Not Found' })
-                }
-            }
-        } catch (err) {
-            return reply.code(500).send({ code: 'unexpected_error', error: err.toString() })
-        }
-    })
+module.exports = async function (app) {
+    app.addHook('preHandler', applicationShared.defaultPreHandler.bind(null, app))
 
     /**
      * Create an application
diff --git a/forge/routes/api/deviceLive.js b/forge/routes/api/deviceLive.js
index 3f20cc99ed..b4239ff85b 100644
--- a/forge/routes/api/deviceLive.js
+++ b/forge/routes/api/deviceLive.js
@@ -114,23 +114,10 @@ module.exports = async function (app) {
                 obj.modules['node-red'] = editor?.nodeRedVersion
             }
         }
-        const getDefaultNodeRedVersion = (dev) => {
-            let nodeRedVersion = '3.0.2' // default to older Node-RED
-            if (SemVer.satisfies(SemVer.coerce(dev.agentVersion), '>=1.11.2')) {
-                // 1.11.2 includes fix for ESM loading of GOT, so lets use 'latest' as before
-                nodeRedVersion = 'latest'
-            }
-            if (SemVer.satisfies(SemVer.coerce(dev.agentVersion), '>=1.11.2')) {
-                // 1.11.2 includes fix for ESM loading of GOT, so lets use 'latest' as before
-                nodeRedVersion = 'latest'
-            }
-            return nodeRedVersion
-        }
         if (!device.targetSnapshot) {
             // device does not have a target snapshot
             // if this is an application owned device, return a starter snapshot
             if (device.isApplicationOwned) {
-                const nodeRedVersion = getDefaultNodeRedVersion(device)
                 if (!device.agentVersion || SemVer.lt(device.agentVersion, '1.11.0')) {
                     reply.code(400).send({ code: 'invalid_agent_version', error: 'invalid agent version' })
                     return
@@ -147,13 +134,7 @@ module.exports = async function (app) {
                         { id: 'FFCHA00000000001', type: 'change', z: 'FFF0000000000001', name: 'Get Env Vars', rules: [{ t: 'set', p: 'payload', pt: 'msg', to: '{}', tot: 'json' }, { t: 'set', p: 'payload.device', pt: 'msg', to: 'FF_DEVICE_NAME', tot: 'env' }, { t: 'set', p: 'payload.application', pt: 'msg', to: 'FF_APPLICATION_NAME', tot: 'env' }], action: '', reg: false, x: 320, y: 160, wires: [['FFDBG00000000001']] },
                         { id: 'FFDBG00000000001', type: 'debug', z: 'FFF0000000000001', name: 'Info', active: true, tosidebar: true, console: true, tostatus: true, complete: 'payload', targetType: 'msg', statusVal: 'payload', statusType: 'auto', x: 490, y: 160 }
                     ],
-                    modules: {
-                        'node-red': nodeRedVersion,
-                        // as of FF v1.14.0, we permit project nodes to work on application owned devices
-                        // the support for this is in @flowfuse/nr-project-nodes > v0.5.0
-                        '@flowfuse/nr-project-nodes': '>0.5.0', // TODO: get this from the "settings" (future)
-                        '@flowfuse/nr-assistant': '>=0.1.0'
-                    },
+                    modules: device.getDefaultModules(),
                     env: {
                         FF_SNAPSHOT_ID: '0',
                         FF_SNAPSHOT_NAME: 'None',
@@ -186,18 +167,19 @@ module.exports = async function (app) {
 
                 // as of FF v1.14.0, we permit project nodes to work on application owned devices
                 if (device.isApplicationOwned) {
-                    settings.modules = settings.modules || {} // snapshot might not have any modules
+                    const defaultModules = device.getDefaultModules()
+                    settings.modules = settings.modules || defaultModules // snapshot might not have any modules
                     // @flowfuse/nr-project-nodes > v0.5.0 is required for this to work
                     // if the snapshot does not have the new module specified OR it is a version <= 0.5.0, update it
                     if (!settings.modules['@flowfuse/nr-project-nodes'] || SemVer.satisfies(SemVer.coerce(settings.modules['@flowfuse/nr-project-nodes']), '<=0.5.0')) {
-                        settings.modules['@flowfuse/nr-project-nodes'] = '>0.5.0'
+                        settings.modules['@flowfuse/nr-project-nodes'] = defaultModules['@flowfuse/nr-project-nodes'] || '>0.5.0'
                     }
                     if (!settings.modules['@flowfuse/nr-assistant']) {
-                        settings.modules['@flowfuse/nr-assistant'] = '>=0.1.0'
+                        settings.modules['@flowfuse/nr-assistant'] = defaultModules['@flowfuse/nr-assistant'] || '>=0.1.0'
                     }
                     if (!settings.modules['node-red']) {
                         // if the snapshot does not have the node-red module specified, ensure it is set to a valid version
-                        settings.modules['node-red'] = getDefaultNodeRedVersion(device)
+                        settings.modules['node-red'] = defaultModules['node-red'] || device.getDefaultNodeRedVersion()
                     }
                     // Belt and braces, remove old module! We don't want to be instructing the device to install the old version.
                     // (the old module can be present due to a snapshot applied from an instance or instance owned device)
diff --git a/forge/routes/api/shared/application.js b/forge/routes/api/shared/application.js
new file mode 100644
index 0000000000..6d307d4610
--- /dev/null
+++ b/forge/routes/api/shared/application.js
@@ -0,0 +1,28 @@
+module.exports = {
+    defaultPreHandler: async (app, request, reply) => {
+        const applicationId = request.params.applicationId
+        if (applicationId === undefined) {
+            return
+        }
+
+        if (!applicationId) {
+            return reply.code(404).send({ code: 'not_found', error: 'Not Found' })
+        }
+
+        try {
+            request.application = await app.db.models.Application.byId(applicationId)
+            if (!request.application) {
+                return reply.code(404).send({ code: 'not_found', error: 'Not Found' })
+            }
+
+            if (request.session.User) {
+                request.teamMembership = await request.session.User.getTeamMembership(request.application.Team.id)
+                if (!request.teamMembership && !request.session.User.admin) {
+                    return reply.code(404).send({ code: 'not_found', error: 'Not Found' })
+                }
+            }
+        } catch (err) {
+            return reply.code(500).send({ code: 'unexpected_error', error: err.toString() })
+        }
+    }
+}
diff --git a/frontend/src/api/application.js b/frontend/src/api/application.js
index a6704b8107..22919a28b5 100644
--- a/frontend/src/api/application.js
+++ b/frontend/src/api/application.js
@@ -342,6 +342,16 @@ const updateDeviceGroupMembership = async (applicationId, groupId, { add, remove
     return client.patch(`/api/v1/applications/${applicationId}/device-groups/${groupId}`, { add, remove, set })
 }
 
+/**
+ * Get a list of Dependencies / Bill of Materials
+ * @param applicationId
+ * @returns {Promise<axios.AxiosResponse<any>>}
+ */
+const getDependencies = (applicationId) => {
+    return client.get(`/api/v1/applications/${applicationId}/bom`)
+        .then(res => res.data)
+}
+
 export default {
     createApplication,
     updateApplication,
@@ -362,5 +372,6 @@ export default {
     createDeviceGroup,
     deleteDeviceGroup,
     updateDeviceGroup,
-    updateDeviceGroupMembership
+    updateDeviceGroupMembership,
+    getDependencies
 }
diff --git a/frontend/src/api/external.js b/frontend/src/api/external.js
new file mode 100644
index 0000000000..42324c8195
--- /dev/null
+++ b/frontend/src/api/external.js
@@ -0,0 +1,12 @@
+import client from './client.js'
+
+const getNpmDependency = async (dependency, version = '') => {
+    return client.get(`https://registry.npmjs.com/${dependency}/${version}`)
+        .then(res => {
+            return res.data
+        })
+}
+
+export default {
+    getNpmDependency
+}
diff --git a/frontend/src/components/Accordion.vue b/frontend/src/components/Accordion.vue
index 2f4e6835cb..0a3f4a4496 100644
--- a/frontend/src/components/Accordion.vue
+++ b/frontend/src/components/Accordion.vue
@@ -1,8 +1,10 @@
 <template>
     <div class="ff-accordion" :class="{'open': isOpen}">
         <button class="ff-accordion--button" :disabled="disabled" @click="toggle()">
-            <label>{{ label }}</label>
-            <div>
+            <slot name="label">
+                <label>{{ label }}</label>
+            </slot>
+            <div class="toggle">
                 <slot name="meta" />
                 <ChevronLeftIcon v-if="!disabled" class="ff-icon" />
             </div>
@@ -24,7 +26,8 @@ export default {
     props: {
         label: {
             type: String,
-            required: true
+            required: false,
+            default: ''
         },
         setOpen: {
             type: Boolean,
diff --git a/frontend/src/mixins/Features.js b/frontend/src/mixins/Features.js
index 9b0048927a..bd0d344f7b 100644
--- a/frontend/src/mixins/Features.js
+++ b/frontend/src/mixins/Features.js
@@ -44,6 +44,15 @@ export default {
         },
         isHTTPBearerTokensFeatureEnabledForTeam () {
             return this.settings.features.httpBearerTokens && this.team.type.properties.features.teamHttpSecurity
+        },
+        isBOMFeatureEnabledForPlatform () {
+            return !!this.features.bom
+        },
+        isBOMFeatureEnabledForTeam () {
+            return !!this.team?.type?.properties?.features?.bom
+        },
+        isBOMFeatureEnabled () {
+            return this.isBOMFeatureEnabledForPlatform && this.isBOMFeatureEnabledForTeam
         }
     }
 }
diff --git a/frontend/src/pages/admin/TeamTypes/dialogs/TeamTypeEditDialog.vue b/frontend/src/pages/admin/TeamTypes/dialogs/TeamTypeEditDialog.vue
index 8ccec346fc..ffbd980b38 100644
--- a/frontend/src/pages/admin/TeamTypes/dialogs/TeamTypeEditDialog.vue
+++ b/frontend/src/pages/admin/TeamTypes/dialogs/TeamTypeEditDialog.vue
@@ -101,7 +101,9 @@
                     <FormRow v-model="input.properties.features.editorLimits" type="checkbox">API/Debug Length Limits</FormRow>
                     <FormRow v-model="input.properties.features.customHostnames" type="checkbox">Custom Hostnames</FormRow>
                     <FormRow v-model="input.properties.features.staticAssets" type="checkbox">Static Assets</FormRow>
-                    <span /> <!-- to make the grid work nicely, only needed if there is an odd number of checkbox features above -->
+                    <!-- to make the grid work nicely, only needed if there is an odd number of checkbox features above-->
+                    <!-- <span />-->
+                    <FormRow v-model="input.properties.features.bom" type="checkbox">Bill of Materials / Dependencies</FormRow>
                     <FormRow v-model="input.properties.features.fileStorageLimit">Persistent File storage limit (Mb)</FormRow>
                     <FormRow v-model="input.properties.features.contextLimit">Persistent Context storage limit (Mb)</FormRow>
                 </div>
diff --git a/frontend/src/pages/application/Dependencies/Dependencies.vue b/frontend/src/pages/application/Dependencies/Dependencies.vue
new file mode 100644
index 0000000000..e580f7ab99
--- /dev/null
+++ b/frontend/src/pages/application/Dependencies/Dependencies.vue
@@ -0,0 +1,193 @@
+<template>
+    <div class="dependencies-wrapper">
+        <SectionTopMenu hero="Dependencies" help-header="Node-RED Dependencies - Running in FlowFuse" info="Dependencies of Node-RED Instances belonging to this application.">
+            <template #pictogram>
+                <img src="../../../images/pictograms/instance_red.png">
+            </template>
+            <template #helptext>
+                <p>This is a list of Node-RED Dependencies in this Application, hosted on the same domain as FlowFuse.</p>
+            </template>
+        </SectionTopMenu>
+
+        <div class="space-y-6 mb-12">
+            <div class="banner-wrapper mt-5">
+                <FeatureUnavailable v-if="!isBOMFeatureEnabledForPlatform" />
+                <FeatureUnavailableToTeam v-else-if="!isBOMFeatureEnabledForTeam" />
+            </div>
+
+            <ff-loading v-if="loading" message="Loading Snapshots..." />
+
+            <div v-else-if="hasInstances">
+                <ff-text-input
+                    v-model="searchTerm"
+                    class="ff-data-table--search mb-5 mt-5"
+                    data-form="search"
+                    placeholder="Search Package Dependency, Instance or Device"
+                >
+                    <template #icon><SearchIcon /></template>
+                </ff-text-input>
+                <div v-if="Object.keys(dependencies).length > 0" class="dependencies" data-el="dependencies">
+                    <dependency-item
+                        v-for="(versions, dependencyTitle) in dependencies"
+                        :key="dependencyTitle"
+                        :title="dependencyTitle"
+                        :versions="versions"
+                    />
+                </div>
+                <div v-else class="empty text-center opacity-60">
+                    <p>Oops! We couldn't find any matching results.</p>
+                </div>
+            </div>
+            <EmptyState v-else>
+                <template #img>
+                    <img src="../../../images/empty-states/application-instances.png">
+                </template>
+                <template #header>Your application doesn't contain any Instances or Devices</template>
+                <template #message>
+                    <p>
+                        Applications in FlowFuse are used to manage groups of Node-RED Instances and Devices.
+                    </p>
+                    <p v-if="!isBOMFeatureEnabled">
+                        Once you assign an Instance or Device to this application, you'll be able to view a complete list of their dependencies.
+                    </p>
+                </template>
+            </EmptyState>
+        </div>
+    </div>
+</template>
+
+<script>
+import { SearchIcon } from '@heroicons/vue/outline'
+
+import ApplicationsApi from '../../../api/application.js'
+import EmptyState from '../../../components/EmptyState.vue'
+import SectionTopMenu from '../../../components/SectionTopMenu.vue'
+import FeatureUnavailable from '../../../components/banners/FeatureUnavailable.vue'
+import FeatureUnavailableToTeam from '../../../components/banners/FeatureUnavailableToTeam.vue'
+
+import featuresMixin from '../../../mixins/Features.js'
+import permissionsMixin from '../../../mixins/Permissions.js'
+
+import DependencyItem from './components/DependencyItem.vue'
+
+export default {
+    name: 'ApplicationDependencies',
+    components: {
+        FeatureUnavailable,
+        FeatureUnavailableToTeam,
+        EmptyState,
+        SectionTopMenu,
+        SearchIcon,
+        DependencyItem
+    },
+    mixins: [featuresMixin, permissionsMixin],
+    inheritAttrs: false,
+    props: {
+        application: {
+            type: Object,
+            required: true
+        },
+        instances: {
+            type: Array,
+            required: true
+        }
+    },
+    data () {
+        return {
+            payload: null,
+            loading: false,
+            searchTerm: ''
+        }
+    },
+    computed: {
+        extendedInstances () {
+            if (!this.payload?.children) {
+                return []
+            }
+
+            return this.payload.children.map(instance => {
+                const fullInstanceData = this.instances.find(ins => ins.id === instance.id)
+                if (fullInstanceData && Object.prototype.hasOwnProperty.call(fullInstanceData, 'meta')) {
+                    instance.meta = fullInstanceData.meta
+                }
+                return instance
+            })
+        },
+        dependencies () {
+            return this.extendedInstances
+                .reduce((acc, currentInstance) => {
+                    currentInstance.dependencies.forEach(dep => {
+                        const searchTerm = this.searchTerm.trim()
+                        const installedDependencyVersion = dep.version.installed ?? dep.version.semver
+                        const dependencyNameMatchesSearch = dep.name.toLowerCase().includes(searchTerm.toLowerCase())
+                        const dependencyVersionMatchesSearch = installedDependencyVersion.toLowerCase().includes(searchTerm.toLowerCase())
+                        const matchesInstanceName = currentInstance.name.toLowerCase().includes(searchTerm.toLowerCase())
+                        const includeDependency = () => {
+                            if (!Object.prototype.hasOwnProperty.call(acc, dep.name)) {
+                                acc[dep.name] = {}
+                            }
+                            if (!Object.prototype.hasOwnProperty.call(acc[dep.name], installedDependencyVersion)) {
+                                acc[dep.name][installedDependencyVersion] = []
+                            }
+                            acc[dep.name][installedDependencyVersion].push(currentInstance)
+                        }
+
+                        switch (true) {
+                        case !searchTerm.length:
+                            includeDependency()
+                            break
+                        case matchesInstanceName:
+                            includeDependency()
+                            break
+                        case dependencyVersionMatchesSearch || dependencyNameMatchesSearch:
+                            includeDependency()
+                            break
+                        default:
+                            break
+                        }
+                    })
+                    return acc
+                }, {})
+        },
+        hasInstances () {
+            return !(!this.payload || this.payload.children.length === 0)
+        },
+        hasTeamPermission () {
+            return this.hasPermission('application:bom')
+        }
+    },
+    mounted () {
+        if (!this.hasTeamPermission) {
+            return this.$router.push({ name: 'Application', params: { id: this.application.id } })
+        }
+        this.getDependencies()
+    },
+    methods: {
+        getDependencies () {
+            if (this.isBOMFeatureEnabled) {
+                this.loading = true
+                ApplicationsApi.getDependencies(this.application.id)
+                    .then(res => {
+                        this.payload = res
+                    })
+                    .catch(err => {
+                        this.payload = []
+                        console.warn(err)
+                    })
+                    .finally(() => {
+                        this.loading = false
+                    })
+            }
+        }
+    }
+}
+</script>
+
+<style scoped lang="scss">
+.dependencies-wrapper {
+  .dependencies {
+    display: grid;
+    gap: 12px;
+  }
+}
+</style>
diff --git a/frontend/src/pages/application/Dependencies/components/DependencyItem.vue b/frontend/src/pages/application/Dependencies/components/DependencyItem.vue
new file mode 100644
index 0000000000..294bd2d7ba
--- /dev/null
+++ b/frontend/src/pages/application/Dependencies/components/DependencyItem.vue
@@ -0,0 +1,118 @@
+<template>
+    <section class="dependency-item" data-el="dependency-item">
+        <div class="dependency-header">
+            <div class="title">
+                <h3>{{ title }}</h3>
+            </div>
+            <div class="details">
+                <span>Latest: {{ externalLatest }}</span>
+                <span>Released: {{ externalLastModified }}</span>
+            </div>
+        </div>
+        <versions-list
+            v-for="(entry, key) in Object.entries(versions)" :key="key"
+            :instances="entry[1]"
+            :version="entry[0]"
+        />
+    </section>
+</template>
+
+<script>
+
+import ExternalClient from '../../../../api/external.js'
+import daysSince from '../../../../utils/daysSince.js'
+
+import VersionsList from './VersionsList.vue'
+
+export default {
+    name: 'DependencyItem',
+    components: { VersionsList },
+    props: {
+        title: {
+            required: true,
+            type: String
+        },
+        versions: {
+            required: true,
+            type: Object
+        }
+    },
+    data () {
+        return {
+            externalDependency: null
+        }
+    },
+    computed: {
+        externalLatest () {
+            if (
+                !this.externalDependency ||
+                (
+                    !Object.prototype.hasOwnProperty.call(this.externalDependency, 'dist-tags') &&
+                    !Object.prototype.hasOwnProperty.call(this.externalDependency['dist-tags'], 'latest')
+                )
+            ) {
+                return 'N/A'
+            }
+
+            return this.externalDependency['dist-tags'].latest
+        },
+        externalLastModified () {
+            if (
+                !this.externalDependency ||
+            (
+                !Object.prototype.hasOwnProperty.call(this.externalDependency, 'time') &&
+                !Object.prototype.hasOwnProperty.call(this.externalDependency.time, 'modified')
+            )
+            ) {
+                return 'N/A'
+            }
+
+            return daysSince(this.externalDependency.time.modified)
+        }
+    },
+    mounted () {
+        this.getExternalDependency()
+    },
+    methods: {
+        async getExternalDependency () {
+            this.externalDependency = await ExternalClient.getNpmDependency(this.title)
+        }
+    }
+}
+</script>
+
+<style lang="scss">
+.dependency-item {
+  border: 1px solid $ff-grey-300;
+  .dependency-header {
+    background: $ff-grey-100;
+    display: flex;
+    border-bottom: 1px solid $ff-grey-300;
+    padding: 6px 9px;
+    align-items: center;
+
+    .title {
+      flex: 1;
+
+      h3 {
+        margin: 0;
+      }
+    }
+
+    .details {
+      display: flex;
+      flex-direction: column;
+      font-size: 0.875rem;
+      font-weight: 500;
+    }
+  }
+
+  &:last-of-type {
+    .ff-accordion {
+      button {
+        border-bottom: none;
+      }
+    }
+  }
+}
+</style>
diff --git a/frontend/src/pages/application/Dependencies/components/InstancesItem.vue b/frontend/src/pages/application/Dependencies/components/InstancesItem.vue
new file mode 100644
index 0000000000..dbefe5ebb1
--- /dev/null
+++ b/frontend/src/pages/application/Dependencies/components/InstancesItem.vue
@@ -0,0 +1,67 @@
+<template>
+    <div class="instance-item" data-el="instance-item">
+        <div class="title">
+            <h6>
+                <IconDeviceSolid v-if="isDevice" class="ff-icon text-teal-700" />
+                <IconNodeRedSolid v-else class="ff-icon text-red-700" />
+                <router-link :to="{name: 'instance-overview', params: {id: instance.id}}" class="ff-link">
+                    {{ instance.name }}
+                </router-link>
+            </h6>
+        </div>
+        <div class="actions">
+            <status-badge v-if="!isDevice" :status="instance.meta?.state" />
+        </div>
+    </div>
+</template>
+
+<script>
+import StatusBadge from '../../../../components/StatusBadge.vue'
+import IconDeviceSolid from '../../../../components/icons/DeviceSolid.js'
+import IconNodeRedSolid from '../../../../components/icons/NodeRedSolid.js'
+
+export default {
+    name: 'InstancesItem',
+    components: { StatusBadge, IconNodeRedSolid, IconDeviceSolid },
+    props: {
+        instance: {
+            required: true,
+            type: Object
+        }
+    },
+    computed: {
+        isDevice () {
+            return this.instance.type === 'device'
+        }
+    }
+}
+</script>
+
+<style scoped lang="scss">
+.instance-item {
+  display: grid;
+  grid-template-columns: repeat(6, 1fr);
+  gap: 15px;
+  background: $ff-grey-50;
+  border-bottom: 1px solid $ff-grey-300;
+  justify-content: space-between;
+  padding: 6px;
+  align-items: center;
+
+  .title {
+    grid-column-start: 2;
+    grid-column-end: 4;
+
+    h6 {
+      display: flex;
+      gap: 6px;
+    }
+  }
+
+  .actions {
+    grid-column-start: 6;
+    display: flex;
+    justify-content: flex-end;
+  }
+}
+</style>
diff --git a/frontend/src/pages/application/Dependencies/components/VersionsList.vue b/frontend/src/pages/application/Dependencies/components/VersionsList.vue
new file mode 100644
index 0000000000..f6c65afb1d
--- /dev/null
+++ b/frontend/src/pages/application/Dependencies/components/VersionsList.vue
@@ -0,0 +1,91 @@
+<template>
+    <ff-accordion class="versions-list" data-el="versions-list">
+        <template #label>
+            <span class="version">{{ version }}</span>
+            <div class="counter">
+                <span v-if="instancesCount > 0" class="instance-counter">{{ instancesCount }} x Instances</span>
+                <span v-if="hasInstances & hasDevices" class="delimiter">, </span>
+                <span v-if="devicesCount > 0" class="devices-counter">{{ devicesCount }} x Devices</span>
+            </div>
+        </template>
+        <template #content>
+            <ul class="instances-list">
+                <li v-for="instance in instances" :key="instance.id">
+                    <instances-item :instance="instance" />
+                </li>
+            </ul>
+        </template>
+    </ff-accordion>
+</template>
+
+<script>
+import FfAccordion from '../../../../components/Accordion.vue'
+
+import InstancesItem from './InstancesItem.vue'
+
+export default {
+    name: 'VersionsList',
+    components: { FfAccordion, InstancesItem },
+    props: {
+        version: {
+            required: true, type: String
+        },
+        instances: {
+            required: true, type: Array
+        }
+    },
+    computed: {
+        instancesCount () {
+            return this.instances.filter(instance => instance.type === 'instance').length
+        },
+        hasInstances () {
+            return this.instancesCount > 0
+        },
+        devicesCount () {
+            return this.instances.filter(instance => instance.type === 'device').length
+        },
+        hasDevices () {
+            return this.devicesCount > 0
+        }
+    }
+}
+</script>
+
+<style lang="scss">
+.versions-list.ff-accordion {
+  margin: 0;
+
+  button {
+    display: grid;
+    grid-template-columns: repeat(12, 1fr);
+    background: $ff-white;
+    gap: 15px;
+    border: none;
+    border-bottom: 1px solid $ff-grey-300;
+
+    .version {
+      grid-column-start: 2;
+      display: flex;
+      justify-content: flex-start;
+      color: $ff-black;
+      font-weight: 500;
+    }
+
+    .counter {
+      grid-column-start: 3;
+      grid-column-end: 6;
+      display: flex;
+      justify-content: flex-start;
+    }
+
+    .toggle {
+      grid-column-start: 12;
+      display: flex;
+      justify-content: flex-end;
+    }
+  }
+  &:last-child button {
+    border-bottom: none;
+  }
+}
+</style>
diff --git a/frontend/src/pages/application/index.vue b/frontend/src/pages/application/index.vue
index 1732ee9e4f..c5375e8469 100644
--- a/frontend/src/pages/application/index.vue
+++ b/frontend/src/pages/application/index.vue
@@ -104,6 +104,13 @@ export default {
                 },
                 { label: 'Logs', to: `/application/${this.application.id}/logs`, tag: 'application-logs', icon: TerminalIcon },
                 { label: 'Audit Log', to: `/application/${this.application.id}/activity`, tag: 'application-activity', icon: ViewListIcon },
+                {
+                    label: 'Dependencies',
+                    to: `/application/${this.application.id}/dependencies`,
+                    tag: 'application-dependencies',
+                    icon: CogIcon,
+                    hidden: !this.hasPermission('application:bom')
+                },
                 { label: 'Settings', to: `/application/${this.application.id}/settings`, tag: 'application-settings', icon: CogIcon }
             ]
 
diff --git a/frontend/src/pages/application/routes.js b/frontend/src/pages/application/routes.js
index 6e313b085c..a33c3a1d82 100644
--- a/frontend/src/pages/application/routes.js
+++ b/frontend/src/pages/application/routes.js
@@ -5,6 +5,7 @@
  * No new functionality should be added here.
  */
 import ApplicationActivity from './Activity.vue'
+import Dependencies from './Dependencies/Dependencies.vue'
 import ApplicationDeviceGroupDevices from './DeviceGroup/devices.vue'
 import ApplicationDeviceGroupIndex from './DeviceGroup/index.vue'
 import ApplicationDeviceGroupSettings from './DeviceGroup/settings.vue'
@@ -135,6 +136,14 @@ export default [
                         }
                     }
                 ]
+            },
+            {
+                path: 'dependencies',
+                name: 'Dependencies',
+                component: Dependencies,
+                meta: {
+                    title: 'Dependencies'
+                }
             }
         ]
     },
diff --git a/test/e2e/frontend/cypress/fixtures/applications/dependencies.json b/test/e2e/frontend/cypress/fixtures/applications/dependencies.json
new file mode 100644
index 0000000000..5aee153db6
--- /dev/null
+++ b/test/e2e/frontend/cypress/fixtures/applications/dependencies.json
@@ -0,0 +1,174 @@
+{
+  "instances": [
+    {
+      "id": "1",
+      "name": "instance-1"
+    },
+    {
+      "id": "2",
+      "name": "instance-2"
+    },
+    {
+      "id": "3",
+      "name": "instance-3"
+    }
+  ],
+  "statuses": [
+    {
+      "id": "1",
+      "name": "instance-1",
+      "meta": {
+        "state": "running"
+      }
+    },
+    {
+      "id": "2",
+      "name": "instance-2",
+      "meta": {
+        "state": "suspended"
+      }
+    },
+    {
+      "id": "3",
+      "name": "instance-3",
+      "meta": {
+        "state": "running"
+      }
+    }
+  ],
+  "dependencies": [
+    {
+      "id": "1",
+      "name": "instance-1",
+      "type": "instance",
+      "dependencies": [
+        {
+          "name": "@package/dep-1",
+          "version": {
+            "semver": "1.1.1",
+            "installed": "1.1.1"
+          }
+        },
+        {
+          "name": "@package/var-2",
+          "version": {
+            "semver": "~1.15.0",
+            "installed": "1.15.0"
+          }
+        },
+        {
+          "name": "@external/sem-3",
+          "version": {
+            "semver": "~2.1.1",
+            "installed": "2.1.1"
+          }
+        }
+      ]
+    },
+    {
+      "id": "2",
+      "name": "instance-2",
+      "type": "instance",
+      "dependencies": [
+        {
+          "name": "@package/dep-1",
+          "version": {
+            "semver": "2.2.2",
+            "installed": "2.2.2"
+          }
+        },
+        {
+          "name": "@package/var-2",
+          "version": {
+            "semver": "3.3.3",
+            "installed": "3.3.3"
+          }
+        },
+        {
+          "name": "@external/sem-3",
+          "version": {
+            "semver": "4.4.4",
+            "installed": "4.4.4"
+          }
+        }
+      ]
+    },
+    {
+      "id": "3",
+      "name": "instance-3",
+      "type": "instance",
+      "dependencies": [
+        {
+          "name": "@package/dep-1",
+          "version": {
+            "semver": "5.5.5",
+            "installed": "5.5.5"
+          }
+        },
+        {
+          "name": "@package/var-2",
+          "version": {
+            "semver": "6.6.6",
+            "installed": "7.7.7"
+          }
+        },
+        {
+          "name": "@external/sem-3",
+          "version": {
+            "semver": "8.8.8",
+            "installed": "8.8.8"
+          }
+        },
+        {
+          "name": "@lonely/package-1",
+          "version": {
+            "semver": "1.0.0",
+            "installed": "1.0.0"
+          }
+        }
+      ]
+    },
+    {
+      "id": "4",
+      "name": "device-1",
+      "type": "device",
+      "dependencies": [
+        {
+          "name": "@package/var-2",
+          "version": {
+            "semver": "6.6.6",
+            "installed": "7.7.7"
+          }
+        }
+      ]
+    },
+    {
+      "id": "5",
+      "name": "device-2",
+      "type": "device",
+      "dependencies": [
+        {
+          "name": "@external/sem-3",
+          "version": {
+            "semver": "8.8.8",
+            "installed": "8.8.8"
+          }
+        }
+      ]
+    },
+    {
+      "id": "6",
+      "name": "device-3",
+      "type": "device",
+      "dependencies": [
+        {
+          "name": "@some-package/var",
+          "version": {
+            "semver": "1.2.0",
+            "installed": "1.1.1"
+          }
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/test/e2e/frontend/cypress/tests-ee/applications/dependencies.spec.js b/test/e2e/frontend/cypress/tests-ee/applications/dependencies.spec.js
new file mode 100644
index 0000000000..da37c69712
--- /dev/null
+++ b/test/e2e/frontend/cypress/tests-ee/applications/dependencies.spec.js
@@ -0,0 +1,258 @@
+import dependencies from '../../fixtures/applications/dependencies.json'
+const interceptBom = (dependencies = []) => {
+    cy.intercept('GET', '/api/*/applications/*/bom', {
+        id: 'app-id',
+        name: 'application-2',
+        children: [...dependencies]
+    }).as('getBom')
+}
+describe('FlowForge - Application - Dependencies', () => {
+    let application
+    function navigateToApplication (teamName, projectName, instances = [], statuses = []) {
+        cy.request('GET', '/api/v1/user/teams')
+            .then((response) => {
+                const team = response.body.teams.find(
+                    (team) => team.name === teamName
+                )
+
+                if (instances.length) {
+                    cy.intercept('GET', '/api/*/applications/*/instances/status', {
+                        count: instances.length,
+                        instances
+                    }).as('getStatuses')
+                }
+                if (statuses.length) {
+                    cy.intercept('GET', '/api/*/applications/*/instances', {
+                        count: statuses.length,
+                        instances: statuses
+                    }).as('getInstances')
+                }
+
+                return cy.request('GET', `/api/v1/teams/${team.id}/applications`)
+            })
+            .then((response) => {
+                application = response.body.applications.find(
+                    (app) => app.name === projectName
+                )
+                cy.visit(`/application/${application.id}/instances`)
+
+                if (instances.length) {
+                    cy.wait('@getStatuses')
+                }
+                if (instances.length) {
+                    cy.wait('@getInstances')
+                }
+
+                cy.wait('@getApplication')
+            })
+    }
+
+    describe('Bill of Materials disabled teams', () => {
+        beforeEach(() => {
+            cy.intercept('GET', '/api/*/applications/*').as('getApplication')
+
+            cy.login('bob', 'bbPassword')
+            cy.home()
+            navigateToApplication('BTeam', 'application-2')
+        })
+
+        it('owners should have access to the dependencies tab but won\'t have access to the feature if the team feature is not enabled', () => {
+            cy.visit(`/application/${application.id}`)
+            cy.get('[data-nav="application-dependencies"]').click()
+
+            cy.get('[data-el="page-banner-feature-unavailable-to-team"]').contains('This feature is not available for your current Team. Please upgrade your Team in order to use it.')
+            cy.get('[data-el="empty-state"]').contains('Your application doesn\'t contain any Instances or Devices')
+        })
+
+        it('members should not have access to the dependencies tab and page', () => {
+            cy.intercept('GET', '/api/*/teams/*/user', { role: 40 }).as('getTeamRole')
+
+            cy.visit(`/application/${application.id}`)
+
+            cy.get('[data-nav="application-dependencies"]').should('not.exist')
+
+            cy.visit(`/application/${application.id}/dependencies`)
+
+            cy.url().should('not.include', '/dependencies')
+            cy.url().should('include', '/instances')
+        })
+    })
+
+    describe('Bill of Materials enabled teams', () => {
+        beforeEach(() => {
+            cy.intercept('GET', '/api/*/teams/*/user', { role: 50 }).as('getTeamRole')
+            cy.intercept('GET', '/api/*/teams/slug/*', (req) => {
+                req.reply((response) => {
+                    // ensure we keep bom enabled
+                    response.body.type.properties.features.bom = true
+                    return response
+                })
+            }).as('getTeam')
+
+            cy.intercept('GET', '/api/*/applications/*').as('getApplication')
+
+            cy.login('bob', 'bbPassword')
+            cy.home()
+
+            navigateToApplication('BTeam', 'application-2', dependencies.instances, dependencies.statuses)
+            cy.wait('@getTeam')
+        })
+
+        it('have access to the dependencies tab and get an empty page when the application doesn\'t have instances or devices assigned', () => {
+            interceptBom()
+            cy.get('[data-nav="application-dependencies"]').click()
+
+            cy.get('[data-el="page-banner-feature-unavailable-to-team"]').should('not.exist')
+            cy.get('[data-el="empty-state"]').contains('Your application doesn\'t contain any Instances or Devices')
+        })
+
+        it('have access to the dependencies tab and can search by name', () => {
+            cy.intercept('GET', 'https://registry.npmjs.com/**', {
+                'dist-tags': {
+                    latest: 'x.x.x'
+                },
+                time: {
+                    modified: new Date()
+                }
+            }
+            ).as('getExternalDependency')
+            interceptBom(dependencies.dependencies)
+
+            cy.get('[data-nav="application-dependencies"]').click()
+            cy.wait('@getExternalDependency')
+
+            cy.get('[data-el="dependency-item"]').should('have.length', 5)
+
+            // can search by instance name
+            cy.get('[data-form="search"] input').type('instance-x')
+            cy.get('[data-el="dependency-item"]').should('have.length', 0)
+            cy.contains('Oops! We couldn\'t find any matching results.')
+
+            cy.get('[data-form="search"] input').clear()
+            cy.get('[data-form="search"] input').type('instance-1')
+            cy.get('[data-el="dependency-item"]').should('have.length', 3)
+            cy.get('[data-el="dependency-item"]').contains('@package/dep-1')
+                .parent()
+                .parent()
+                .parent()
+                .within(() => {
+                    cy.get('[data-el="versions-list"] button').click()
+                    cy.get('[data-el="versions-list"] button').contains('1 x Instances')
+                    cy.get('[data-el="versions-list"]')
+                        .within(() => {
+                            cy.get('[data-el="instance-item"]').should('have.length', 1)
+                            cy.contains('instance-1')
+                        })
+                })
+            cy.get('[data-el="dependency-item"]').contains('@package/var-2')
+                .parent()
+                .parent()
+                .parent()
+                .within(() => {
+                    cy.get('[data-el="versions-list"] button').click()
+                    cy.get('[data-el="versions-list"] button').contains('1 x Instances')
+                    cy.get('[data-el="versions-list"]')
+                        .within(() => {
+                            cy.get('[data-el="instance-item"]').should('have.length', 1)
+                            cy.contains('instance-1')
+                        })
+                })
+            cy.get('[data-el="dependency-item"]').contains('@external/sem-3')
+                .parent()
+                .parent()
+                .parent()
+                .within(() => {
+                    cy.get('[data-el="versions-list"] button').click()
+                    cy.get('[data-el="versions-list"] button').contains('1 x Instances')
+                    cy.get('[data-el="versions-list"]')
+                        .within(() => {
+                            cy.get('[data-el="instance-item"]').should('have.length', 1)
+                            cy.contains('instance-1')
+                        })
+                })
+        })
+
+        it('have access to the dependencies tab and can search by instance type', () => {
+            cy.intercept('GET', 'https://registry.npmjs.com/**', {
+                'dist-tags': {
+                    latest: 'x.x.x'
+                },
+                time: {
+                    modified: new Date()
+                }
+            }
+            ).as('getExternalDependency')
+            interceptBom(dependencies.dependencies)
+
+            cy.get('[data-nav="application-dependencies"]').click()
+            cy.wait('@getExternalDependency')
+
+            cy.get('[data-el="dependency-item"]').should('have.length', 5)
+
+            // can search by instance type
+            cy.get('[data-form="search"] input').type('instance')
+            cy.get('[data-el="dependency-item"]').should('have.length', 4)
+
+            cy.contains('x Devices').should('not.exist')
+
+            // can search by instance type
+            cy.get('[data-form="search"] input').clear()
+            cy.get('[data-form="search"] input').type('device')
+            cy.get('[data-el="dependency-item"]').should('have.length', 3)
+
+            cy.contains('x Instances').should('not.exist')
+        })
+
+        it('have access to the dependencies tab and can search by package name', () => {
+            cy.intercept('GET', 'https://registry.npmjs.com/**', {
+                'dist-tags': {
+                    latest: 'x.x.x'
+                },
+                time: {
+                    modified: new Date()
+                }
+            }
+            ).as('getExternalDependency')
+            interceptBom(dependencies.dependencies)
+
+            cy.get('[data-nav="application-dependencies"]').click()
+            cy.wait('@getExternalDependency')
+
+            cy.get('[data-el="dependency-item"]').should('have.length', 5)
+
+            // can search by package name
+            cy.get('[data-form="search"] input').type('@lonely/package-1')
+            cy.get('[data-el="dependency-item"]').should('have.length', 1)
+
+            cy.get('[data-form="search"] input').clear()
+            cy.get('[data-form="search"] input').type('var')
+            cy.get('[data-el="dependency-item"]').should('have.length', 2)
+        })
+
+        it('have access to the dependencies tab and can search by package version', () => {
+            cy.intercept('GET', 'https://registry.npmjs.com/**', {
+                'dist-tags': {
+                    latest: 'x.x.x'
+                },
+                time: {
+                    modified: new Date()
+                }
+            }
+            ).as('getExternalDependency')
+            interceptBom(dependencies.dependencies)
+
+            cy.get('[data-nav="application-dependencies"]').click()
+            cy.wait('@getExternalDependency')
+
+            cy.get('[data-el="dependency-item"]').should('have.length', 5)
+
+            // can search by package version
+            cy.get('[data-form="search"] input').type('4.4.4')
+            cy.get('[data-el="dependency-item"]').should('have.length', 1)
+
+            cy.get('[data-form="search"] input').clear()
+            cy.get('[data-form="search"] input').type('1.1.1')
+            cy.get('[data-el="dependency-item"]').should('have.length', 2)
+        })
+    })
+})
diff --git a/test/e2e/frontend/cypress/tests/applications/dependencies.spec.js b/test/e2e/frontend/cypress/tests/applications/dependencies.spec.js
new file mode 100644
index 0000000000..483ac7d8b0
--- /dev/null
+++ b/test/e2e/frontend/cypress/tests/applications/dependencies.spec.js
@@ -0,0 +1,48 @@
+describe('FlowForge - Application - Dependencies', () => {
+    let application
+    function navigateToApplication (teamName, projectName) {
+        cy.request('GET', '/api/v1/user/teams')
+            .then((response) => {
+                const team = response.body.teams.find(
+                    (team) => team.name === teamName
+                )
+                return cy.request('GET', `/api/v1/teams/${team.id}/applications`)
+            })
+            .then((response) => {
+                application = response.body.applications.find(
+                    (app) => app.name === projectName
+                )
+                cy.visit(`/application/${application.id}/instances`)
+                cy.wait('@getApplication')
+            })
+    }
+
+    beforeEach(() => {
+        cy.intercept('GET', '/api/*/applications/*').as('getApplication')
+
+        cy.login('bob', 'bbPassword')
+        cy.home()
+        navigateToApplication('BTeam', 'application-2')
+    })
+
+    it('owners should have access to the dependencies tab but won\'t have access to the feature', () => {
+        cy.visit(`/application/${application.id}`)
+        cy.get('[data-nav="application-dependencies"]').click()
+
+        cy.get('[data-el="page-banner-feature-unavailable"]').contains('This is a FlowFuse Enterprise feature. Please upgrade your instance of FlowFuse in order to use it.')
+        cy.get('[data-el="empty-state"]').contains('Your application doesn\'t contain any Instances or Devices')
+    })
+
+    it('members should not have access to the dependencies tab and page', () => {
+        cy.intercept('GET', '/api/*/teams/*/user', { role: 40 }).as('getTeamRole')
+
+        cy.visit(`/application/${application.id}`)
+
+        cy.get('[data-nav="application-dependencies"]').should('not.exist')
+
+        cy.visit(`/application/${application.id}/dependencies`)
+
+        cy.url().should('not.include', '/dependencies')
+        cy.url().should('include', '/instances')
+    })
+})
diff --git a/test/unit/forge/db/models/Application_spec.js b/test/unit/forge/db/models/Application_spec.js
new file mode 100644
index 0000000000..f6917e7fe7
--- /dev/null
+++ b/test/unit/forge/db/models/Application_spec.js
@@ -0,0 +1,147 @@
+const should = require('should') // eslint-disable-line
+const setup = require('../setup')
+
+describe('Application model', function () {
+    // Use standard test data.
+    let app
+    /** @type {import('../../../../lib/TestModelFactory')} */
+    let factory = null
+
+    before(async function () {
+        app = await setup()
+        factory = app.factory
+    })
+    after(async function () {
+        await app.close()
+    })
+    let Application, Project, Team, Device
+    const nameGenerator = (name) => `${name} ${Math.random().toString(36).substring(7)}`
+    const newProject = async (applicationId, teamId, projectTypeId, projectStackId, projectTemplateId) => {
+        const name = nameGenerator('Test Project')
+        const project = await Project.create({
+            name,
+            safeName: name.toLowerCase().replace(/[^a-z0-9]/g, '-'),
+            type: '',
+            url: '',
+            ApplicationId: applicationId,
+            TeamId: teamId,
+            ProjectTypeId: projectTypeId || null,
+            ProjectStackId: projectStackId || null,
+            ProjectTemplateId: projectTemplateId || null
+        })
+        return project
+    }
+    const newApplication = async (teamId) => {
+        const name = nameGenerator('Test Application')
+        const application = await Application.create({ name, TeamId: teamId })
+        return application
+    }
+    const newTeam = async (teamTypeId = 1) => {
+        const name = nameGenerator('Test Team')
+        const team = await Team.create({ name, TeamTypeId: teamTypeId })
+        return team
+    }
+
+    describe('Relations', function () {
+        beforeEach(async () => {
+            app.license.defaults.instances = 20; // override default
+            ({ Application, Project, Team, Device } = app.db.models)
+        })
+
+        it('should delete Application when team is deleted', async () => {
+            // Create an application and a project
+            const team = await newTeam()
+            const application = await newApplication(team.id)
+
+            // first assert that they are associated
+            application.TeamId.should.equal(team.id)
+
+            // Delete the team
+            await team.destroy()
+
+            // Reload project to get updated data
+            const updatedApplication = await Application.findByPk(application.id)
+            should.not.exist(updatedApplication)
+        })
+    })
+
+    describe('instance methods', function () {
+        describe('getChildren', function () {
+            beforeEach(async () => {
+                app.license.defaults.instances = 20; // override default
+                ({ Application, Project, Team } = app.db.models)
+            })
+
+            it('should return an child instances, devices and instance devices', async () => {
+                // Create an application and a project
+                const team = await newTeam()
+                const application = await newApplication(team.id)
+                const project = await newProject(application.id, team.id)
+                const appDevice = await factory.createDevice({ name: 'device 1', type: 'test device' }, team, null, application)
+                const instDevice = await factory.createDevice({ name: 'device 1', type: 'test device' }, team, project, null)
+
+                const children = await application.getChildren()
+                should(children).be.an.Array().and.have.length(3)
+                const instance = children.find(c => c.type === 'instance' && c.model.id === project.id)
+                const device1 = children.find(c => c.type === 'device' && c.model.id === appDevice.id)
+                const device2 = children.find(c => c.type === 'device' && c.model.id === instDevice.id)
+
+                instance.should.be.an.Object()
+                instance.model.should.be.an.instanceOf(Project)
+                instance.should.not.have.property('dependencies')
+
+                device1.should.be.an.Object()
+                device1.model.should.be.an.instanceOf(Device)
+                device1.should.have.property('ownerId', application.id)
+                device1.should.have.property('ownerType', 'application')
+                device1.should.not.have.property('dependencies')
+
+                device2.should.be.an.Object()
+                device2.model.should.be.an.instanceOf(Device)
+                device2.should.have.property('ownerType', 'instance')
+                device2.should.have.property('ownerId', project.id)
+                device2.should.not.have.property('dependencies')
+            })
+            it('should return an child instances, devices and instance devices with dependencies', async () => {
+                // Create an application and a project
+                const team = await newTeam()
+                const application = await newApplication(team.id)
+                const project = await newProject(application.id, team.id)
+                const appDevice = await factory.createDevice({ name: 'device 1', type: 'test device' }, team, null, application)
+                const instDevice = await factory.createDevice({ name: 'device 1', type: 'test device' }, team, project, null)
+
+                const children = await application.getChildren({ includeDependencies: true })
+                should(children).be.an.Array().and.have.length(3)
+                const instance = children.find(c => c.type === 'instance' && c.model.id === project.id)
+                const device1 = children.find(c => c.type === 'device' && c.model.id === appDevice.id)
+                const device2 = children.find(c => c.type === 'device' && c.model.id === instDevice.id)
+
+                const checkDeps = (item) => {
+                    item.should.have.property('dependencies').and.be.an.Object()
+                    Object.entries(item.dependencies).forEach(([key, value]) => {
+                        key.should.be.a.String()
+                        value.should.be.an.Object()
+                        value.should.have.property('semver')
+                        value.should.have.property('installed')
+                    })
+                }
+
+                instance.should.be.an.Object()
+                instance.model.should.be.an.instanceOf(Project)
+                checkDeps(instance)
+
+                device1.should.be.an.Object()
+                device1.model.should.be.an.instanceOf(Device)
+                device1.should.have.property('ownerId', application.id)
+                device1.should.have.property('ownerType', 'application')
+                checkDeps(device1)
+
+                device2.should.be.an.Object()
+                device2.model.should.be.an.instanceOf(Device)
+                device2.should.have.property('ownerType', 'instance')
+                device2.should.have.property('ownerId', project.id)
+                checkDeps(device2)
+            })
+        })
+    })
+})
diff --git a/test/unit/forge/ee/routes/api/application_spec.js b/test/unit/forge/ee/routes/api/application_spec.js
new file mode 100644
index 0000000000..a35ba542c2
--- /dev/null
+++ b/test/unit/forge/ee/routes/api/application_spec.js
@@ -0,0 +1,173 @@
+const should = require('should') // eslint-disable-line
+const sinon = require('sinon')
+
+const setup = require('../../setup.js')
+
+const FF_UTIL = require('flowforge-test-utils')
+const { Roles } = FF_UTIL.require('forge/lib/roles')
+
+describe('Application API', function () {
+    let app
+    const TestObjects = {
+        /** admin - owns ateam */
+        alice: {},
+        /** owner of bteam */
+        bob: {},
+        /** member of b team */
+        chris: {},
+        /** not connected to any teams */
+        dave: {},
+        ATeam: {},
+        BTeam: {},
+        /** B-team Application */
+        application: {},
+        /** B-team Instance */
+        instance: {},
+        /** B-team Instance device */
+        device1: {},
+        /** B-team Application Device */
+        device2: {}
+
+    }
+    /** @type {import('../../../../../lib/TestModelFactory')} */
+    let factory = null
+    let objectCount = 0
+    const generateName = (root = 'object') => `${root}-${objectCount++}`
+
+    before(async function () {
+        app = await setup()
+        factory = app.factory
+
+        // ATeam ( alice  (owner), bob )
+        // BTeam ( bob (owner), chris )
+
+        // Alice create in setup()
+        TestObjects.alice = await app.db.models.User.byUsername('alice')
+        TestObjects.bob = await app.db.models.User.create({ username: 'bob', name: 'Bob Solo', email: 'bob@example.com', email_verified: true, password: 'bbPassword' })
+        TestObjects.chris = await app.db.models.User.create({ username: 'chris', name: 'Chris Crackers', email: 'chris@example.com', email_verified: true, password: 'ccPassword' })
+        TestObjects.dave = await app.db.models.User.create({ username: 'dave', name: 'Dave Smith', email: 'dave@example.com', email_verified: true, password: 'ddPassword' })
+
+        // ATeam create in setup()
+        TestObjects.ATeam = await app.db.models.Team.byName('ATeam')
+
+        // Need to give the default TeamType permission to use DeviceGroup feature
+        const defaultTeamTypeProperties = app.defaultTeamType.properties
+        defaultTeamTypeProperties.features.deviceGroups = true
+        defaultTeamTypeProperties.features.bom = true
+        app.defaultTeamType.properties = defaultTeamTypeProperties
+        await app.defaultTeamType.save()
+        TestObjects.BTeam = await app.db.models.Team.create({ name: 'BTeam', TeamTypeId: app.defaultTeamType.id })
+
+        // alice : admin - owns ateam (setup)
+        // bob - owner of bteam
+        // chris - member of b team
+        // dave - not connected to any teams
+        await TestObjects.BTeam.addUser(TestObjects.bob, { through: { role: Roles.Owner } })
+        await TestObjects.BTeam.addUser(TestObjects.chris, { through: { role: Roles.Member } })
+
+        TestObjects.application = await app.db.models.Application.create({
+            name: 'B-team Application',
+            description: 'B-team Application description',
+            TeamId: TestObjects.BTeam.id
+        })
+        TestObjects.instance = await factory.createInstance({ name: generateName('B-team-instance') }, TestObjects.application, app.stack, app.template, app.projectType, { start: false })
+        TestObjects.device1 = await factory.createDevice({ name: generateName('device') }, TestObjects.ATeam, TestObjects.instance, null)
+        TestObjects.device2 = await factory.createDevice({ name: generateName('device') }, TestObjects.BTeam, null, TestObjects.application)
+    })
+
+    async function login (username, password) {
+        const response = await app.inject({
+            method: 'POST',
+            url: '/account/login',
+            payload: { username, password, remember: false }
+        })
+        response.cookies.should.have.length(1)
+        response.cookies[0].should.have.property('name', 'sid')
+        return response.cookies[0].value
+    }
+
+    after(async function () {
+        await app.close()
+    })
+
+    beforeEach(async function () {
+        sinon.stub(app.comms.devices, 'sendCommand').resolves()
+    })
+
+    afterEach(async function () {
+        app.comms.devices.sendCommand.restore()
+    })
+
+    describe('BOM', async function () {
+        it('Owner can get Application BOM', async function () {
+            const sid = await login('bob', 'bbPassword')
+
+            const response = await app.inject({
+                method: 'GET',
+                url: `/api/v1/applications/${TestObjects.application.hashid}/bom`,
+                cookies: { sid }
+            })
+
+            response.statusCode.should.equal(200)
+
+            const depsCheck = (item) => {
+                should(item.dependencies).be.an.Array()
+                item.dependencies.forEach(dep => {
+                    should(dep).be.an.Object()
+                    dep.should.have.properties('name', 'version')
+                    dep.version.should.have.properties('semver', 'installed')
+                })
+            }
+
+            const result = response.json()
+            should(result).be.an.Object()
+            result.should.have.properties('id', 'name', 'children')
+            result.id.should.equal(TestObjects.application.hashid)
+            result.name.should.equal(TestObjects.application.name)
+            result.children.should.be.an.Array().and.have.length(3)
+
+            const instance = result.children.find(c => c.type === 'instance' && c.id === TestObjects.instance.id)
+            should(instance).be.an.Object()
+            instance.should.have.property('name', TestObjects.instance.name)
+            instance.should.have.property('type', 'instance')
+            depsCheck(instance)
+
+            const device1 = result.children.find(c => c.type === 'device' && c.id === TestObjects.device1.hashid)
+            should(device1).be.an.Object()
+            device1.should.have.property('name', TestObjects.device1.name)
+            device1.should.have.property('ownerType', 'instance')
+            device1.should.have.property('ownerId', TestObjects.instance.id)
+            depsCheck(device1)
+
+            const device2 = result.children.find(c => c.type === 'device' && c.id === TestObjects.device2.hashid)
+            should(device2).be.an.Object()
+            device2.should.have.property('name', TestObjects.device2.name)
+            device2.should.have.property('ownerType', 'application')
+            device2.should.have.property('ownerId', TestObjects.application.hashid)
+            depsCheck(device2)
+        })
+
+        // 401 means not logged in where as 403 means logged in but not authorized
+        it('Non Owner can not get BOM (403)', async function () {
+            const sid = await login('chris', 'ccPassword')
+            const response = await app.inject({
+                method: 'GET',
+                url: `/api/v1/applications/${TestObjects.application.hashid}/bom`,
+                cookies: { sid }
+            })
+
+            response.statusCode.should.equal(403)
+        })
+
+        it('Non Member can not get BOM (404)', async function () {
+            const sid = await login('dave', 'ddPassword')
+            const response = await app.inject({
+                method: 'GET',
+                url: `/api/v1/applications/${TestObjects.application.hashid}/bom`,
+                cookies: { sid }
+            })
+
+            response.statusCode.should.equal(404)
+        })
+    })
+})