Comparing SBOM Versions
Compare two versions of an asset to see which components, vulnerabilities, and licenses changed between them.
Version comparison shows what changed between two versions of the same asset: the components that were added or removed, the vulnerabilities those component changes brought in or took away, and the licenses that changed with them. Use it to review an upgrade before release, to explain why a new version has more vulnerabilities, or to check that a fix actually removed a vulnerable package.
A version comparison always has two sides:
- Baseline: the version you are comparing from, usually the older one.
- Comparison: the version you are comparing to, usually the newer one.
Added means the item is in the comparison version but not in the baseline. Removed means it is in the baseline but not in the comparison version.
Before you start
- Both versions must belong to the same asset, which means they appear in the same asset's Versions tab.
- You need permission to view assets, components, vulnerabilities, and licenses. The Vulnerabilities and Licenses tabs and the XLSX export need the matching permission. If you open a comparison you cannot access, the drawer shows You do not have access to this comparison.
- Version comparison is enabled per organization. If you do not see the Compare SBOMs button on the Versions tab, contact [email protected].
Compare two versions
- Go to Assets in the left menu and select the asset.
- Open the Versions tab.
- Select the checkboxes of the two versions you want to compare. The first version you select becomes the Baseline and the second becomes the Comparison. Selecting a third version drops the first one.
- Click Compare SBOMs. The Version Comparison drawer opens.
You can also click Compare SBOMs with one or no versions selected and pick the versions in the drawer. Each click on a version in the list fills the next empty side. The newest version is marked Latest.
To change a side, clear it and pick another version. To reverse the comparison, click Swap baseline and comparison.
The page URL includes both versions, so you can bookmark a comparison or share the link with a teammate who has access to the asset.
Read the summary cards
The cards at the top of the drawer show each version's stored totals side by side, with the net change between them:
- Asset Risk
- Components
- Vulnerabilities
- Critical (critical vulnerabilities)
- License Issues
Why the cards and the Vulnerabilities tab can disagree: the cards show each version's total vulnerability counts as stored for that version. The Vulnerabilities tab lists only the CVEs caused by component changes between the two versions. A CVE that affects both versions is counted on both cards but does not appear in the tab, so the net change on the card and the number of rows in the tab can differ.
Review the changes
The drawer has three tabs. Each tab lists only changes. Anything that is the same in both versions is not listed. Use the search box to find a row, and use the filter to show only Added or Removed rows.
Components
Lists each component version that is present in one version of the asset and not in the other.
Components are matched by package, so an upgrade shows as two rows: the old version as Removed and the new version as Added. A package that keeps the same version in both asset versions is not listed.
| Column | Description |
|---|---|
| +/- | Added or Removed. |
| Component | The component name. |
| Version | The component version. |
| pURL | The component's package URL. |
| Relationship | Whether the component is a direct or transitive dependency. See Understanding Direct and Transitive Dependencies. |
Vulnerabilities
Lists the CVEs caused by component changes: CVEs that affect an added or removed component and are found in only one of the two versions.
- An Added CVE affects a component that was added in the comparison version and is not found anywhere in the baseline.
- A Removed CVE affects a component that was removed from the baseline and is not found anywhere in the comparison version.
- A CVE that is still present in the other version through another component is not listed, because the component change did not add or remove it.
- A CVE that affects several changed components is listed once per affected component.
| Column | Description |
|---|---|
| +/- | Added or Removed. |
| CVE | The CVE ID. |
| Severity | The CVE severity. |
| CVSS | The CVSS score. |
| EPSS | The EPSS score. |
| KEV | Whether the CVE is on the CISA Known Exploited Vulnerabilities (KEV) list. |
| Affected Component | The added or removed component that carries the CVE. |
| Relationship | Whether the affected component is a direct or transitive dependency. |
On this tab you can also filter by severity.
Older versions are not re-scanned for this comparison. Each version's vulnerabilities come from the last time that version was scanned. A recently published CVE can show as Added on an upgraded package even if the old version of the package was also affected, because the older asset version was scanned before the CVE was published.
Licenses
Lists license changes on the components that changed: a license that an added or removed component carries in one version, and that the same package does not carry in the other version. If a package is upgraded and keeps the same license, no license row is listed.
| Column | Description |
|---|---|
| +/- | Added or Removed. |
| Affected Component | The component and version that carries the license. |
| License | The license name. |
| Risk | Approved, Review, or Forbidden, based on your organization's license settings. Empty when Manifest could not match the license to a known license. See License Detection. |
Export the comparison
Click Export XLSX to download the full comparison as a spreadsheet. The file is named <asset>_<baseline version>_vs_<comparison version>.xlsx and has three sheets:
| Sheet | Columns |
|---|---|
| Components | Change, Component, Version, Package URL, Relationship |
| Vulnerabilities | Change, CVE, Severity, CVSS, EPSS, KEV, Component, Version, Relationship, Recommendation |
| Licenses | Change, Component, Version, License, Risk |
The export always contains every change between the two versions. Searches and filters in the drawer do not apply to it.
If the download fails with Other exports are being prepared right now. Try again in a moment., wait a few seconds and click Export XLSX again. If a comparison has more rows than a spreadsheet can hold, read it page by page with the API instead.
Compare versions with the API
Every view in the drawer, and the export, is available through the Manifest API. See Comparing SBOM Versions with the API.
Updated about 5 hours ago