TraceGuardDocs

BOMs & version history

Browse a project's BOMs, inspect a version, and diff what changed.

Each project keeps every BOM version it has received. The BOMs view lists them newest-first — tagged with their source and (for Git sources) the commit — so you can see exactly what was known at any point.

Inspecting an SBOM

Open a BOM to see four tabs:

  • Overview — metadata, source, BOM type, and parse/scan status.
  • Components — everything the BOM declares, with versions.
  • Vulnerabilities — findings for this version, ranked by severity / KEV / EPSS.
  • History — the version lineage, with summary chips for what changed.

From here you can download the original file or trigger a re-scan.

Diffing versions

The real power is comparing versions. From History, open the detailed diff against the previous (or any sibling) BOM in the same lineage. It shows:

  • Vulnerabilities — findings introduced, removed, or changed between versions (so you can see whether a release made you safer or riskier).
  • Components — packages added, removed, or version-bumped.

This turns "did that dependency update help?" into a concrete, evidenced answer — and feeds the assurance log.

Versions dedupe by content hash: pushing an identical BOM won't create a new entry, so the history reflects real change, not noise.