BOMs & version history
Browse a project's BOMs, inspect a version, and diff what changed.
Each project keeps every BOM version it has received. The BOMs view lists them newest-first — tagged with their source and (for Git sources) the commit — so you can see exactly what was known at any point.
Inspecting an SBOM
Open a BOM to see four tabs:
- Overview — metadata, source, BOM type, and parse/scan status.
- Components — everything the BOM declares, with versions.
- Vulnerabilities — findings for this version, ranked by severity / KEV / EPSS.
- History — the version lineage, with summary chips for what changed.
From here you can download the original file or trigger a re-scan.
Diffing versions
The real power is comparing versions. From History, open the detailed diff against the previous (or any sibling) BOM in the same lineage. It shows:
- Vulnerabilities — findings introduced, removed, or changed between versions (so you can see whether a release made you safer or riskier).
- Components — packages added, removed, or version-bumped.
This turns "did that dependency update help?" into a concrete, evidenced answer — and feeds the assurance log.
Versions dedupe by content hash: pushing an identical BOM won't create a new entry, so the history reflects real change, not noise.