CycloneDX SBOM diff
Compare two CycloneDX JSON SBOMs, say last release's and this one's, and see which components were added, removed or changed, and which versions and licenses changed. Both files are read in your browser and never uploaded.
How to use it
- Open or paste the older SBOM on the left and the newer one on the right. A pasted SBOM is read when you leave the box.
- Read the totals, then the tables. Changed rows show the old and new version, and the old and new licenses when those changed.
- Check the line about licenses: a license that is new to the SBOM is the one to look at first. Run the license checker on the new SBOM to see whether it fits your project's license.
How components are matched
Each file is read the same way as in the SBOM viewer: every component, nested ones included, with its name (prefixed with its group), version, licenses and package URL (purl). Two entries are the same component when their purls match once the version, qualifiers and subpath are removed. So pkg:npm/[email protected] and pkg:npm/[email protected] are one component with a new version. Entries without a purl are matched by name.
A package can be listed more than once, for example when npm installs two versions side by side. The diff compares each package's set of versions and set of licenses, so adding a second copy of an existing package shows as a change, not an addition.
Licenses are compared as text: an SPDX ID, a license name or an SPDX expression, as the file has them. A switch from GPL-3.0 to GPL-3.0-only counts as a license change even though it is the same license under a newer identifier.
Only components are compared. Services, the dependency graph, hashes and vulnerability data are not. If you aren't sure a file is well-formed, check it first with the CycloneDX validator.
Privacy: the files stay in your browser
The page reads both files with your browser's file API and compares them with JavaScript on this page. It makes no network request with the files or anything in them, and stores nothing. You can check this in your browser's developer tools: no request in the network panel carries the files' contents.
SBOMs in AI CodeOps
AI CodeOps keeps SBOM records per project, and the release check your CI calls can deny a change when the project's latest SBOM contains a license you've disallowed. See SBOM and security and the docs. For what an SBOM is and how to use one, read What is software supply chain security?
Embed this tool
Paste this snippet into your own page or docs. The framed copy shows only the tool, with a link back here, and is kept out of search results.
<iframe src="https://aicodeops.dev/tools/sbom-diff?embed=1" title="SBOM diff" width="100%" height="640" style="border:0" loading="lazy"></iframe> <p><a href="https://aicodeops.dev/tools/sbom-diff">SBOM diff</a> by <a href="https://aicodeops.dev/">AI CodeOps</a></p>
Frequently asked questions
Are my SBOMs uploaded anywhere?
No. Both files are read and compared in your browser, and the page sends no request with them. Nothing is stored: reload the page and the comparison is gone.
How does it decide two entries are the same component?
By package URL without the version, so pkg:npm/[email protected] and pkg:npm/[email protected] are one component whose version changed. A component without a package URL is matched by its name, including its group.
What if a package appears more than once?
Some ecosystems install several versions of one package side by side. The diff compares the set of versions and the set of licenses for each package, so a second copy of an existing package shows as a changed component.
Does it support SPDX or CycloneDX XML?
No. Both files must be CycloneDX JSON, of any spec version. Export JSON from your SBOM tool, or convert with the CycloneDX CLI.
Do I need an account?
No. The diff is free and works without signing in.