📦 SBOM Diff Report
Generated by sbomlyze · 2026-11-02T03:06:39Z
SBOM Comparison
| Before | After |
|---|
| File | previous.cdx.json | current.cdx.json |
| File Size | 295 KB | 268 KB |
| Format | syft | syft |
| Components | 407 | 369 |
| PURL Coverage | 96.8% | 97.6% |
| License Coverage | 0.0% | 0.0% |
| Hash Coverage | 2.7% | 1.9% |
Key Findings
📉 Attack surface: -38 packages (-9.3%)
❌ npm ecosystem entirely removed (14 → 0 packages)
🔄 8 version upgrades (7 major, 1 minor) among 389 shared packages
✅ Core system packages stable: github (18) unchanged
Drift Summary
| Type | Count | Status |
|---|
| Version | 8 | ✅ OK |
| Integrity | 0 | ✅ OK |
| Metadata | 0 | ✅ OK |
➖ Removed Components (18)
| Name | Version | Type | License |
|---|
| github.com/davecgh/go-spew | v1.1.1 | golang | — |
| github.com/pmezard/go-difflib | v1.0.0 | golang | — |
| go.uber.org/multierr | v1.10.0 | golang | — |
| go.uber.org/zap | v1.27.0 | golang | — |
| gopkg.in/yaml.v3 | v3.0.1 | golang | — |
| @img/sharp-darwin-arm64 | 0.33.5 | npm | — |
| @img/sharp-linux-x64 | 0.33.5 | npm | — |
| axios | 1.6.0 | npm | — |
| color | 4.2.3 | npm | — |
| follow-redirects | 1.15.3 | npm | — |
| ghostty-web | github:rcarmo/ghostty-web#6c1c75b | npm | — |
| lodash | 4.17.21 | npm | — |
| sharp | 0.33.5 | npm | — |
| tracestrings | github:oven-sh/bun.report#912ca63 | npm | — |
| /syft/pkg/cataloger/javascript/test-fixtures/bun/bun.lock | | unknown | — |
| /syft/pkg/cataloger/javascript/test-fixtures/bun-trailing-comma/bun.lock | | unknown | — |
| /syft/pkg/cataloger/golang/internal/gotestdata/go-source/go.mod | | unknown | — |
| /syft/pkg/cataloger/javascript/test-fixtures/bun-variable-tuples/bun.lock | | unknown | — |
🔄 Changed Components (8)
| Name | Before | After | Drift |
|---|
| github.com/go-viper/mapstructure/v2 | v2.2.1 | v2.5.0 | 📦 Version |
| github.com/pelletier/go-toml/v2 | v2.2.3 | v2.4.3 | 📦 Version |
| github.com/sourcegraph/conc | v0.3.0 | v0.3.1-0.20240121214520-5f936abd7ae8 | 📦 Version |
| github.com/spf13/afero | v1.12.0 | v1.15.0 | 📦 Version |
| github.com/spf13/viper | v1.20.1 | v1.21.0 | 📦 Version |
| github.com/stretchr/testify | v1.10.0 | v1.12.1 | 📦 Version |
| golang.org/x/sys | v0.33.0 | v0.48.0 | 📦 Version |
| golang.org/x/text | v0.21.0 | v0.43.0 | 📦 Version |