📦 SBOM Diff Report

Generated by sbomlyze · 2026-11-02T03:07:26Z

SBOM Comparison

BeforeAfter
Fileprevious.cdx.jsoncurrent.cdx.json
File Size1 MB890 KB
Formatsyftsyft
Components881694
PURL Coverage80.5%87.2%
License Coverage0.0%0.0%
Hash Coverage14.6%6.9%
2
Added
122
Removed
2
Changed

Key Findings

📉 Attack surface: -187 packages (-21.2%)
❌ maven ecosystem entirely removed (62 → 0 packages)
🔄 1 version upgrades (1 major) among 759 shared packages
✅ Core system packages stable: cargo (481), pypi (21) unchanged

Drift Summary

TypeCountStatus
Version2✅ OK
Integrity0✅ OK
Metadata0✅ OK
➕ Added Components (2)
NameVersionTypeLicense
@types/node24.3.1npm—
undici-types7.10.0npm—
➖ Removed Components (122)
NameVersionTypeLicense
./.github/actions/install-airbyte-ciUNKNOWNunknown—
file_exclusion0.1.0unknown—
astral-sh/setup-uvv3github—
docker/login-actionv3github—
foo/bar25b062c917b0c75f8b47d8469aff6c94ffd89abbgithub—
frabert/replace-string-actionv2.5github—
jwalton/gh-docker-logsv2github—
lycheeverse/lychee-actionv2.0.2github—
nick-fields/retryv3github—
example.com/testv0.1.0golang—
github.com/linode/linode-docs-themev0.0.0-20220622135843-166f108e1933golang—
github.com/microsoft/go-mssqldbv0.12.0golang—
golang.org/x/netv0.0.0-20200505041828-1ed23360d12cgolang—
main-module1.0maven—
maven-add-exports-module-flags1.0-SNAPSHOTmaven—
maven-execution-specific-java-version1.0-SNAPSHOTmaven—
maven-java16-with-higher-jdk1.0-SNAPSHOTmaven—
maven-java8-java11-dependency1.0-SNAPSHOTmaven—
maven-multimodule-test-java-version1.0maven—
maven-sample1.0-SNAPSHOTmaven—
maven-wrapper-missing-properties-test1.0-SNAPSHOTmaven—
maven3-fetch-maven4-wrapper-test1.0.0maven—
submod11.0-SNAPSHOTmaven—
submod21.0-SNAPSHOTmaven—
test-module1.0maven—
otherreleasetest1.0maven—
snapshottest1.0-SNAPSHOTmaven—
vulnerable-jsp-app1.0.0-SNAPSHOTmaven—
my-app1.0-SNAPSHOTmaven—
asdkfj1.0-SNAPSHOTmaven—
javax.servlet-api3.1.0maven—
junit-nonesuch4.11maven—
junit4.11maven—
junit-nonesuch4.11maven—
commons-lang33.14.0maven—
apache-jsp9.3.3.v20150827maven—
apache-jstl9.3.3.v20150827maven—
jetty-annotations9.3.3.v20150827maven—
jetty-webapp9.3.3.v20150827maven—
jenkins-war2.249maven—
testng7.7.0maven—
/go/ql/integration-tests/two-go-mods-not-nested/src/subdir2/go.modunknown—
/java/ql/integration-tests/java/maven-enforcer-multiple-versions/pom.xmlunknown—
/java/ql/integration-tests/java/buildless-sibling-projects/maven-project-1/pom.xmlunknown—
/go/ql/integration-tests/extract-vendor/src/go.modunknown—
/go/ql/integration-tests/two-go-mods-one-failure/src/subdir1/go.modunknown—
/java/ql/integration-tests/java/java-web-jsp/pom.xmlunknown—
/java/ql/integration-tests/java/diagnostics/multiple-candidate-builds/maven-project-2/pom.xmlunknown—
/java/ql/integration-tests/java/maven-multimodule-test-java-version/main-module/pom.xmlunknown—
/go/ql/integration-tests/single-go-work-not-in-root/src/modules/subdir1/go.modunknown—
/java/ql/integration-tests/java/maven-sample-xml-mode-all-gbk-encoding/pom.xmlunknown—
/go/ql/integration-tests/single-go-work-not-in-root/src/modules/subdir2/go.modunknown—
/java/ql/integration-tests/java/maven-sample-large-xml-files/pom.xmlunknown—
/rust/ql/integration-tests/file-exclusions/cargo.lockunknown—
/actions/ql/test/query-tests/security/cwe-829/.github/actions/dangerous-git-checkout/action.ymlunknown—
/actions/ql/test/query-tests/security/cwe-094/.github/actions/action6/action.ymlunknown—
/java/ql/integration-tests/java/buildless-maven-mirrorof/pom.xmlunknown—
/java/ql/integration-tests/java/maven-sample-small-xml-files/pom.xmlunknown—
/go/ql/integration-tests/ninja-sample/src/go.modunknown—
/go/ql/integration-tests/two-go-mods-one-failure/src/subdir2/go.modunknown—
/go/ql/integration-tests/mixed-layout/src/workspace/subdir/go.modunknown—
/go/ql/integration-tests/two-go-mods-nested-none-in-root/src/subdir0/go.modunknown—
/java/ql/integration-tests/java/maven-sample-xml-mode-byname/pom.xmlunknown—
/java/ql/integration-tests/java/buildless-maven-executable-war/pom.xmlunknown—
/java/ql/integration-tests/java/buildless-maven-timeout/pom.xmlunknown—
/actions/ql/test/query-tests/security/cwe-094/.github/actions/external/testorg/testrepo/.github/actions/clone-repo/action.yamlunknown—
/actions/ql/test/query-tests/security/cwe-077/.github/actions/download-artifact-2/action.yamlunknown—
/go/ql/integration-tests/diagnostics/package-not-found-with-go-mod/work/go.modunknown—
/go/ql/integration-tests/single-go-mod-not-in-root/src/subdir/go.modunknown—
/java/ql/integration-tests/java/maven-wrapper-missing-properties/pom.xmlunknown—
/java/ql/integration-tests/java/diagnostics/multiple-candidate-builds/maven-project-1/pom.xmlunknown—
/java/ql/integration-tests/java/buildless-maven/pom.xmlunknown—
/actions/ql/test/query-tests/security/cwe-077/.github/actions/download-artifact/action.yamlunknown—
/java/ql/integration-tests/java/maven-sample-xml-mode-smart/pom.xmlunknown—
/java/ql/integration-tests/java/maven-enforcer-property-version/pom.xmlunknown—
/java/ql/integration-tests/java/maven-multimodule-test-java-version/test-module/pom.xmlunknown—
/java/ql/integration-tests/java/maven-wrapper/pom.xmlunknown—
/go/ql/integration-tests/two-go-mods-nested-none-in-root/src/subdir0/subdir1/go.modunknown—
/java/ql/integration-tests/java/buildless-maven-existing-settings-xml/pom.xmlunknown—
/java/ql/integration-tests/java/maven-wrapper-source-only/pom.xmlunknown—
/java/ql/integration-tests/java/maven-wrapper-script-only/pom.xmlunknown—
/java/ql/integration-tests/java/diagnostics/maven-http-repository/pom.xmlunknown—
/java/ql/integration-tests/java/buildless-inherit-trust-store/pom.xmlunknown—
/actions/ql/integration-tests/filters/src/.github/actions/action-name/action.ymlunknown—
/go/ql/integration-tests/two-go-mods-not-nested/src/subdir1/go.modunknown—
/java/ql/integration-tests/java/maven-java8-java11-dependency/pom.xmlunknown—
/go/ql/integration-tests/single-go-mod-and-go-files-not-under-it/src/subdir/go.modunknown—
/java/ql/integration-tests/java/maven-enforcer-single-version/pom.xmlunknown—
/java/ql/integration-tests/java/buildless-maven-multimodule/submod1/pom.xmlunknown—
/go/ql/integration-tests/single-go-mod-in-root/src/go.modunknown—
/go/ql/integration-tests/bazel-sample-1/src/go.modunknown—
/java/ql/integration-tests/java/diagnostics/compilation-error/pom.xmlunknown—
/java/ql/integration-tests/java/diagnostics/dependency-error/pom.xmlunknown—
/java/ql/integration-tests/java/buildless-maven-multimodule/pom.xmlunknown—
/actions/ql/test/query-tests/security/cwe-094/.github/actions/action7/action.ymlunknown—
/go/ql/integration-tests/two-go-mods-nested-one-in-root/src/go.modunknown—
/go/ql/integration-tests/go-mod-sample/src/go.modunknown—
/actions/ql/test/query-tests/security/cwe-829/.github/actions/unpinned-tag/action.ymlunknown—
/java/ql/integration-tests/java/maven-enforcer/pom.xmlunknown—
/actions/ql/test/query-tests/security/cwe-829/.github/actions/download-artifact-2/action.yamlunknown—
/java/ql/integration-tests/java/maven-execution-specific-java-version/pom.xmlunknown—
/java/ql/integration-tests/java/buildless-sibling-projects/maven-project-2/pom.xmlunknown—
/java/ql/integration-tests/java/buildless-maven-multimodule/submod2/pom.xmlunknown—
/java/ql/integration-tests/java/maven-add-exports-module-flags/pom.xmlunknown—
/java/ql/integration-tests/java/maven-multimodule-test-java-version/pom.xmlunknown—
/java/ql/integration-tests/java/buildless-proxy-maven/pom.xmlunknown—
/actions/ql/test/query-tests/security/cwe-078/.github/actions/run-airbyte-ci/action.yamlunknown—
/actions/ql/test/query-tests/security/cwe-829/.github/actions/download-artifact/action.yamlunknown—
/java/ql/integration-tests/java/buildless-maven-tolerate-unavailable-dependency/pom.xmlunknown—
/java/ql/integration-tests/java/buildless-snapshot-repository/pom.xmlunknown—
/java/ql/integration-tests/java/maven-sample-xml-mode-all/pom.xmlunknown—
/java/ql/integration-tests/java/maven-java16-with-higher-jdk/pom.xmlunknown—
/java/ql/integration-tests/java/maven-download-failure/pom.xmlunknown—
/go/ql/integration-tests/make-sample/src/go.modunknown—
/java/ql/integration-tests/java/maven-sample/pom.xmlunknown—
/go/ql/integration-tests/go-mod-without-version/src/go.modunknown—
/go/ql/integration-tests/two-go-mods-nested-one-in-root/src/subdir1/go.modunknown—
/go/ql/integration-tests/bazel-sample-2/src/go.modunknown—
/java/ql/integration-tests/java/maven-sample-extract-properties/pom.xmlunknown—
/java/ql/integration-tests/java/buildless-dependency-different-repository/pom.xmlunknown—
/java/ql/integration-tests/java/maven_3_fetch_maven_4_wrapper/app/pom.xmlunknown—
/java/ql/integration-tests/java/maven-sample-xml-mode-disabled/pom.xmlunknown—
🔄 Changed Components (2)
NameBeforeAfterDrift
actions/checkout4v5📦 Version
golang.org/x/sysv0.18.0v0.49.0📦 Version