SBOM Diff

About this tool

SBOM Diff compares two resolved dependency files — an "old" (before) and a "new" (after) — and reports exactly which packages were added, removed, or version-bumped between them. Paste an npm package-lock.json, a Rust Cargo.lock, a Python requirements.txt, or an existing CycloneDX / SPDX software bill of materials on each side, and the tool renders the change set as a human-readable report, a markdown table for a pull request, or machine-readable JSON.

It does not run a package manager or contact a registry. A lockfile or SBOM already records the resolved dependency set, so this tool parses both sides locally in WebAssembly and compares the inventories. That makes it useful for reviewing a dependency update in code review, gating a CI job on unexpected additions, or auditing what a release actually changed. Because the comparison is a pure set diff, identical input always produces byte-identical output.

Worked example

Given this old package-lock.json:

{"name":"my-app","version":"1.0.0","lockfileVersion":3,"packages":{"":{"name":"my-app","version":"1.0.0"},"node_modules/chalk":{"version":"4.1.2"},"node_modules/left-pad":{"version":"1.3.0"}}}

and this new one (chalk bumped, left-pad dropped, lodash added):

{"name":"my-app","version":"1.1.0","lockfileVersion":3,"packages":{"":{"name":"my-app","version":"1.1.0"},"node_modules/chalk":{"version":"5.0.0"},"node_modules/lodash":{"version":"4.17.21"}}}

with output text, the result is:

Dependency diff
  added:     1
  removed:   1
  changed:   1
  unchanged: 0

Added (1)
  + npm [email protected]

Removed (1)
  - npm [email protected]

Changed (1)
  ~ npm chalk 4.1.2 -> 5.0.0  (upgraded)

Switch output to markdown for a pull-request table, or to json for a { "summary": …, "added": …, "removed": …, "changed": … } change report. Each changed package is labelled upgraded, downgraded, or changed.

Limits & notes

• Supported inputs (per side, auto-detected or forced): npm package-lock.json v1/v2/v3, Rust Cargo.lock, pip requirements.txt, CycloneDX JSON, SPDX JSON, and SPDX tag-value SBOMs. The two sides may use different formats.
• Both inputs must be resolved — a lockfile or SBOM, not a manifest like package.json or Cargo.toml. Unresolved version ranges are not expanded.
• The root project (the SBOM's described component) is excluded so its own version bump does not appear as a change. Each side is capped at 200,000 components.
• Version direction (upgraded / downgraded) is computed with a dependency-free dotted-version comparison; a package resolved to more than one version becomes a multi-version changed entry rather than a direction.
• The tool compares the dependency inventory only. It does not diff hashes, licenses, or vulnerability data, and does not fetch anything from a registry.

FAQ