{
  "slug": "sbom-diff",
  "name": "gizza-ai/sbom-diff",
  "version": "0.1.0",
  "title": "SBOM Diff — compare two lockfiles or SBOMs for dependency changes — gizza.ai",
  "description": "Diff two package-lock.json, Cargo.lock, requirements.txt, or CycloneDX/SPDX SBOMs and see added, removed, and version-bumped dependencies. Runs locally in your browser.",
  "tags": [
    "sbom diff",
    "dependency diff",
    "lockfile diff",
    "package-lock diff",
    "cargo lock diff",
    "cyclonedx",
    "spdx",
    "supply chain",
    "version bump",
    "software bill of materials"
  ],
  "category": "text",
  "urls": {
    "page": "https://gizza.ai/tools/sbom-diff/",
    "markdown": "https://gizza.ai/tools/sbom-diff/index.md",
    "descriptor": "https://gizza.ai/tools/sbom-diff/tool.json",
    "deep_link_example": "https://gizza.ai/tools/sbom-diff/?old=%7B%0A%20%20%22name%22%3A%20%22my-app%22%2C%0A%20%20%22lockfileVersion%22%3A%203%2C%0A%20%20%22packages%22%3A%20%7B%0A%20%20%20%20%22%22%3A%20%7B%20%22name%22%3A%20%22my-app%22%2C%20%22version%22%3A%20%221.0.0%22%20%7D%2C%0A%20%20%20%20%22node_modules%2Fchalk%22%3A%20%7B%20%22version%22%3A%20%224.1.2%22%20%7D%0A%20%20%7D%0A%7D&new=%7B%0A%20%20%22name%22%3A%20%22my-app%22%2C%0A%20%20%22lockfileVersion%22%3A%203%2C%0A%20%20%22packages%22%3A%20%7B%0A%20%20%20%20%22%22%3A%20%7B%20%22name%22%3A%20%22my-app%22%2C%20%22version%22%3A%20%221.1.0%22%20%7D%2C%0A%20%20%20%20%22node_modules%2Fchalk%22%3A%20%7B%20%22version%22%3A%20%225.0.0%22%20%7D%0A%20%20%7D%0A%7D&old_format=auto&new_format=auto&include_dev=true&output=text"
  },
  "cli": "gizza tool sbom-diff '{\n  \"name\": \"my-app\",\n  \"lockfileVersion\": 3,\n  \"packages\": {\n    \"\": { \"name\": \"my-app\", \"version\": \"1.0.0\" },\n    \"node_modules/chalk\": { \"version\": \"4.1.2\" }\n  }\n}' 'new={\n  \"name\": \"my-app\",\n  \"lockfileVersion\": 3,\n  \"packages\": {\n    \"\": { \"name\": \"my-app\", \"version\": \"1.1.0\" },\n    \"node_modules/chalk\": { \"version\": \"5.0.0\" }\n  }\n}'",
  "tool": {
    "description": "Compare two resolved dependency lockfiles or SBOMs and report which dependencies were added, removed, or version-bumped between them. Pass old (the before file) and new (the after file) as file contents: an npm package-lock.json (v1 or v2/v3), a Cargo.lock, a pip requirements.txt, or an existing CycloneDX/SPDX SBOM (cyclonedx-json, spdx-json, spdx-tag). Each side's format is auto-detected unless old_format / new_format (auto/npm/cargo/pip/cyclonedx-json/spdx-json/spdx-tag) is set, and the two sides may use different formats. The diff is a pure set comparison of the resolved dependency inventories — no resolver and no network — so output is deterministic; version bumps are classified as upgraded, downgraded, or changed. output selects the report: text (grouped human report, default), markdown (a PR/CI table), or json (a summary plus added/removed/changed lists). include_dev keeps npm dev/optional deps on both sides. Returns the diff report as text.",
    "parameters": {
      "additionalProperties": false,
      "properties": {
        "include_dev": {
          "default": true,
          "description": "Include npm dev/optional dependencies on both sides (npm lockfile input only — cargo/pip and SBOM inputs do not distinguish them here). Default true.",
          "type": "boolean"
        },
        "new": {
          "description": "The NEW (after) file contents to compare with the old side. Same accepted inputs as old; the two sides may even use different formats. The format is auto-detected unless new_format is set.",
          "type": "string"
        },
        "new_format": {
          "default": "auto",
          "description": "Format of the new side: auto (detect from the content), npm, cargo, pip, cyclonedx-json, spdx-json, or spdx-tag. Default auto.",
          "enum": [
            "auto",
            "npm",
            "cargo",
            "pip",
            "cyclonedx-json",
            "spdx-json",
            "spdx-tag"
          ],
          "type": "string"
        },
        "old": {
          "description": "The OLD (before) file contents to diff against. Paste a resolved dependency lockfile — an npm package-lock.json (v1 or v2/v3), a Cargo.lock, or a pip requirements.txt — or an existing CycloneDX/SPDX SBOM. The format is auto-detected unless old_format is set.",
          "type": "string"
        },
        "old_format": {
          "default": "auto",
          "description": "Format of the old side: auto (detect from the content), npm (package-lock.json), cargo (Cargo.lock), pip (requirements.txt), cyclonedx-json (CycloneDX JSON SBOM), spdx-json (SPDX JSON SBOM), or spdx-tag (SPDX tag-value SBOM). Default auto.",
          "enum": [
            "auto",
            "npm",
            "cargo",
            "pip",
            "cyclonedx-json",
            "spdx-json",
            "spdx-tag"
          ],
          "type": "string"
        },
        "output": {
          "default": "text",
          "description": "Report format: text (grouped human-readable report, default), markdown (a PR/CI-friendly table), or json (a machine-readable change report with a summary and added/removed/changed lists).",
          "enum": [
            "text",
            "markdown",
            "json"
          ],
          "type": "string"
        }
      },
      "required": [
        "old",
        "new"
      ],
      "type": "object"
    }
  }
}