fix: correct upgrade detection and CLI default format#8
Open
dmchaledev wants to merge 1 commit into
Open
Conversation
Two correctness bugs broke the documented usage:
- diff() keyed components by the full purl, but purls embed the version
(e.g. pkg:npm/lodash@4.17.21). A version change produced a different
key, so upgrades were reported as a separate add + remove instead of an
upgrade — defeating the package's headline feature for any SBOM with
versioned purls (the real-world norm). Now matched by a version-agnostic
purl key; scoped npm packages (%40) are handled correctly.
- The CLI crashed when run without --format. args.indexOf('--format')
returned -1, so args[-1+1] used the first filename as the format and
threw "Unsupported format". sbom-diff old.json new.json (the README's
primary example) now works, and invalid --format values give a clear
error.
Updated the misleading diff test that asserted the buggy behavior and
added coverage for versioned-purl and scoped-package upgrades.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two correctness bugs broke the tool's documented usage. Both fixes are small and self-contained.
1. Upgrade detection was broken for versioned purls (the headline feature)
diff()keyed components by their full purl, but purls embed the version (e.g.pkg:npm/lodash@4.17.21). When a package was upgraded, its purl changed, so it was keyed differently in each SBOM and reported as a separate add + remove rather than an upgrade. Since real-world CycloneDX/SPDX SBOMs almost always emit versioned purls, the package's headline feature ("Highlights … upgraded dependencies") effectively never worked outside the name-only fallback path.Before (
old.jsonlodash 4.17.20 →new.jsonlodash 4.17.21):After:
Fix: match components by a version-agnostic purl key (strip everything from the first literal
@onward). Scoped npm packages encode their namespace@as%40, so the first literal@is always the version delimiter —pkg:npm/%40babel/core@7.xis handled correctly.2. CLI crashed when run without
--formatsbom-diff old.json new.json— the primary example in the README — threwError: Unsupported format: old.json. With no--formatflag,args.indexOf('--format')returns-1, soargs[-1 + 1]read the first filename as the format. Invalid--formatvalues also dumped a stack trace.Fix: only read the next arg when
--formatis actually present, and validate the value, printing a clear error (Unknown format: yaml. Use one of: text, json, markdown) instead of throwing.Tests
difftest that asserted the buggy add/remove behavior with one that asserts correct upgrade detection across versioned purls.%40).https://claude.ai/code/session_013dtMxjdzfj1UumYEKLUo4u
Generated by Claude Code