diff.md

Bomly Diff JSON Schema Reference

Complete reference for the bomly diff JSON output.

Document

Field	Type	Description
schema_version	string
command	string
project	ProjectDescriptor
comparison	DiffComparison
results	DiffResults
summary	DiffSummary
packages	Array<ScanPackageEntry>
audit	DiffAudit
warnings	Array<DetectorWarning>
metadata	Metadata

Types

AffectedSymbol

Field	Type	Description
symbol	string
kind	string
package	string
module	string
definition	SourcePosition

AuditFinding

Field	Type	Description
id	string
kind	string
severity	string
package	FindingPackageRef
title	string
reasons	Array<string>
source	string
auditor	string
rule_id	string
policy_status	string
vulnerability_id	string
dependency_refs	Array<string>

AuditSummary

Field	Type	Description
critical	integer
high	integer
medium	integer
low	integer
unknown	integer
total	integer

CVSSScore

Field	Type	Description
vector	string
score	number
version	string
source	string

CWE

Field	Type	Description
cve	string
id	string
source	string
type	string

CallFrame

Field	Type	Description
function	string
package	string
receiver	string
position	SourcePosition

CallPath

Field	Type	Description
sink	AffectedSymbol
frames	Array<CallFrame>

DetectorWarning

Field	Type	Description
type	string
code	string
source	string
subproject	string
manifest	string
message	string

DiffAudit

Field	Type	Description
introduced	Array<AuditFinding>
resolved	Array<AuditFinding>
persisted	Array<AuditFinding>
audit_summary	AuditSummary

DiffChangedPackage

Field	Type	Description
after	PackageRef
before	PackageRef

DiffComparison

Field	Type	Description
base	string
head	string

DiffDependencyResults

Field	Type	Description
added	Array<DiffPackageChange>
removed	Array<DiffPackageChange>
changed	Array<DiffChangedPackage>
transitions	Array<DiffDependencyTransition>

DiffDependencyTransition

Field	Type	Description
before	DiffDependencyTransitionState
after	DiffDependencyTransitionState
changed_fields	Array<string>

DiffDependencyTransitionState

Field	Type	Description
id	string
name	string
version	string
purl	string
scope	string
relationship	string
source	string
registry_eligible	boolean

DiffLicenseChange

Field	Type	Description
package	PackageRef
licenses	Array<LicenseRef>

DiffLicenseDelta

Field	Type	Description
package	PackageRef
before	Array<LicenseRef>
after	Array<LicenseRef>

DiffLicenseResults

Field	Type	Description
added	Array<DiffLicenseChange>
removed	Array<DiffLicenseChange>
changed	Array<DiffLicenseDelta>

DiffManifestResult

Field	Type	Description
status	string
path	string
kind	string
subproject	string
ecosystem	string
package_manager	string
added	Array<DiffPackageChange>
removed	Array<DiffPackageChange>
changed	Array<DiffChangedPackage>
transitions	Array<DiffDependencyTransition>

DiffPackageChange

Field	Type	Description
package	PackageRef

DiffResults

Field	Type	Description
dependencies	DiffDependencyResults
licenses	DiffLicenseResults
vulnerabilities	DiffVulnerabilityResults
manifests	Array<DiffManifestResult>

DiffSummary

Field	Type	Description
added_manifest_count	integer
changed_manifest_count	integer
removed_manifest_count	integer
unchanged_manifest_count	integer
added_package_count	integer
changed_package_count	integer
transitioned_package_count	integer
removed_package_count	integer
exact_match_count	integer
fuzzy_match_count	integer
unmatched_package_count	integer

DiffVulnerabilityChange

Field	Type	Description
package	PackageRef
vulnerability	VulnerabilityRef

DiffVulnerabilityResults

Field	Type	Description
added	Array<DiffVulnerabilityChange>
removed	Array<DiffVulnerabilityChange>
persisted	Array<DiffVulnerabilityChange>

Digest

Field	Type	Description
algorithm	string
value	string
subject	string

EPSSScore

Field	Type	Description
cve	string
epss	number
percentile	number
date	string

FindingPackageRef

Field	Type	Description
name	string
org	string
version	string
purl	string
ecosystem	string

FixAvailable

Field	Type	Description
version	string
date	string
kind	string

KnownExploited

Field	Type	Description
cve	string
vendor_project	string
product	string
date_added	string
required_action	string
due_date	string
known_ransomware_campaign_use	string
notes	string
urls	Array<string>
cwes	Array<string>

LicenseRef

Field	Type	Description
value	string
spdxExpression	string
type	string

LocationRef

Field	Type	Description
real_path	string
access_path	string
position	PositionRef

Metadata

Field	Type	Description
duration_ms	integer
reachability_enabled	boolean
scorecard_enabled	boolean
analyzer_runs	Array<string>
analyzer_stats	object

PackageEOL

Field	Type	Description
source	string
cycle	string
eol	boolean
eol_date	string
latest_version	string
release_date	string
supported	boolean

PackageRef

Field	Type	Description
name	string
version	string
scope	string
purl	string
id	string
metadata	object
locations	Array<LocationRef>
licenses	Array<LicenseRef>
vulnerabilities	Array<VulnerabilityRef>
scorecard	PackageScorecard
relationship	string
direct	boolean

PackageRemediation

Field	Type	Description
status	string
recommended_version	string
suggestions	Array<PackageRemediationSuggestion>

PackageRemediationSuggestion

Field	Type	Description
affected_dependency_refs	Array<string>
suggested_action_dependency_ref	string
manifest_path	string
action	string
override_advice	string

PackageScorecard

Field	Type	Description
source	string
repository	string
commitSha	string
scorecardVersion	string
runDate	Time
aggregateScore	number
checks	Array<PackageScorecardCheck>

PackageScorecardCheck

Field	Type	Description
name	string
score	integer
reason	string
documentation	string

PositionRef

Field	Type	Description
file	string
line	integer
column	integer
end_line	integer

ProjectDescriptor

Field	Type	Description
name	string
path	string
target_type	string
target_ref	string
ecosystem	string
package_manager	string

Reachability

Field	Type	Description
status	string
tier	string
analyzer	string
reason	string
symbols	Array<AffectedSymbol>
call_paths	Array<CallPath>
hops	integer
confidence	string
dynamic_imports_detected	boolean
analyzed_at	string
evidence	Array<ReachabilityEvidence>

ReachabilityEvidence

Field	Type	Description
module_root	string
dependency_refs	Array<string>
status	string
tier	string
analyzer	string
reason	string
symbols	Array<AffectedSymbol>
call_paths	Array<CallPath>
hops	integer
confidence	string
dynamic_imports_detected	boolean
analyzed_at	string

Reference

Field	Type	Description
url	string
type	string

ScanPackageEntry

Field	Type	Description
purl	string
name	string
org	string
version	string
ecosystem	string
matched	boolean
licenses	Array<LicenseRef>
vulnerabilities	Array<VulnerabilityRef>
scorecard	PackageScorecard
eol	PackageEOL
remediation	PackageRemediation
cpes	Array<string>
digests	Array<Digest>
metadata	object

SourcePosition

Field	Type	Description
file	string
line	integer
column	integer
end_line	integer

Time

VulnerabilityRef

Field	Type	Description
id	string
source	string
title	string
severity	string
severity_source	string
aliases	Array<string>
description	string
reasons	Array<string>
cvss	Array<CVSSScore>
fixed_in	string
fixed_versions	Array<string>
fix_state	string
fix_available	Array<FixAvailable>
affected_version_range	string
references	Array<Reference>
kev_exploited	boolean
known_exploited	Array<KnownExploited>
epss	Array<EPSSScore>
cwes	Array<CWE>
risk_score	number
data_source	string
namespace	string
cpes	Array<string>
affected_symbols	Array<AffectedSymbol>
reachability	Reachability