CycloneDX / CycloneDX/cyclonedx-cli
analyze --multiple-component-versions
- Dominant language
- C#
- Stars
- 541
- Forks
- 82
- PR merge metrics
- No merged PRs in 30d
Description
Hi,
in my SBOM file grep finds for example:
```
% grep minimatch some-sbom.json
"name": "minimatch",
"bom-ref": "Dashboard@0.1.0|minimatch@3.1.2",
"purl": "pkg:npm/minimatch@3.1.2",
...
"name": "minimatch",
"bom-ref": "Dashboard@0.1.0|glob@10.3.10|minimatch@9.0.5",
...
"name": "minimatch",
"bom-ref": "Dashboard@0.1.0|@typescript-eslint/typescript-estree@8.7.0|minimatch@9.0.5",
...
```
which shows at least two versions.
But using:
```
% cyclonedx-linux-x64 --version
0.30.0+d9a47f949b2809ab9275ba339dd8db25138d6ded
% cyclonedx-linux-x64 validate --input-file some-sbom.json
BOM validated successfully.
% cyclonedx-linux-x64 analyze --input-file some-sbom.json --multiple-component-versions
Analysis results for Dashboard@0.1.0:
BOM Serial Number: urn:uuid:02c728c6-4d1a-40a0-8390-1917dd5c201c
BOM Version: 1
Timestamp: 03.02.2026 13:46:52
Components with multiple versions:
string-width versions: 4.2.3 5.1.2
wrap-ansi versions: 7.0.0 8.1.0
```
Does not show multiple versions.
What might be the reason for this difference?
Thanks
Contributor guide
Assessment
This issue has not been assessed yet.