CycloneDX / CycloneDX/cyclonedx-cli

analyze --multiple-component-versions

Open
#481 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
541
Forks
82
PR merge metrics
No merged PRs in 30d

Description

Hi,

in my SBOM file grep finds for example:
```
% grep minimatch some-sbom.json
"name": "minimatch",
"bom-ref": "Dashboard@0.1.0|minimatch@3.1.2",
"purl": "pkg:npm/minimatch@3.1.2",
...
"name": "minimatch",
"bom-ref": "Dashboard@0.1.0|glob@10.3.10|minimatch@9.0.5",
...
"name": "minimatch",
"bom-ref": "Dashboard@0.1.0|@typescript-eslint/typescript-estree@8.7.0|minimatch@9.0.5",
...
```

which shows at least two versions.
But using:
```
% cyclonedx-linux-x64 --version
0.30.0+d9a47f949b2809ab9275ba339dd8db25138d6ded
% cyclonedx-linux-x64 validate --input-file some-sbom.json
BOM validated successfully.
% cyclonedx-linux-x64 analyze --input-file some-sbom.json --multiple-component-versions
Analysis results for Dashboard@0.1.0:
BOM Serial Number: urn:uuid:02c728c6-4d1a-40a0-8390-1917dd5c201c
BOM Version: 1
Timestamp: 03.02.2026 13:46:52

Components with multiple versions:

string-width versions: 4.2.3 5.1.2
wrap-ansi versions: 7.0.0 8.1.0
```
Does not show multiple versions.

What might be the reason for this difference?

Thanks

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.