VulnTrack v2.1.0 - Improve SBOM Explorer

VulnTrack v2.1.0 - Enhanced SBOM Explorer

This release improves VulnTrack’s SBOM analysis experience, especially for Yocto-generated SPDX bundles.

Highlights

• Added support for Yocto .spdx.tar SBOM bundles.
• Added browser-based .spdx.tar.zst support when the browser supports native zstd decompression.
• Improved SPDX parsing so package-level SPDX documents are merged into one complete SBOM view.
• Collapsed duplicate Yocto package/recipe records into a single clean component row.
• Added Compliance Readiness indicators derived from uploaded SBOM metadata.
• Added component-level installed file visibility with actual file paths, file type, license, and checksums.
• Removed raw SPDX JSON display from the UI and replaced it with clean source-document traceability.
• Improved SBOM loading feedback for large archive uploads.
• Improved SBOM table/detail layout with sticky headers, selected row state, and better detail-panel readability.
• Updated README documentation for Yocto SBOM upload and analysis.

Validation

Tested with a Yocto-generated SPDX tar bundle containing thousands of SPDX documents. The viewer now correctly shows package metadata and installed files such as /etc/..., /usr/bin/..., and related checksums.

Notes

Package dependency maps are shown only when package-level dependency relationships are present in the uploaded SBOM. Yocto file containment relationships are displayed under Installed Files instead of being mixed into dependency data.

VulnTrack v2.0.0 — Report Exporting & Release Automation

VulnTrack v2.0.0

This release focuses on improving VulnTrack’s reporting workflow by adding exportable report formats and preparing the project for versioned GitHub releases.

Added

• Added report export support for HTML, PDF, Markdown, and JSON summary outputs.
• Added an export report toolbar/dropdown in the dashboard.
• Added a dedicated report-generation.js module for building downloadable vulnerability reports.
• Added GitHub Actions release workflow for tag-based release creation.
• Added cache-busting update for the report generation script.

Improved

• Improved handling of Yocto package issue data by normalizing package issue structures before rendering.
• Improved package indexing so package summary data is retained more consistently.
• Improved empty-state handling when a parsed report has packages but no CVE issues to rank.
• Improved report output structure for executive summaries, severity/status graphs, priority CVEs, package risk summaries, and remediation-focused sections.

Notes

This release is intended as the second major VulnTrack milestone, focused specifically on report generation and release packaging improvements.