Skip to content

VulnTrack v2.1.0 - Improve SBOM Explorer

Latest
Latest

Choose a tag to compare

View all tags
@prashantdivate prashantdivate released this 07 Oct 10:04
· 1 commit to master since this release
v2.1.0
dff5708

VulnTrack v2.1.0 - Enhanced SBOM Explorer

This release improves VulnTrack’s SBOM analysis experience, especially for Yocto-generated SPDX bundles.

Highlights

  • Added support for Yocto .spdx.tar SBOM bundles.
  • Added browser-based .spdx.tar.zst support when the browser supports native zstd decompression.
  • Improved SPDX parsing so package-level SPDX documents are merged into one complete SBOM view.
  • Collapsed duplicate Yocto package/recipe records into a single clean component row.
  • Added Compliance Readiness indicators derived from uploaded SBOM metadata.
  • Added component-level installed file visibility with actual file paths, file type, license, and checksums.
  • Removed raw SPDX JSON display from the UI and replaced it with clean source-document traceability.
  • Improved SBOM loading feedback for large archive uploads.
  • Improved SBOM table/detail layout with sticky headers, selected row state, and better detail-panel readability.
  • Updated README documentation for Yocto SBOM upload and analysis.

Validation

Tested with a Yocto-generated SPDX tar bundle containing thousands of SPDX documents. The viewer now correctly shows package metadata and installed files such as /etc/..., /usr/bin/..., and related checksums.

Notes

Package dependency maps are shown only when package-level dependency relationships are present in the uploaded SBOM. Yocto file containment relationships are displayed under Installed Files instead of being mixed into dependency data.

Assets 2
Loading