Bomly Diff JSON Schema Reference

Last updated July 30, 2026View source (v0.21.1)

Complete reference for the bomly diff JSON output.

Document

Field	Type	Description
`schema_version`	`string`
`command`	`string`
`project`	`ProjectDescriptor`
`comparison`	`DiffComparison`
`results`	`DiffResults`
`summary`	`DiffSummary`
`packages`	Array<`ScanPackageEntry`>
`audit`	`DiffAudit`
`warnings`	Array<`DetectorWarning`>
`metadata`	`Metadata`

Types

`AffectedSymbol`

Field	Type	Description
`symbol`	`string`
`kind`	`string`
`package`	`string`
`module`	`string`
`definition`	`SourcePosition`

`AuditFinding`

Field	Type	Description
`id`	`string`
`kind`	`string`
`severity`	`string`
`package`	`FindingPackageRef`
`title`	`string`
`reasons`	Array<`string`>
`source`	`string`
`auditor`	`string`
`rule_id`	`string`
`policy_status`	`string`
`vulnerability_id`	`string`
`dependency_refs`	Array<`string`>

`AuditSummary`

Field	Type	Description
`critical`	`integer`
`high`	`integer`
`medium`	`integer`
`low`	`integer`
`unknown`	`integer`
`total`	`integer`

`CVSSScore`

Field	Type	Description
`vector`	`string`
`score`	`number`
`version`	`string`
`source`	`string`

`CWE`

Field	Type	Description
`cve`	`string`
`id`	`string`
`source`	`string`
`type`	`string`

`CallFrame`

Field	Type	Description
`function`	`string`
`package`	`string`
`receiver`	`string`
`position`	`SourcePosition`

`CallPath`

Field	Type	Description
`sink`	`AffectedSymbol`
`frames`	Array<`CallFrame`>

`DetectorWarning`

Field	Type	Description
`type`	`string`
`code`	`string`
`source`	`string`
`subproject`	`string`
`manifest`	`string`
`message`	`string`

`DiffAudit`

Field	Type	Description
`introduced`	Array<`AuditFinding`>
`resolved`	Array<`AuditFinding`>
`persisted`	Array<`AuditFinding`>
`audit_summary`	`AuditSummary`

`DiffChangedPackage`

Field	Type	Description
`after`	`PackageRef`
`before`	`PackageRef`

`DiffComparison`

Field	Type	Description
`base`	`string`
`head`	`string`

`DiffDependencyResults`

Field	Type	Description
`added`	Array<`DiffPackageChange`>
`removed`	Array<`DiffPackageChange`>
`changed`	Array<`DiffChangedPackage`>
`transitions`	Array<`DiffDependencyTransition`>

`DiffDependencyTransition`

Field	Type	Description
`before`	`DiffDependencyTransitionState`
`after`	`DiffDependencyTransitionState`
`changed_fields`	Array<`string`>

`DiffDependencyTransitionState`

Field	Type	Description
`id`	`string`
`name`	`string`
`version`	`string`
`purl`	`string`
`scope`	`string`
`relationship`	`string`
`source`	`string`
`registry_eligible`	`boolean`

`DiffLicenseChange`

Field	Type	Description
`package`	`PackageRef`
`licenses`	Array<`LicenseRef`>

`DiffLicenseDelta`

Field	Type	Description
`package`	`PackageRef`
`before`	Array<`LicenseRef`>
`after`	Array<`LicenseRef`>

`DiffLicenseResults`

Field	Type	Description
`added`	Array<`DiffLicenseChange`>
`removed`	Array<`DiffLicenseChange`>
`changed`	Array<`DiffLicenseDelta`>

`DiffManifestResult`

Field	Type	Description
`status`	`string`
`path`	`string`
`kind`	`string`
`subproject`	`string`
`ecosystem`	`string`
`package_manager`	`string`
`added`	Array<`DiffPackageChange`>
`removed`	Array<`DiffPackageChange`>
`changed`	Array<`DiffChangedPackage`>
`transitions`	Array<`DiffDependencyTransition`>

`DiffPackageChange`

Field	Type	Description
`package`	`PackageRef`

`DiffResults`

Field	Type	Description
`dependencies`	`DiffDependencyResults`
`licenses`	`DiffLicenseResults`
`vulnerabilities`	`DiffVulnerabilityResults`
`manifests`	Array<`DiffManifestResult`>

`DiffSummary`

Field	Type	Description
`added_manifest_count`	`integer`
`changed_manifest_count`	`integer`
`removed_manifest_count`	`integer`
`unchanged_manifest_count`	`integer`
`added_package_count`	`integer`
`changed_package_count`	`integer`
`transitioned_package_count`	`integer`
`removed_package_count`	`integer`
`exact_match_count`	`integer`
`fuzzy_match_count`	`integer`
`unmatched_package_count`	`integer`

`DiffVulnerabilityChange`

Field	Type	Description
`package`	`PackageRef`
`vulnerability`	`VulnerabilityRef`

`DiffVulnerabilityResults`

Field	Type	Description
`added`	Array<`DiffVulnerabilityChange`>
`removed`	Array<`DiffVulnerabilityChange`>
`persisted`	Array<`DiffVulnerabilityChange`>

`Digest`

Field	Type	Description
`algorithm`	`string`
`value`	`string`

`EPSSScore`

Field	Type	Description
`cve`	`string`
`epss`	`number`
`percentile`	`number`
`date`	`string`

`FindingPackageRef`

Field	Type	Description
`name`	`string`
`org`	`string`
`version`	`string`
`purl`	`string`
`ecosystem`	`string`

`FixAvailable`

Field	Type	Description
`version`	`string`
`date`	`string`
`kind`	`string`

`KnownExploited`

Field	Type	Description
`cve`	`string`
`vendor_project`	`string`
`product`	`string`
`date_added`	`string`
`required_action`	`string`
`due_date`	`string`
`known_ransomware_campaign_use`	`string`
`notes`	`string`
`urls`	Array<`string`>
`cwes`	Array<`string`>

`LicenseRef`

Field	Type	Description
`value`	`string`
`spdxExpression`	`string`
`type`	`string`

`LocationRef`

Field	Type	Description
`real_path`	`string`
`access_path`	`string`
`position`	`PositionRef`

`Metadata`

Field	Type	Description
`duration_ms`	`integer`
`reachability_enabled`	`boolean`
`scorecard_enabled`	`boolean`
`analyzer_runs`	Array<`string`>
`analyzer_stats`	`object`

`PackageEOL`

Field	Type	Description
`source`	`string`
`cycle`	`string`
`eol`	`boolean`
`eol_date`	`string`
`latest_version`	`string`
`release_date`	`string`
`supported`	`boolean`

`PackageRef`

Field	Type	Description
`name`	`string`
`version`	`string`
`scope`	`string`
`purl`	`string`
`id`	`string`
`metadata`	`object`
`locations`	Array<`LocationRef`>
`licenses`	Array<`LicenseRef`>
`vulnerabilities`	Array<`VulnerabilityRef`>
`scorecard`	`PackageScorecard`
`relationship`	`string`
`direct`	`boolean`

`PackageRemediation`

Field	Type	Description
`status`	`string`
`recommended_version`	`string`
`suggestions`	Array<`PackageRemediationSuggestion`>

`PackageRemediationSuggestion`

Field	Type	Description
`affected_dependency_refs`	Array<`string`>
`suggested_action_dependency_ref`	`string`
`manifest_path`	`string`
`action`	`string`
`override_advice`	`string`

`PackageScorecard`

Field	Type	Description
`source`	`string`
`repository`	`string`
`commitSha`	`string`
`scorecardVersion`	`string`
`runDate`	`Time`
`aggregateScore`	`number`
`checks`	Array<`PackageScorecardCheck`>

`PackageScorecardCheck`

Field	Type	Description
`name`	`string`
`score`	`integer`
`reason`	`string`
`documentation`	`string`

`PositionRef`

Field	Type	Description
`file`	`string`
`line`	`integer`
`column`	`integer`
`end_line`	`integer`

`ProjectDescriptor`

Field	Type	Description
`name`	`string`
`path`	`string`
`target_type`	`string`
`target_ref`	`string`
`ecosystem`	`string`
`package_manager`	`string`

`Reachability`

Field	Type	Description
`status`	`string`
`tier`	`string`
`analyzer`	`string`
`reason`	`string`
`symbols`	Array<`AffectedSymbol`>
`call_paths`	Array<`CallPath`>
`hops`	`integer`
`confidence`	`string`
`dynamic_imports_detected`	`boolean`
`analyzed_at`	`string`

`Reference`

Field	Type	Description
`url`	`string`
`type`	`string`

`ScanPackageEntry`

Field	Type	Description
`purl`	`string`
`name`	`string`
`org`	`string`
`version`	`string`
`ecosystem`	`string`
`matched`	`boolean`
`licenses`	Array<`LicenseRef`>
`vulnerabilities`	Array<`VulnerabilityRef`>
`scorecard`	`PackageScorecard`
`eol`	`PackageEOL`
`remediation`	`PackageRemediation`
`cpes`	Array<`string`>
`digests`	Array<`Digest`>
`metadata`	`object`

`SourcePosition`

Field	Type	Description
`file`	`string`
`line`	`integer`
`column`	`integer`
`end_line`	`integer`

`Time`

`VulnerabilityRef`

Field	Type	Description
`id`	`string`
`source`	`string`
`title`	`string`
`severity`	`string`
`severity_source`	`string`
`aliases`	Array<`string`>
`description`	`string`
`reasons`	Array<`string`>
`cvss`	Array<`CVSSScore`>
`fixed_in`	`string`
`fixed_versions`	Array<`string`>
`fix_state`	`string`
`fix_available`	Array<`FixAvailable`>
`affected_version_range`	`string`
`references`	Array<`Reference`>
`kev_exploited`	`boolean`
`known_exploited`	Array<`KnownExploited`>
`epss`	Array<`EPSSScore`>
`cwes`	Array<`CWE`>
`risk_score`	`number`
`data_source`	`string`
`namespace`	`string`
`cpes`	Array<`string`>
`affected_symbols`	Array<`AffectedSymbol`>
`reachability`	`Reachability`

Back to all docs