Change analysis for SBOMs

[artem-smotrakov]

Hey! First of all, I'd like to thank you all for developing such a great project!

It would be great if Dependency Track could display difference between two SBOMs. That would help analysing changes between versions of a project. At first, Dependency Track could display basic diffs for components and services, for example, what was added/removed, what versions/URLs were updated.

I've looked for existing open/closed issues but didn't find anything. What do you think about it? Are you willing to accept this contribution?

Current Behavior:

Dependency Track can't show difference between two SBOMs.

Proposed Behavior:

• In the Projects page, select two SBOMs and click Compare.
• Dependency Track displays a table that shows basic difference between the selected SBOMs
  • Added and removed components
  • Updated component versions
  • Updated services

[stevespringett]

That would be a useful enhancement. The CycloneDX CLI supports diff between SBOMs. DT currently doesn't keep SBOMs after they're consumed. This is being discussed in #877.