diff_findings
Compare vulnerability findings between two project versions to identify carried, updated, new, and removed issues for triage transfer during upgrades.
Instructions
Compute carried / updated_component / new / gone between two versions.
Typical use: upgrading a product v1 → v2. source is v1 (where
triage decisions already exist), target is v2 (new SBOM just
uploaded). Returns four lists:
carried— same component + same vulnerability, safe to transfer analyses 1:1.updated_component— same vulnerability, component version changed (patch or major). Decision may or may not still apply.new— appeared in target only.gone— were in source only; reason isvuln_fixed(component still there) orcomponent_removed.
Component matching uses (purl_type, purl_namespace, purl_name) —
deliberately drops qualifiers so DT 4.13→4.14 upgrades that add
distro=... don't invalidate every match. Ambiguous matches
(multi-arch SBOMs with the same component at different qualifiers)
emit an entry in warnings. Read-only.
Args: source_project_uuid: Old version UUID (usually with existing triage). target_project_uuid: New version UUID. include_analysis: Load current analysis for each source finding (needed for carry_over; adds one HTTP call per finding).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| source_project_uuid | Yes | ||
| target_project_uuid | Yes | ||
| include_analysis | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||