Your component inventory reflects whatever SBOM was last uploaded to a product version. When a new release ships with different dependencies, upload a new SBOM so matching keeps running against what you actually ship, not what you shipped last time.
Before you start
- You need
sbom.uploadpermission. - Decide whether the new release is a new product version or an update to an existing one. A version that hasn't been seen before is created automatically when you push an SBOM to it through the API; in the UI, create or select the version before uploading.
Steps
- Open the product, and the version the release belongs to.
- Upload the new SBOM the same way as the first one — drag it in, or choose it from your filesystem. Format is still detected from content, not filename.
- Wait for parsing. This runs in the background, the same as any upload.
What you should see
The new SBOM replaces the version's component set wholesale — Declara doesn't keep both the old and new inventories side by side for the same version. The upload record itself keeps a count of what was added and removed compared to what was there before, so you can see what changed between releases at a glance. Matching against the advisory feeds re-runs against the new inventory automatically.
If you're tracking a version, not overwriting one
Uploading to the same product version replaces its inventory. If you want the previous release's inventory to stay queryable on its own, upload the new SBOM to a new product version instead of the old one — each version keeps its own component set.