To find duplicate versions, group your SBOM components by package name and look for names with more than one version. To collapse them, align the version ranges that cause the split, or let your package manager dedupe the tree where it can. Always rebuild and retest afterwards.
Why duplicates happen
Two packages may ask for the same library with different ranges. The npm docs give a clear example: one dependency wants c at 1.0.x and another wants c at 1.x. During install, npm favours newer versions by default, even when that causes duplication, so you can end up with two copies where one would satisfy both.
Other ecosystems resolve this differently. Some pick one version for the whole build, others allow several. So the first step is to know how your ecosystem behaves.
Step 1: find them in the SBOM
Export the component list and group by name and package type. A short script or a spreadsheet pivot works. In the output, flag names with two or more versions.
| Package | Versions found | Where |
|---|---|---|
| example-lib | 1.0.3, 1.9.9 | Two different parents |
| another-lib | 2.4.0 only | Fine |
Check the namespace and ecosystem too, so two different packages that share a name are not mistaken for duplicates.
Step 2: decide whether it matters
Duplicates matter most when one copy has a known advisory and the other does not, since you now have a finding you could remove. They matter less when both are patched and small.
Step 3: collapse
For npm, the dedupe command searches the local package tree and tries to simplify it by moving dependencies further up where they can be shared. The docs say it never results in new modules being installed. The find-dupes command runs the same logic as a dry run, so start there. Dedupe does not change the version ranges in your package.json. If you want direct dependency ranges updated, use the update command with the save flag.
To prefer deduplication during install, npm has a prefer-dedupe setting.
If dedupe cannot fix it, because the two parents genuinely need incompatible versions, the options are to upgrade one parent, or use an override to force one version. Overrides are blunt, so test the result.
Step 4: verify
Regenerate the SBOM and run the same grouping. Duplicates that were actually collapsed should be gone. Keep the before and after as evidence of the change.
For release reviews, diffing two SBOMs shows whether a duplicate appeared or disappeared.
Try it yourself
Click through it at your own pace, or open it full screen. Look for a package that appears more than once.
Safeguard's SBOM and dependency scanning list components with their versions, so duplicates are visible in one view. You can try the free scan.
Quick check
Are two versions of a library always a problem?
No. It is a problem when one copy carries an advisory or when it signals a conflict you should settle.
Will dedupe change my package.json?
No. It rearranges the installed tree. To change declared ranges, use the update command with the save flag.
Sources
Last reviewed: 19 October 2026.
