An unresolved component is an item the scanner detected but could not tie to a specific package name and version, such as a file with no metadata or a version it could not parse. Without an exact identity it cannot be matched to advisories, so it sits outside vulnerability results.
Why identity comes first
Vulnerability matching is a lookup. The scanner needs a package identifier and a version, then asks which advisories apply. If either is missing, there is nothing to look up.
The Package URL specification exists to give packages a predictable, ecosystem independent identifier. A good component record carries a purl, a version and ideally a hash. A weak record carries only a filename.
The SPDX specification shows how formats handle gaps. Many fields accept the value NOASSERTION, which it defines as used when the creator tried but could not reach a reasonable objective determination, made no attempt, or chose not to provide the data. So a document can be valid and still say nothing about a component.
Common causes
- A file copied into the repository with no manifest.
- A version string the scanner cannot parse, such as a build date or a branch name.
- A package from a private registry the scanner cannot query.
- A binary that bundles code with no embedded metadata.
- A package whose name differs between your registry and the advisory source.
How to measure the gap
- Export the scan or SBOM as JSON.
- Count components with no purl, no version, or a version of NOASSERTION or empty.
- Divide by total components. That is your unresolved rate.
- Track it per repository over time, next to the findings count.
A report showing zero findings and a 30 percent unresolved rate is not a clean report. It is a partly measured one. Add the rate to your scan coverage statement.
How to reduce it
- Prefer lockfiles over loose files, since lockfiles carry exact versions.
- Fix private registry access so internal packages resolve. See does the scanner cover private registries and internal packages.
- Replace copied files with declared dependencies where you can.
- For what you cannot fix, record the component by hand with a purl and version, and note why.
Try it yourself
Click through it at your own pace, or open it full screen. Check how each component carries a name and version, and picture one without them.
Safeguard produces SBOMs through its dependency scanning, and you can try a free scan at gold.safeguard.sh/scan. Look at the component list as well as the findings.
Quick check
Is an unresolved component the same as a vulnerable one?
No. It means unknown, and unknown cannot be matched. It may be harmless or vulnerable, and the scanner cannot say which.
What unresolved rate is acceptable?
There is no universal figure. Pick a target for your own estate, track it, and investigate any repository that moves up.
Sources
Last reviewed: 19 October 2026.
