Use the latest revision of the same document, identified by its serial number and version, and keep the earlier ones for audit. A new product release is a different case: it gets its own SBOM record. Never overwrite history, and never count both revisions as current.
Revision versus release
Two situations look alike but are not.
- Revision: the supplier corrects or completes the SBOM for a release you already have. The product version is unchanged.
- Release: the supplier ships a new product version with its own bill of materials.
Mixing them up either hides a fix or loses the record of what you actually deployed.
What the formats tell you
CycloneDX says a BOM should have a serial number, formatted as a URN with a UUID, even when contents are unchanged, and that the integer version should increase by one whenever the BOM changes. When multiple BOMs share a serial number, the consumer should use the one with the highest version.
SPDX works differently. Its document namespace must be unique for the specific version of the document, so an updated document gets a new URI. The created field records when the document was first created, in UTC.
| Format | Same document identity | Revision signal |
|---|---|---|
| CycloneDX | Serial number | Version integer goes up |
| SPDX | Namespace changes per version | New URI, new created time |
A handling procedure
- On arrival, read the identity fields and the product version.
- Look up your store. If you hold the same serial number with a lower version, mark the old one superseded and the new one current.
- If the format is SPDX, link the new namespace to the old one using the product, supplier and release as the key, since the URI itself changes.
- Rematch vulnerabilities for the new revision.
- Diff old against new. Note added, removed and changed components.
- Close findings that disappeared and note why. Reopen any that came back.
- Tell the requester if a fix landed.
Keep the history
An auditor or incident responder may ask what you knew on a given date. If you replaced the old record, you cannot answer. Mark it superseded, keep its findings, and store the receipt date alongside.
Try it yourself
Click through it at your own pace, or open it full screen.
Watch how findings change over time, then imagine each change tied to a revision.
Where Safeguard fits
Safeguard offers continuous monitoring on top of SBOM and dependency scanning, so a revised inventory is rechecked against current advisories. Try a free scan to see the output.
Quick check
If the supplier sends a corrected SBOM, do I delete the first?
No. Mark it superseded and keep it with its receipt date.
How do I spot a revision in SPDX?
The namespace is unique per document version, so match on product, supplier and release, then compare created times.
Sources
- CycloneDX 1.6 JSON reference: serial number and version rules.
- SPDX 2.3.1, document creation information: namespace uniqueness and created field.
Last reviewed: 19 October 2026.
