Compare Build Versions

You can compare two versions of a scanned build and see the security differences between them, such as any new CVEs that have been introduced. With this feature you can:

• Compare security posture between two build versions.
• Identify new CVEs introduced in the newer version.
• Get detailed information on each CVE including severity, description, and remediation.
• Proactively detect security regressions between build versions.
• Quickly identify and mitigate newly introduced vulnerabilities.

You can compare the current build version against any previous version that JFrog Xray indexed. For more information, see Understanding and Analyzing Xray Scan Results.

Compare Two Build Versions

To compare build versions:

1. In Scans List, open the Builds tab.

2. Select the Build, and in the Build Versions list, from the three dot menu, select Compare to Version.

   The compare window appears.

3. Select the version you want to compare from the dropdown list.

   The diff view appears. It will display the following:

   • Summary of security changes between the versions.

   CVEs that exist in one version, but not the other, are indicated as Added. CVEs that were fixed are marked as Resolved.

• Details on each CVE are displayed when you click the CVE.
• CVEs that are not affected are hidden. Click View Unchanged CVEs to view the full list.
• Filter the view by selecting or clearing the Added and Resolved checkboxes.

For more information, see Builds Security Overview.

Related Topics

• Export Scan Results
• JFrog Security Research
• Contextual Analysis of CVEs