MundoKit

CycloneDX version compatibility checker

Paste a CycloneDX JSON BOM and choose an older target version. Review potential data-loss locations before conversion; the original BOM stays unchanged in your browser.

Inspect a BOM locally for structural downgrade losses. JavaScript is required. No upload or conversion occurs.

How it works

The checker walks present JSON values through local structural projections of the official schemas from release tag 1.7. It compares property availability, value types and enums, following local references and nested arrays. An unsupported subtree counts as one loss location. Counts are exact integers; there is no rounding.

Unknown source properties and external schema references are marked unassessed. A value invalid in the source enum is a source issue, not a downgrade loss. The audit deliberately ignores the version declaration during comparison: exporters still need to update specVersion and $schema.

This is not full schema validation. Required fields, string formats, patterns, conditional rules, combinations of alternative schema branches, signatures and semantic relationships need separate validation. No converted BOM is produced.

Worked examples

Two component fields lost in 1.6

A 1.7 library component with name, versionRange and isExternal produces 2 loss locations when targeting 1.6: versionRange and isExternal. Targeting 1.7 produces 0.

Cryptography in an older export

A 1.6 component with type="cryptographic-asset", name and cryptoProperties produces 2 loss locations when targeting 1.5: the type enum value and the cryptoProperties subtree.

Frequently asked questions

Will this convert my SBOM?
No. It reports locations that need an export decision. Keep the richer original, review each finding, and validate the exporter output independently.
Does zero loss mean the older BOM will validate?
No. This is a structural preflight. Required fields and cross-field constraints can still make the output invalid, and an exporter can behave differently.
Which input versions are supported?
JSON BOMs declaring 1.4, 1.5, 1.6 or 1.7. The target must be the same version or older. XML and upgrades are outside scope.
Why are some fields unassessed?
Custom properties outside the schema and external schema references cannot be classified reliably. Their values are not silently treated as portable.
How large can a BOM be?
The application accepts at most 1,000,000 UTF-8 bytes, 20,000 JSON nodes and 64 nesting levels. These are tool resource limits, not CycloneDX specification limits.

Sources

Last reviewed 2026-11-14; next review due by 2027-02-12. The method is written out above so you can check our math.