Commercial Component Catalog

Sonatype Lifecycle can identify selected commercial versions of open-source components from participating vendors when those components are present in an application scan. This helps you distinguish vendor-maintained or patched components from their upstream open-source counterparts and review the component data available for them in scan reports.

A component appears in a scan only when it is included in the catalog and your organization has an agreement with the vendor. Availability and data coverage vary by vendor and ecosystem.

Depending on the vendor, catalog data may include component identification, vulnerability information based on the upstream open-source component, vendor-provided vulnerability updates, and license information. The available data and ecosystem coverage vary by vendor; confirm support for a specific package or ecosystem with the vendor.

When Lifecycle identifies a cataloged commercial component during an application scan, its component details and available security and license information appear in the Application Composition Report. Findings reflect the data available for that component and may include upstream vulnerability information and vendor-provided updates.

The report does not display a separate visual indicator for the commercial vendor, so check the component version name to identify its source: SEAL Security version names include sp (for example, 3.5.0+sp1), while HeroDevs version names follow the version-name-version pattern. The component may otherwise look like a standard entry.