On the project page, open the Publish history tab (or Snapshot history in the publish card). Each revision is immutable, so procurement reviewers always see the exact revision number you last published on your public attestation.
Recent revisions load first. Select Load more to retrieve older revisions. Once the next page is loaded, you can compare revisions across the newly loaded boundary.
Diff and rollback
- Diff: Compare any revision to the previous one. See packages added or removed and every changed published field: exact name casing, version, license name or SPDX identifier, copyright holder, ecosystem, upstream repository URL, source URL, license-text presence, license URL, and copyleft or network flags. Inline license bodies are never shown in the diff.
- Signatures: Existing signer chips stay on each revision. Add signature is only offered on the current live published revision (for co-signers after publish). Older revisions cannot gain new signatures.
- Rollback: Re-publish an older revision as a new revision number. History is preserved; nothing is deleted. The new revision is labeled "Rolled back from revision N". You can optionally sign the new revision in the same confirm step (required when your publish policy demands a signature). Roll back to here is hidden on revisions whose content already matches the live page. Confirm, then (when the org requires member 2FA) enter a fresh authenticator code, then a short countdown gives a last chance to cancel. See Help center → Org-required two-factor authentication (Org-required two-factor authentication).
- Take offline: Stop serving the public URL without deleting revisions. See Help center → Taking a page offline (Taking a page offline).