Third party libraries are checked for vulnerabilities with cycloneDX. https://github.com/10gen/mongo/blob/master/sbom.json is validated against bom-1.5.schema.json  before cycloneDX vulnerability check. sbom.json file may contain a version for a library/component.

Third party libraries have import scripts (https://github.com/10gen/mongo/tree/master/src/third_party#readme) which may include a version.

These two versions should be validated against each other in this ticket when possible.