Changelog

Building and Packaging

• a99a5fc: build(deps): bump actions/checkout from 6.0.2 to 7.0.1 (@dependabot[bot])
• b317ad7: build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (@dependabot[bot])
• aaeb6ff: build(deps): bump go-license-detector to v4.3.1 to fix BSD-3-Clause misdetection (#775) (@dkr91)
• a946f18: build(deps): bump golang from 1.26.2-alpine3.23 to 1.26.5-alpine3.23 (@dependabot[bot])
• 8656a5e: build(deps): bump golang from 1.26.5-alpine3.23 to 1.26.6-alpine3.23 (@dependabot[bot])
• 1f50d4e: build(deps): bump golang.org/x/mod from 0.39.0 to 0.40.0 (@dependabot[bot])
• ade6480: build(deps): bump the codeql group with 3 updates (@dependabot[bot])

Changelog

Features

• bed74cb: feat: add -license-confidence-threshold CLI flag (#755) (@dkr91)
• d7039a8: feat: harden gha workflows with zizmor (@nscuro)
• 1ac4e2d: feat: support cyclonedx 1.7 output (@nscuro)

Fixes

• 8820fcb: fix: disable cosign new bundle format (@nscuro)
• c6a4c56: fix: incorrect actions tag annotation (@nscuro)
• 9cb8ae4: fix: linter issues (@nscuro)
• 8c1b71f: fix: preserve resolved local replacement directory (#748) (@Eljees)
• 7fe274f: fix: skip hashes for modules without a directory (#747) (@Eljees)
• 489c363: fix: switch to stdlib slices package (@nscuro)
• 85929bf: fix: update test snapshots (@nscuro)

Building and Packaging

• 59ca4b6: build(deps): bump actions/checkout from 5.0.0 to 6.0.2 (@dependabot[bot])
• b506e33: build(deps): bump actions/setup-go from 6.0.0 to 6.2.0 (@dependabot[bot])
• 06ebcd2: build(deps): bump actions/setup-go from 6.2.0 to 7.0.0 (@dependabot[bot])
• 796b471: build(deps): bump apache/skywalking-eyes from 0.7.0 to 0.8.0 (@dependabot[bot])
• ef8c854: build(deps): bump aquasecurity/trivy-action from 0.35.0 to 0.36.0 (@dependabot[bot])
• 3e16074: build(deps): bump docker/login-action from 3.5.0 to 3.7.0 (@dependabot[bot])
• 0c199c6: build(deps): bump docker/login-action from 3.7.0 to 4.0.0 (@dependabot[bot])
• 0913ba2: build(deps): bump docker/login-action from 4.0.0 to 4.6.0 (@dependabot[bot])
• 54d7d46: build(deps): bump docker/setup-qemu-action from 3.6.0 to 4.0.0 (@dependabot[bot])
• 7e79bca: build(deps): bump docker/setup-qemu-action from 4.0.0 to 4.2.0 (@dependabot[bot])
• 84fa414: build(deps): bump github.com/CycloneDX/cyclonedx-go (@dependabot[bot])
• 0989a68: build(deps): bump github.com/CycloneDX/cyclonedx-go from 0.9.3 to 0.10.0 (@dependabot[bot])
• 7ed78cb: build(deps): bump github.com/go-git/go-git/v5 from 5.16.2 to 5.16.4 (@dependabot[bot])
• c2e4e1d: build(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to 5.19.2 (@dependabot[bot])
• f7639a5: build(deps): bump github.com/package-url/packageurl-go (@dependabot[bot])
• de1c664: build(deps): bump github.com/rs/zerolog from 1.34.0 to 1.35.1 (@dependabot[bot])
• 355b682: build(deps): bump github/codeql-action from 3.30.0 to 4.32.0 (@dependabot[bot])
• 7329a34: build(deps): bump github/codeql-action from 4.32.0 to 4.34.1 (@dependabot[bot])
• 72968ec: build(deps): bump golang from 1.25.6-alpine3.23 to 1.26.2-alpine3.23 (@dependabot[bot])
• 644a766: build(deps): bump golang.org/x/crypto from 0.47.0 to 0.52.0 (@dependabot[bot])
• 5dac7d1: build(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 (@dependabot[bot])
• c1f0dd6: build(deps): bump golang.org/x/mod from 0.31.0 to 0.32.0 (@dependabot[bot])
• 1f8aea5: build(deps): bump golang.org/x/mod from 0.37.0 to 0.39.0 (@dependabot[bot])
• c68ea7b: build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.3.0 (@dependabot[bot])
• 3a149fb: build(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.2.3 (@dependabot[bot])
• 76b1764: build(deps): bump sigstore/cosign-installer from 3.10.1 to 4.1.2 (@dependabot[bot])
• 3f318d7: build(deps): bump sigstore/cosign-installer from 3.9.2 to 4.1.0 (@dependabot[bot])
• 0c2b745: build(deps): bump the codeql group with 3 updates (@dependabot[bot])
• fa59ccf: build(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 (@dependabot[bot])

Others

• 4baa8b0: chore: bump go to 1.26 (@nscuro)
• d8d7a39: chore: bump trivy-action to v0.35.0 (@nscuro)
• b0f7bb1: chore: modernize goreleaser setup (@nscuro)

Changelog

Features

• 0578e8f: feat: add notimestamp option (#693) (@aschereT)
• 02b8cfb: feat: add short-purls option (#685) (@alecbarber)

Fixes

• 556f6b4: fix: app module detection (#701) (@dporf)
• 6364168: fix: casing of -short-purls flag (@nscuro)
• fd4f966: fix: golangci-lint config and issues (@nscuro)
• ba23e15: fix: print hint that it is actually a Git error (@SweetVishnya)
• f6a462e: fix: sort package URL qualifiers lexicographically (@samherrmann)

Building and Packaging

• c85dc06: build(deps): bump actions/checkout from 4.2.2 to 5.0.0 (@dependabot[bot])
• 2688865: build(deps): bump actions/setup-go from 5.2.0 to 5.3.0 (@dependabot[bot])
• bc3a95a: build(deps): bump actions/setup-go from 5.3.0 to 5.4.0 (@dependabot[bot])
• 708265e: build(deps): bump actions/setup-go from 5.4.0 to 5.5.0 (@dependabot[bot])
• 60b3f43: build(deps): bump actions/setup-go from 5.5.0 to 6.0.0 (@dependabot[bot])
• 99e8bcc: build(deps): bump apache/skywalking-eyes from 0.6.0 to 0.7.0 (@dependabot[bot])
• 085bdf2: build(deps): bump aquasecurity/trivy-action from 0.29.0 to 0.30.0 (@dependabot[bot])
• 235da84: build(deps): bump aquasecurity/trivy-action from 0.30.0 to 0.31.0 (@dependabot[bot])
• 545cd17: build(deps): bump aquasecurity/trivy-action from 0.31.0 to 0.33.0 (@dependabot[bot])
• 492336e: build(deps): bump aquasecurity/trivy-action from 0.33.0 to 0.33.1 (@dependabot[bot])
• d7a5fd7: build(deps): bump docker/login-action from 3.3.0 to 3.4.0 (@dependabot[bot])
• 814e73f: build(deps): bump docker/login-action from 3.4.0 to 3.5.0 (@dependabot[bot])
• 38f3665: build(deps): bump docker/setup-qemu-action from 3.2.0 to 3.3.0 (@dependabot[bot])
• ef4a4f2: build(deps): bump docker/setup-qemu-action from 3.3.0 to 3.4.0 (@dependabot[bot])
• 16108fe: build(deps): bump docker/setup-qemu-action from 3.4.0 to 3.5.0 (@dependabot[bot])
• cffdc02: build(deps): bump docker/setup-qemu-action from 3.5.0 to 3.6.0 (@dependabot[bot])
• 0f3f3d2: build(deps): bump github.com/CycloneDX/cyclonedx-go from 0.9.2 to 0.9.3 (@dependabot[bot])
• 0ba2553: build(deps): bump github.com/go-git/go-git/v5 from 5.13.1 to 5.13.2 (@dependabot[bot])
• 24b5e4c: build(deps): bump github.com/go-git/go-git/v5 from 5.13.2 to 5.14.0 (@dependabot[bot])
• e97a3cc: build(deps): bump github.com/go-git/go-git/v5 from 5.14.0 to 5.16.0 (@dependabot[bot])
• c30426b: build(deps): bump github.com/go-git/go-git/v5 from 5.16.0 to 5.16.2 (@dependabot[bot])
• 239448f: build(deps): bump github.com/rs/zerolog from 1.33.0 to 1.34.0 (@dependabot[bot])
• 6f8436f: build(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.1 (@dependabot[bot])
• 2705623: build(deps): bump github/codeql-action from 3.28.0 to 3.28.1 (@dependabot[bot])
• 811dcb7: build(deps): bump github/codeql-action from 3.28.1 to 3.28.3 (@dependabot[bot])
• 80b82dd: build(deps): bump github/codeql-action from 3.28.10 to 3.28.11 (@dependabot[bot])
• 4a732e9: build(deps): bump github/codeql-action from 3.28.11 to 3.28.12 (@dependabot[bot])
• 99e652c: build(deps): bump github/codeql-action from 3.28.12 to 3.28.15 (@dependabot[bot])
• a45b17f: build(deps): bump github/codeql-action from 3.28.15 to 3.28.19 (@dependabot[bot])
• 007bea7: build(deps): bump github/codeql-action from 3.28.19 to 3.30.0 (@dependabot[bot])
• af5e268: build(deps): bump github/codeql-action from 3.28.3 to 3.28.4 (@dependabot[bot])
• 5624b2d: build(deps): bump github/codeql-action from 3.28.4 to 3.28.5 (@dependabot[bot])
• 1f255df: build(deps): bump github/codeql-action from 3.28.5 to 3.28.6 (@dependabot[bot])
• 13e4d83: build(deps): bump github/codeql-action from 3.28.6 to 3.28.8 (@dependabot[bot])
• e8a8005: build(deps): bump github/codeql-action from 3.28.8 to 3.28.9 (@dependabot[bot])
• f95d064: build(deps): bump github/codeql-action from 3.28.9 to 3.28.10 (@dependabot[bot])
• eb733b6: build(deps): bump gitpod/workspace-go from 08a7c68 to 530715f (@dependabot[bot])
• 05dab24: build(deps): bump gitpod/workspace-go from 4702df2 to 8985eb7 (@dependabot[bot])
• 9af45aa: build(deps): bump gitpod/workspace-go from 6932342 to 4702df2 (@dependabot[bot])
• efd28d0: build(deps): bump gitpod/workspace-go from 8985eb7 to 08a7c68 (@dependabot[bot])
• ed2d262: build(deps): bump golang from 1.23.4-alpine3.20 to 1.23.5-alpine3.20 (@dependabot[bot])
• f644e70: build(deps): bump golang from 1.23.5-alpine3.20 to 1.23.6-alpine3.20 (@dependabot[bot])
• 199f4e9: build(deps): bump golang from 1.23.6-alpine3.20 to 1.24.0-alpine3.20 (@dependabot[bot])
• 8cce23f: build(deps): bump golang from 1.24.0-alpine3.20 to 1.24.1-alpine3.20 (@dependabot[bot])
• f2a5932: build(deps): bump golang from 1.24.1-alpine3.20 to 1.24.2-alpine3.20 (@dependabot[bot])
• 8bce593: build(deps): bump golang from 1.24.2-alpine3.20 to 1.24.3-alpine3.20 (@dependabot[bot])
• c41cd7d: build(deps): bump golang from 9fed402 to 79f7ffe (@dependabot[bot])
• 955989a: build(deps): bump golang.org/x/crypto from 0.31.0 to 0.32.0 (@dependabot[bot])
• 9972fcd: build(deps): bump golang.org/x/crypto from 0.32.0 to 0.33.0 (@dependabot[bot])
• 0933780: build(deps): bump golang.org/x/crypto from 0.33.0 to 0.35.0 (@dependabot[bot])
• f8a5c1e: build(deps): bump golang.org/x/crypto from 0.35.0 to 0.36.0 (@dependabot[bot])
• 0d1525d: build(deps): bump golang.org/x/crypto from 0.36.0 to 0.37.0 (@dependabot[bot])
• 903c4b2: build(deps): bump golang.org/x/crypto from 0.37.0 to 0.39.0 (@dependabot[bot])
• 5ae5c53: build(deps): bump golang.org/x/crypto from 0.39.0 to 0.41.0 (@dependabot[bot])
• dc558a7: build(deps): bump golang.org/x/crypto from 0.41.0 to 0.43.0 (@dependabot[bot])
• 3adfe8f: build(deps): bump golang.org/x/crypto from 0.41.0 to 0.45.0 (@dependabot[bot])
• adf0a74: build(deps): bump golang.org/x/mod from 0.22.0 to 0.23.0 (@dependabot[bot])
• bad4e36: build(deps): bump golang.org/x/mod from 0.23.0 to 0.24.0 (@dependabot[bot])
• 966992f: build(deps): bump golang.org/x/mod from 0.25.0 to 0.27.0 (@dependabot[bot])
• 8d6318c: build(deps): bump golang.org/x/mod from 0.27.0 to 0.29.0 (@dependabot[bot])
• a6ff7cb: build(deps): bump golang.org/x/net from 0.35.0 to 0.36.0 (@dependabot[bot])
• 1154f59: build(deps): bump golang.org/x/net from 0.36.0 to 0.38.0 (@dependabot[bot])
• 2273dda: build(deps): bump golangci/golangci-lint-action from 6.1.1 to 6.2.0 (@dependabot[bot])
• 095a137: build(deps): bump golangci/golangci-lint-action from 6.2.0 to 6.3.0 (@dependabot[bot])
• db2163a: build(deps): bump golangci/golangci-lint-action from 6.3.0 to 6.5.0 (@dependabot[bot])
• ac8df36: build(deps): bump golangci/golangci-lint-action from 6.5.0 to 6.5.1 (@dependabot[bot])
• 86755da: build(deps): bump golangci/golangci-lint-action from 6.5.1 to 6.5.2 (@dependabot[bot])
• 3391a7f: build(deps): bump goreleaser/goreleaser-action from 6.1.0 to 6.2.1 (@dependabot[bot])
• 7cb5aa0: build(deps): bump goreleaser/goreleaser-action from 6.2.1 to 6.3.0 (@dependabot[bot])
• 8ffa343: build(deps): bump goreleaser/goreleaser-action from 6.3.0 to 6.4.0 (@dependabot[bot])
• f71861c: build(deps): bump sigstore/cosign-installer from 3.7.0 to 3.8.0 (@dependabot[bot])
• f6aeae4: build(deps): bump sigstore/cosign-installer from 3.8.0 to 3.8.1 (@dependabot[bot])
• 7693501: build(deps): bump sigstore/cosign-installer from 3.8.1 to 3.8.2 (@dependabot[bot])
• d0d0807: build(deps): bump sigstore/cosig...

Changelog

Features

• 8f59db7: feat: cli option to disable html escaping in output (@Aswinr24)

Fixes

• 17dc871: fix: resolve linting errors to pass checks (@Aswinr24)

Building and Packaging

• 4e056d2: build(deps): bump actions/checkout from 4.1.7 to 4.2.0 (@dependabot[bot])
• 35bcf07: build(deps): bump actions/checkout from 4.2.0 to 4.2.1 (@dependabot[bot])
• 8749fb6: build(deps): bump actions/checkout from 4.2.1 to 4.2.2 (@dependabot[bot])
• 4047c5a: build(deps): bump actions/setup-go from 5.0.2 to 5.2.0 (@dependabot[bot])
• 000407a: build(deps): bump aquasecurity/trivy-action from 0.24.0 to 0.25.0 (@dependabot[bot])
• af81360: build(deps): bump aquasecurity/trivy-action from 0.25.0 to 0.26.0 (@dependabot[bot])
• 058572e: build(deps): bump aquasecurity/trivy-action from 0.26.0 to 0.27.0 (@dependabot[bot])
• 309ffc3: build(deps): bump aquasecurity/trivy-action from 0.27.0 to 0.28.0 (@dependabot[bot])
• db52ead: build(deps): bump aquasecurity/trivy-action from 0.28.0 to 0.29.0 (@dependabot[bot])
• ccd5664: build(deps): bump github.com/CycloneDX/cyclonedx-go from 0.9.1 to 0.9.2 (@dependabot[bot])
• 4029b4c: build(deps): bump github.com/go-git/go-git/v5 from 5.12.0 to 5.13.0 (@dependabot[bot])
• 5fab0d7: build(deps): bump github.com/go-git/go-git/v5 from 5.13.0 to 5.13.1 (@dependabot[bot])
• b308972: build(deps): bump github/codeql-action from 3.26.11 to 3.26.12 (@dependabot[bot])
• ca0ee9e: build(deps): bump github/codeql-action from 3.26.12 to 3.26.13 (@dependabot[bot])
• c4523cc: build(deps): bump github/codeql-action from 3.26.13 to 3.27.0 (@dependabot[bot])
• 337b0ff: build(deps): bump github/codeql-action from 3.26.6 to 3.26.7 (@dependabot[bot])
• 1b2bd29: build(deps): bump github/codeql-action from 3.26.7 to 3.26.8 (@dependabot[bot])
• 573a41b: build(deps): bump github/codeql-action from 3.26.8 to 3.26.9 (@dependabot[bot])
• 719ada5: build(deps): bump github/codeql-action from 3.26.9 to 3.26.11 (@dependabot[bot])
• ce9bc87: build(deps): bump github/codeql-action from 3.27.0 to 3.28.0 (@dependabot[bot])
• da51cd2: build(deps): bump gitpod/workspace-go from 9c95281 to 6932342 (@dependabot[bot])
• bb30f8a: build(deps): bump golang from 1.23.1-alpine3.20 to 1.23.2-alpine3.20 (@dependabot[bot])
• 42c7a74: build(deps): bump golang from 1.23.2-alpine3.20 to 1.23.4-alpine3.20 (@dependabot[bot])
• 246b392: build(deps): bump golang.org/x/crypto from 0.27.0 to 0.28.0 (@dependabot[bot])
• 5096426: build(deps): bump golang.org/x/crypto from 0.28.0 to 0.31.0 (@dependabot[bot])
• f281e9f: build(deps): bump golang.org/x/mod from 0.21.0 to 0.22.0 (@dependabot[bot])
• faa328f: build(deps): bump golangci/golangci-lint-action from 6.1.0 to 6.1.1 (@dependabot[bot])
• 2a38800: build(deps): bump goreleaser/goreleaser-action from 6.0.0 to 6.1.0 (@dependabot[bot])
• 40c0389: build(deps): bump sigstore/cosign-installer from 3.6.0 to 3.7.0 (@dependabot[bot])

Documentation

• 398210a: docs: updated docs with the disable-html-escape cli option (@Aswinr24)

Changelog

Features

• 80bf19c: feat: change default output version to 1.6 (@nscuro)
• d304d89: feat: dont rely on cyclonedx cli for bom validation (@nscuro)
• 6a03474: feat: switch snapshot tests from xml to json (@nscuro)

Fixes

• 9cddfb0: fix: fmt.Errorf -> errors.New (@nscuro)
• 7c6357f: fix: exclude schema files from license check (@nscuro)
• 4039a89: fix: failing InvalidOutputVersion test (@nscuro)
• 1ea4afd: fix: handle breaking change in skywalking-eyes (@nscuro)
• 32c943d: fix: ignore init lint failure (@nscuro)
• 95bd45c: fix: incorrect go directive in go.mod (@nscuro)
• a05b56d: fix: linter errors (@nscuro)
• 5987947: fix: redact platform-dependent values in snapshot tests (@nscuro)
• f9e550b: fix: remove deprecated goreleaser flag (@nscuro)

Building and Packaging

• 74ef5e8: build(deps): bump actions/checkout from 4.1.2 to 4.1.4 (@dependabot[bot])
• f99b6b7: build(deps): bump actions/checkout from 4.1.4 to 4.1.6 (@dependabot[bot])
• 7535647: build(deps): bump actions/checkout from 4.1.6 to 4.1.7 (@dependabot[bot])
• 2d70b1c: build(deps): bump actions/setup-go from 5.0.0 to 5.0.1 (@dependabot[bot])
• 034893f: build(deps): bump actions/setup-go from 5.0.1 to 5.0.2 (@dependabot[bot])
• 6ef596d: build(deps): bump apache/skywalking-eyes from 0.4.0 to 0.6.0 (@dependabot[bot])
• 163a3c0: build(deps): bump aquasecurity/trivy-action from 0.19.0 to 0.21.0 (@dependabot[bot])
• a23a7a3: build(deps): bump aquasecurity/trivy-action from 0.21.0 to 0.22.0 (@dependabot[bot])
• f571455: build(deps): bump aquasecurity/trivy-action from 0.22.0 to 0.23.0 (@dependabot[bot])
• 71b7d69: build(deps): bump aquasecurity/trivy-action from 0.23.0 to 0.24.0 (@dependabot[bot])
• a6fb053: build(deps): bump docker/login-action from 3.1.0 to 3.2.0 (@dependabot[bot])
• f0acfa9: build(deps): bump docker/login-action from 3.2.0 to 3.3.0 (@dependabot[bot])
• 08c1f88: build(deps): bump docker/setup-qemu-action from 3.0.0 to 3.2.0 (@dependabot[bot])
• 61cb8f1: build(deps): bump github.com/CycloneDX/cyclonedx-go from 0.8.0 to 0.9.0 (@dependabot[bot])
• 1972b88: build(deps): bump github.com/go-git/go-git/v5 from 5.11.0 to 5.12.0 (@dependabot[bot])
• a8a5cc4: build(deps): bump github.com/rs/zerolog from 1.32.0 to 1.33.0 (@dependabot[bot])
• 6d49b2e: build(deps): bump github/codeql-action from 2.13.4 to 3.25.6 (@dependabot[bot])
• f16cdce: build(deps): bump github/codeql-action from 3.25.10 to 3.25.15 (@dependabot[bot])
• c4b79a6: build(deps): bump github/codeql-action from 3.25.15 to 3.26.0 (@dependabot[bot])
• f7de6db: build(deps): bump github/codeql-action from 3.25.6 to 3.25.7 (@dependabot[bot])
• 36f358f: build(deps): bump github/codeql-action from 3.25.7 to 3.25.8 (@dependabot[bot])
• c17db9c: build(deps): bump github/codeql-action from 3.25.8 to 3.25.9 (@dependabot[bot])
• af6e3f3: build(deps): bump github/codeql-action from 3.25.9 to 3.25.10 (@dependabot[bot])
• a1c5a1d: build(deps): bump github/codeql-action from 3.26.0 to 3.26.6 (@dependabot[bot])
• 114d480: build(deps): bump gitpod/workspace-go from 02cae32 to 769e7b0 (@dependabot[bot])
• e918dde: build(deps): bump gitpod/workspace-go from 1fd550f to 8d15123 (@dependabot[bot])
• 728ff78: build(deps): bump gitpod/workspace-go from 2a9e01c to 9c95281 (@dependabot[bot])
• 34f111f: build(deps): bump gitpod/workspace-go from 769e7b0 to 1fd550f (@dependabot[bot])
• 5d92fb6: build(deps): bump gitpod/workspace-go from 8d15123 to 95d2129 (@dependabot[bot])
• 6c7c413: build(deps): bump gitpod/workspace-go from 95d2129 to 2a9e01c (@dependabot[bot])
• 5b43149: build(deps): bump gitpod/workspace-go from b746928 to 02cae32 (@dependabot[bot])
• 6b73888: build(deps): bump golang from 1.22.2-alpine3.18 to 1.22.3-alpine3.18 (@dependabot[bot])
• da8d897: build(deps): bump golang from 4531927 to d1a601b (@dependabot[bot])
• 1e7183f: build(deps): bump golang.org/x/crypto from 0.22.0 to 0.23.0 (@dependabot[bot])
• 3aec1a1: build(deps): bump golang.org/x/crypto from 0.23.0 to 0.24.0 (@dependabot[bot])
• 2f8b783: build(deps): bump golang.org/x/crypto from 0.24.0 to 0.25.0 (@dependabot[bot])
• d1b2942: build(deps): bump golang.org/x/crypto from 0.25.0 to 0.26.0 (@dependabot[bot])
• 6c4db8d: build(deps): bump golang.org/x/crypto from 0.26.0 to 0.27.0 (@dependabot[bot])
• b3b46aa: build(deps): bump golang.org/x/mod from 0.17.0 to 0.18.0 (@dependabot[bot])
• fe7503c: build(deps): bump golang.org/x/mod from 0.18.0 to 0.19.0 (@dependabot[bot])
• d619728: build(deps): bump golang.org/x/mod from 0.19.0 to 0.20.0 (@dependabot[bot])
• 39845fb: build(deps): bump golang.org/x/mod from 0.20.0 to 0.21.0 (@dependabot[bot])
• c59df5e: build(deps): bump golang.org/x/net from 0.22.0 to 0.23.0 (@dependabot[bot])
• 15182f2: build(deps): bump golangci/golangci-lint-action from 4.0.0 to 5.1.0 (@dependabot[bot])
• f3fa84c: build(deps): bump golangci/golangci-lint-action from 5.1.0 to 6.0.1 (@dependabot[bot])
• d085de2: build(deps): bump golangci/golangci-lint-action from 6.0.1 to 6.1.0 (@dependabot[bot])
• eb667a9: build(deps): bump goreleaser/goreleaser-action from 5.0.0 to 5.1.0 (@dependabot[bot])
• fd72f9b: build(deps): bump goreleaser/goreleaser-action from 5.1.0 to 6.0.0 (@dependabot[bot])
• 86196cf: build(deps): bump sigstore/cosign-installer from 3.4.0 to 3.5.0 (@dependabot[bot])
• 2f863cc: build(deps): bump sigstore/cosign-installer from 3.5.0 to 3.6.0 (@dependabot[bot])
• c62c3d8: build: bump go to 1.23.1 (@nscuro)

Documentation

• a934b7f: docs: Fix outdated CDX-version information in README (@ja-he)
• 6ac31ab: docs: update supported spec versions in readme (@nscuro)

Others

• 1fc2435: chore: CodeQL run scheduled and manual (@jkowalleck)

Changelog

Features

• b7cd1be: feat: build against go 1.22 in ci (@nscuro)
• cab6d46: feat: bump baseline go version to 1.21 (@nscuro)
• 7865448: feat: change default output spec version to v1.5 (@nscuro)

Fixes

• 5b5153e: fix: handle breaking change in metadata.tools (@nscuro)
• d0fc72d: fix: ignore deprecation lint on legacy Tool type (@nscuro)
• 4550c9b: fix: spec version validation (@nscuro)
• 8018799: fix: work around broken #nosec in gosec (@nscuro)

Building and Packaging

• 75d8eb6: build(deps): bump actions/checkout from 4.1.1 to 4.1.2 (@dependabot[bot])
• 10e3de7: build(deps): bump aquasecurity/trivy-action from 0.16.1 to 0.17.0 (@dependabot[bot])
• 5283b95: build(deps): bump aquasecurity/trivy-action from 0.17.0 to 0.19.0 (@dependabot[bot])
• 6bb9fdd: build(deps): bump docker/login-action from 3.0.0 to 3.1.0 (@dependabot[bot])
• 2eaa786: build(deps): bump github.com/CycloneDX/cyclonedx-go from 0.7.1 to 0.8.0 (@dependabot[bot])
• 44906d1: build(deps): bump github.com/rs/zerolog from 1.31.0 to 1.32.0 (@dependabot[bot])
• 63d4b19: build(deps): bump github.com/stretchr/testify from 1.8.4 to 1.9.0 (@dependabot[bot])
• fbcff63: build(deps): bump gitpod/workspace-go from 817abc4 to b746928 (@dependabot[bot])
• 06ccb60: build(deps): bump golang from 1.21.6-alpine3.18 to 1.22.2-alpine3.18 (@dependabot[bot])
• f0d95f1: build(deps): bump golang.org/x/crypto from 0.18.0 to 0.19.0 (@dependabot[bot])
• def890a: build(deps): bump golang.org/x/crypto from 0.19.0 to 0.22.0 (@dependabot[bot])
• 78946eb: build(deps): bump golang.org/x/mod from 0.14.0 to 0.15.0 (@dependabot[bot])
• 46c5b97: build(deps): bump golang.org/x/mod from 0.15.0 to 0.17.0 (@dependabot[bot])
• 268ed52: build(deps): bump golangci/golangci-lint-action from 3.7.0 to 4.0.0 (@dependabot[bot])
• b64ba8b: build(deps): bump sigstore/cosign-installer from 3.3.0 to 3.4.0 (@dependabot[bot])

Changelog

Features

• 6b624c3: feat: support storing file paths relative to module root (#412) (@SweetVishnya)

Building and Packaging

• bc8ce58: build(deps): bump actions/setup-go from 4.1.0 to 5.0.0 (@dependabot[bot])
• 4164841: build(deps): bump aquasecurity/trivy-action from 0.15.0 to 0.16.0 (@dependabot[bot])
• 5a729d2: build(deps): bump aquasecurity/trivy-action from 0.16.0 to 0.16.1 (@dependabot[bot])
• 8ddcae0: build(deps): bump github.com/cloudflare/circl from 1.3.3 to 1.3.7 (@dependabot[bot])
• 573126a: build(deps): bump github.com/go-git/go-git/v5 from 5.10.1 to 5.11.0 (@dependabot[bot])
• 199d9cb: build(deps): bump github.com/google/uuid from 1.4.0 to 1.6.0 (@dependabot[bot])
• aebe71f: build(deps): bump gitpod/workspace-go from 05594b7 to 28c97d8 (@dependabot[bot])
• 11e5bb1: build(deps): bump gitpod/workspace-go from 28c97d8 to d608afb (@dependabot[bot])
• 1f472e1: build(deps): bump gitpod/workspace-go from d608afb to 817abc4 (@dependabot[bot])
• 9bf82be: build(deps): bump golang from 1.21.5-alpine3.18 to 1.21.6-alpine3.18 (@dependabot[bot])
• 8fb239a: build(deps): bump golang from 3bd4475 to 3354c3a (@dependabot[bot])
• 9639df6: build(deps): bump golang from 5c1cabd to 9390a99 (@dependabot[bot])
• 8c1bdf3: build(deps): bump golang from 869193e to 3bd4475 (@dependabot[bot])
• 8848013: build(deps): bump golang.org/x/crypto from 0.16.0 to 0.18.0 (@dependabot[bot])
• 331e272: build(deps): bump sigstore/cosign-installer from 3.2.0 to 3.3.0 (@dependabot[bot])

Changelog

Fixes

• 064b068: fix: address goconst linter finding (@nscuro)

Building and Packaging

• a37e219: build(deps): bump actions/checkout from 3.5.3 to 3.6.0 (@dependabot[bot])
• 3e04af4: build(deps): bump actions/checkout from 3.6.0 to 4.1.0 (@dependabot[bot])
• 4ff23ee: build(deps): bump actions/checkout from 4.1.0 to 4.1.1 (@dependabot[bot])
• 3ba5a9c: build(deps): bump actions/setup-go from 4.0.1 to 4.1.0 (@dependabot[bot])
• bb461a2: build(deps): bump aquasecurity/trivy-action from 0.11.2 to 0.12.0 (@dependabot[bot])
• 164de0a: build(deps): bump aquasecurity/trivy-action from 0.12.0 to 0.14.0 (@dependabot[bot])
• 0202226: build(deps): bump aquasecurity/trivy-action from 0.14.0 to 0.15.0 (@dependabot[bot])
• 30e7fcd: build(deps): bump docker/login-action from 2.2.0 to 3.0.0 (@dependabot[bot])
• 4ec1675: build(deps): bump docker/setup-qemu-action from 2.2.0 to 3.0.0 (@dependabot[bot])
• b59fb32: build(deps): bump github.com/go-git/go-git/v5 from 5.8.1 to 5.9.0 (@dependabot[bot])
• 3502184: build(deps): bump github.com/go-git/go-git/v5 from 5.9.0 to 5.10.1 (@dependabot[bot])
• 46e241c: build(deps): bump github.com/google/uuid from 1.3.0 to 1.3.1 (@dependabot[bot])
• 3c1b101: build(deps): bump github.com/google/uuid from 1.3.1 to 1.4.0 (@dependabot[bot])
• c948c25: build(deps): bump github.com/rs/zerolog from 1.30.0 to 1.31.0 (@dependabot[bot])
• fa436e1: build(deps): bump gitpod/workspace-go from 0f38231 to 06ca870 (@dependabot[bot])
• cfa6134: build(deps): bump gitpod/workspace-go from 487cfd3 to 5e45d83 (@dependabot[bot])
• 02f640d: build(deps): bump gitpod/workspace-go from 5e45d83 to d3603c7 (@dependabot[bot])
• d33d175: build(deps): bump gitpod/workspace-go from 6290ac5 to 0f38231 (@dependabot[bot])
• 7c165a4: build(deps): bump gitpod/workspace-go from 94ae638 to 6290ac5 (@dependabot[bot])
• b2c7596: build(deps): bump gitpod/workspace-go from d3603c7 to 94ae638 (@dependabot[bot])
• 212e79b: build(deps): bump gitpod/workspace-go from f37c673 to 487cfd3 (@dependabot[bot])
• 1ae57dd: build(deps): bump golang from 1.20.7-alpine3.18 to 1.21.5-alpine3.18 (@dependabot[bot])
• cfbeac7: build(deps): bump golang.org/x/crypto from 0.11.0 to 0.12.0 (@dependabot[bot])
• cd3a38f: build(deps): bump golang.org/x/crypto from 0.13.0 to 0.14.0 (@dependabot[bot])
• 9b61805: build(deps): bump golang.org/x/crypto from 0.15.0 to 0.16.0 (@dependabot[bot])
• d7221f7: build(deps): bump golang.org/x/mod from 0.12.0 to 0.13.0 (@dependabot[bot])
• 93b808f: build(deps): bump golang.org/x/mod from 0.13.0 to 0.14.0 (@dependabot[bot])
• cdfb139: build(deps): bump golang.org/x/net from 0.15.0 to 0.17.0 (@dependabot[bot])
• 2aca6aa: build(deps): bump golangci/golangci-lint-action from 3.6.0 to 3.7.0 (@dependabot[bot])
• 29730f3: build(deps): bump goreleaser/goreleaser-action from 4.3.0 to 4.4.0 (@dependabot[bot])
• 13e8204: build(deps): bump goreleaser/goreleaser-action from 4.4.0 to 5.0.0 (@dependabot[bot])
• 453ae8f: build(deps): bump sigstore/cosign-installer (@dependabot[bot])
• d9e7a9f: build(deps): bump sigstore/cosign-installer (@dependabot[bot])
• d4df73e: build(deps): bump sigstore/cosign-installer from 3.1.2 to 3.2.0 (@dependabot[bot])

Others

• 9473377: chore: raise baseline go version to 1.20 (@nscuro)
• e81ccd1: ci: bump cyclonedx-cli to v0.25.0 (@nscuro)
• f532562: ci: fix deprecated goreleaser flags (@nscuro)

Changelog

Features

• fbf8c29: feat: bump go base images to 1.20.7 (@nscuro)

Fixes

• 38c50d8: fix: errors being logged in json format when they shouldn't (@nscuro)
• 5263237: fix: missing --yes flag for cosign (@nscuro)
• 8e8abae: fix: permission denied for /.cache/go-build in container (@nscuro)

Building and Packaging

• d4306ba: build(deps): bump golang.org/x/exp to v0.0.0-20230801115018-d63ba01acd4b (@nscuro)
• 37a2163: build(deps): bump actions/checkout from 3.5.1 to 3.5.2 (@dependabot[bot])
• 98a4440: build(deps): bump actions/checkout from 3.5.2 to 3.5.3 (@dependabot[bot])
• b9166b1: build(deps): bump actions/setup-go from 4.0.0 to 4.0.1 (@dependabot[bot])
• 948d7f7: build(deps): bump aquasecurity/trivy-action from 0.10.0 to 0.11.0 (@dependabot[bot])
• 2a011ee: build(deps): bump aquasecurity/trivy-action from 0.11.0 to 0.11.2 (@dependabot[bot])
• 64f406c: build(deps): bump aquasecurity/trivy-action from 0.9.2 to 0.10.0 (@dependabot[bot])
• 78ec046: build(deps): bump docker/login-action from 2.1.0 to 2.2.0 (@dependabot[bot])
• 6d804fc: build(deps): bump docker/setup-qemu-action from 2.1.0 to 2.2.0 (@dependabot[bot])
• 6539185: build(deps): bump github.com/go-git/go-git/v5 from 5.6.1 to 5.7.0 (@dependabot[bot])
• ca27bfc: build(deps): bump github.com/go-git/go-git/v5 from 5.7.0 to 5.8.1 (@dependabot[bot])
• e05885e: build(deps): bump github.com/peterbourgon/ff/v3 from 3.3.0 to 3.3.1 (@dependabot[bot])
• 5e0cf1a: build(deps): bump github.com/peterbourgon/ff/v3 from 3.3.1 to 3.3.2 (@dependabot[bot])
• 2361df0: build(deps): bump github.com/peterbourgon/ff/v3 from 3.3.2 to 3.4.0 (@dependabot[bot])
• c1a568a: build(deps): bump github.com/rs/zerolog from 1.29.0 to 1.29.1 (@dependabot[bot])
• 7b58508: build(deps): bump github.com/rs/zerolog from 1.29.1 to 1.30.0 (@dependabot[bot])
• 691bf2b: build(deps): bump github.com/stretchr/testify from 1.8.2 to 1.8.4 (@dependabot[bot])
• e1aed57: build(deps): bump github/codeql-action from 2.2.11 to 2.3.3 (@dependabot[bot])
• d6d7944: build(deps): bump github/codeql-action from 2.3.3 to 2.13.4 (@dependabot[bot])
• 7126a9f: build(deps): bump gitpod/workspace-go from 08b6bdc to d7a41f5 (@dependabot[bot])
• ed7fc32: build(deps): bump gitpod/workspace-go from 7bf5091 to 08b6bdc (@dependabot[bot])
• 679615f: build(deps): bump gitpod/workspace-go from d7a41f5 to f37c673 (@dependabot[bot])
• 05231bc: build(deps): bump golang from 1.20.3-alpine3.16 to 1.20.4-alpine3.16 (@dependabot[bot])
• 369bbce: build(deps): bump golang.org/x/crypto from 0.10.0 to 0.11.0 (@dependabot[bot])
• 695911e: build(deps): bump golang.org/x/crypto from 0.8.0 to 0.9.0 (@dependabot[bot])
• c7047f1: build(deps): bump golang.org/x/crypto from 0.9.0 to 0.10.0 (@dependabot[bot])
• 5e46093: build(deps): bump golang.org/x/mod from 0.10.0 to 0.11.0 (@dependabot[bot])
• a711766: build(deps): bump golang.org/x/mod from 0.11.0 to 0.12.0 (@dependabot[bot])
• 03a27c1: build(deps): bump golangci/golangci-lint-action from 3.4.0 to 3.5.0 (@dependabot[bot])
• ee2b8af: build(deps): bump golangci/golangci-lint-action from 3.5.0 to 3.6.0 (@dependabot[bot])
• 3605c88: build(deps): bump goreleaser/goreleaser-action from 4.2.0 to 4.3.0 (@dependabot[bot])
• 94182fc: build(deps): bump sigstore/cosign-installer (@dependabot[bot])
• b64eb5c: build(deps): bump sigstore/cosign-installer (@dependabot[bot])
• f739b28: build(deps): bump sigstore/cosign-installer (@dependabot[bot])

Documentation

• f87ab90: docs: add note about license assertion (@nscuro)

Others

• fd1ef2f: ci: bump go to 1.20 (@nscuro)
• 835af6b: misc(dx): add project icon for intellij and goland (@nscuro)

Changelog

Features

• 86d7a92: feat: add GOOS and GOARCH into PURL (#217) (@zdtsw)
• df6b19e: feat: add support for output of older spec versions (@nscuro)

Fixes

• e219a24: fix: module tests for cross-platform compatibility (#253) (@neilnaveen)

Building and Packaging

• e59fa66: build(deps): bump actions/checkout from 3.1.0 to 3.2.0 (@dependabot[bot])
• a18e39d: build(deps): bump actions/checkout from 3.2.0 to 3.3.0 (@dependabot[bot])
• 18adb3e: build(deps): bump actions/checkout from 3.3.0 to 3.5.0 (@dependabot[bot])
• 2907e70: build(deps): bump actions/checkout from 3.5.0 to 3.5.1 (@dependabot[bot])
• a33451c: build(deps): bump actions/setup-go from 3.3.1 to 3.4.0 (@dependabot[bot])
• 0055cba: build(deps): bump actions/setup-go from 3.4.0 to 3.5.0 (@dependabot[bot])
• 2c330f4: build(deps): bump actions/setup-go from 3.5.0 to 4.0.0 (@dependabot[bot])
• 99e5f7a: build(deps): bump aquasecurity/trivy-action from 0.6.2 to 0.7.1 (#190) (@dependabot[bot])
• feb93f9: build(deps): bump aquasecurity/trivy-action from 0.7.1 to 0.8.0 (@dependabot[bot])
• 65bdf0b: build(deps): bump aquasecurity/trivy-action from 0.8.0 to 0.9.2 (@dependabot[bot])
• 3cf1b61: build(deps): bump github.com/CycloneDX/cyclonedx-go from 0.7.0 to 0.7.1 (@dependabot[bot])
• 4182911: build(deps): bump github.com/bradleyjkemp/cupaloy/v2 from 2.7.0 to 2.8.0 (@dependabot[bot])
• 7aa9e25: build(deps): bump github.com/go-git/go-git/v5 from 5.4.2 to 5.5.1 (@dependabot[bot])
• d99f077: build(deps): bump github.com/go-git/go-git/v5 from 5.5.1 to 5.5.2 (@dependabot[bot])
• 5cfaac3: build(deps): bump github.com/go-git/go-git/v5 from 5.5.2 to 5.6.0 (@dependabot[bot])
• f1c3f57: build(deps): bump github.com/go-git/go-git/v5 from 5.6.0 to 5.6.1 (@dependabot[bot])
• 7479f0a: build(deps): bump github.com/rs/zerolog from 1.27.0 to 1.28.0 (@dependabot[bot])
• 24ba9c2: build(deps): bump github.com/rs/zerolog from 1.28.0 to 1.29.0 (@dependabot[bot])
• 405ca77: build(deps): bump github.com/stretchr/testify from 1.8.0 to 1.8.1 (@dependabot[bot])
• 6c5a0f6: build(deps): bump github.com/stretchr/testify from 1.8.1 to 1.8.2 (@dependabot[bot])
• a47841a: build(deps): bump github/codeql-action (@dependabot[bot])
• 98787d9: build(deps): bump github/codeql-action from 2.1.31 to 2.1.36 (@dependabot[bot])
• 99ad277: build(deps): bump github/codeql-action from 2.1.36 to 2.1.39 (@dependabot[bot])
• fe4d108: build(deps): bump github/codeql-action from 2.1.39 to 2.2.5 (@dependabot[bot])
• c44f8f1: build(deps): bump github/codeql-action from 2.2.5 to 2.2.7 (@dependabot[bot])
• 7a2b1b0: build(deps): bump github/codeql-action from 2.2.7 to 2.2.8 (@dependabot[bot])
• 37d77e4: build(deps): bump github/codeql-action from 2.2.8 to 2.2.11 (@dependabot[bot])
• 5f86996: build(deps): bump gitpod/workspace-go from 2be827f to 7bf5091 (@dependabot[bot])
• 8e2f88a: build(deps): bump golang from 1.18.5-alpine3.16 to 1.19.3-alpine3.16 (@dependabot[bot])
• 0dbe27b: build(deps): bump golang from 1.19.3-alpine3.16 to 1.19.4-alpine3.16 (@dependabot[bot])
• 4529125: build(deps): bump golang from 1.19.4-alpine3.16 to 1.19.5-alpine3.16 (@dependabot[bot])
• b27f4b9: build(deps): bump golang from 1.19.5-alpine3.16 to 1.20.2-alpine3.16 (@dependabot[bot])
• 811371b: build(deps): bump golang from 1.20.2-alpine3.16 to 1.20.3-alpine3.16 (@dependabot[bot])
• 20b6a25: build(deps): bump golang from 8558ae6 to dc4f475 (@dependabot[bot])
• bedf9f6: build(deps): bump golang.org/x/crypto from 0.3.0 to 0.4.0 (@dependabot[bot])
• 5040afa: build(deps): bump golang.org/x/crypto from 0.4.0 to 0.5.0 (@dependabot[bot])
• 9e982a2: build(deps): bump golang.org/x/crypto from 0.5.0 to 0.6.0 (@dependabot[bot])
• e091e69: build(deps): bump golang.org/x/crypto from 0.6.0 to 0.7.0 (@dependabot[bot])
• 963cf30: build(deps): bump golang.org/x/crypto from 0.7.0 to 0.8.0 (@dependabot[bot])
• 993dab0: build(deps): bump golang.org/x/mod (@dependabot[bot])
• 4a2610b: build(deps): bump golang.org/x/mod from 0.8.0 to 0.9.0 (@dependabot[bot])
• 58c520a: build(deps): bump golang.org/x/mod from 0.9.0 to 0.10.0 (@dependabot[bot])
• 2b5037c: build(deps): bump golang.org/x/net from 0.5.0 to 0.7.0 (@dependabot[bot])
• 44d49f4: build(deps): bump golangci/golangci-lint-action from 3.2.0 to 3.3.0 (@dependabot[bot])
• 896135d: build(deps): bump golangci/golangci-lint-action from 3.3.0 to 3.3.1 (@dependabot[bot])
• 8316594: build(deps): bump golangci/golangci-lint-action from 3.3.1 to 3.4.0 (@dependabot[bot])
• f512843: build(deps): bump goreleaser/goreleaser-action from 3.0.0 to 3.1.0 (@dependabot[bot])
• b851cf6: build(deps): bump goreleaser/goreleaser-action from 3.1.0 to 3.2.0 (@dependabot[bot])
• ec3a94c: build(deps): bump goreleaser/goreleaser-action from 3.2.0 to 4.1.0 (@dependabot[bot])
• b2f95c8: build(deps): bump goreleaser/goreleaser-action from 4.1.0 to 4.2.0 (@dependabot[bot])
• 730898b: build(deps): bump sigstore/cosign-installer from 2.5.0 to 2.5.1 (#188) (@dependabot[bot])
• 9eb69fa: build(deps): bump sigstore/cosign-installer from 2.5.1 to 2.6.0 (@dependabot[bot])
• 9008f06: build(deps): bump sigstore/cosign-installer from 2.6.0 to 2.7.0 (@dependabot[bot])
• f5716c2: build(deps): bump sigstore/cosign-installer from 2.7.0 to 2.8.1 (@dependabot[bot])
• bc3fb39: build: pin digest of gitpod dockerfile (@nscuro)
• 9a1042a: build: update cyclonedx-cli to 0.24.2 (@nscuro)

Documentation

• a045269: docs: update README.md (#189) (@tusharxoxoxo)

Others

• 96b10ee: ci: pin digests of github actions (@nscuro)