Releases: bomly-dev/bomly-cli
Releases · bomly-dev/bomly-cli
Release list
v0.21.1
Immutable
release. Only release title and notes can be modified.
What's Changed
- docs: reorganize navigation and group detector pages by ecosystem by @bomly-guy in #358
- feat(sbom): write CycloneDX 1.7 by default by @bomly-guy in #357
Full Changelog: v0.21.0...v0.21.1
Release artifacts
- Full builtin
bomlyarchives for Linux, macOS, and Windows. - Alternate
bomly-litearchives for users who prefer external Syft and Grype binaries. - Linux packages for Debian, RPM, Alpine, and Arch-compatible package managers.
- Homebrew, Scoop, and WinGet package-manager manifests or publishing pull requests.
SHA256SUMSfor release artifact verification, signed keylessly with cosign (SHA256SUMS.sigstore.json).- SLSA Build Level 3 provenance (
multiple.intoto.jsonl) generated by slsa-github-generator.
Each archive includes LICENSE, NOTICE, and a licenses/ directory with third-party license texts. See Verify release checksums for signature and provenance verification commands.
Contributors
bomly-guy
Assets 26
- 13.8 MB
2026-07-30T15:53:07Z - 12.9 MB
2026-07-30T15:53:07Z - 13.5 MB
2026-07-30T15:53:09Z - 12.4 MB
2026-07-30T15:53:09Z - 14.9 MB
2026-07-30T15:53:07Z - 13.5 MB
2026-07-30T15:53:07Z - 33.8 MB
2026-07-30T15:53:05Z - 31.7 MB
2026-07-30T15:53:05Z - 33.5 MB
2026-07-30T15:53:10Z - 32.2 MB
2026-07-30T15:53:12Z -
2026-07-30T15:33:50Z -
2026-07-30T15:33:50Z -
2026-07-30T15:33:50Z - Loading
v0.21.0
Immutable
release. Only release title and notes can be modified.
What's Changed
- Bound in-process repository file reads by @bomly-guy in #341
- Bound remote Git target materialization by @bomly-guy in #342
- build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0 by @dependabot[bot] in #346
- build(deps): bump the github-actions-patch group with 4 updates by @dependabot[bot] in #345
- build(deps): bump bomly-dev/bomly-guard from 1.1.0 to 1.2.0 in the github-actions-minor group by @dependabot[bot] in #344
- build(deps): bump the gomod-minor group with 2 updates by @dependabot[bot] in #343
- Report dependency detail changes in diff by @bomly-guy in #347
- Review and audit risky dependency detail changes by @bomly-guy in #348
- Expand dependency source classification by @bomly-guy in #352
- Publish reproducible evidence cases by @bomly-guy in #353
- docs: first wave of docs improvements (FAQ, network page, command reference, link CI) by @bomly-guy in #350
- docs: wave 2 — expected output everywhere, integrations page, selector grammar by @bomly-guy in #354
- docs: clarify that file-only -o SBOM runs print nothing without --format by @bomly-guy in #355
- docs: wave 3 — end-to-end tutorial, diff-gating semantics fix, verification output by @bomly-guy in #356
Full Changelog: v0.20.2...v0.21.0
Release artifacts
- Full builtin
bomlyarchives for Linux, macOS, and Windows. - Alternate
bomly-litearchives for users who prefer external Syft and Grype binaries. - Linux packages for Debian, RPM, Alpine, and Arch-compatible package managers.
- Homebrew, Scoop, and WinGet package-manager manifests or publishing pull requests.
SHA256SUMSfor release artifact verification, signed keylessly with cosign (SHA256SUMS.sigstore.json).- SLSA Build Level 3 provenance (
multiple.intoto.jsonl) generated by slsa-github-generator.
Each archive includes LICENSE, NOTICE, and a licenses/ directory with third-party license texts. See Verify release checksums for signature and provenance verification commands.
Contributors
dependabot and bomly-guy
Assets 26
v0.20.2
Immutable
release. Only release title and notes can be modified.
What's Changed
- test: update smoke golden files by @github-actions[bot] in #318
- Require explicit trust for repository configuration by @bomly-guy in #320
- fix(matchers): pass distro and upstreams to Grype for OS packages by @bomly-guy in #323
- fix(matchers): query advisories by the ecosystem-native package name by @bomly-guy in #322
- fix(osv): emit spec purl types and make the name+ecosystem fallback reachable by @bomly-guy in #321
- Clarify network and plugin trust boundaries by @bomly-guy in #324
- feat(discovery): explain why each probed manifest candidate was skipped by @bomly-guy in #333
- fix(pip): scope direct dependencies, name project roots, diagnose old pip by @bomly-guy in #338
- feat(engine): report CI-readiness hints for package-manager mismatches by @bomly-guy in #335
- Honor Bomly no-proxy with standard proxy fallback by @bomly-guy in #325
- Redact credentials from endpoint logs by @bomly-guy in #327
- Add execution boundary assurance by @bomly-guy in #328
- Verify HTTP trust boundaries by @bomly-guy in #329
- Contain automatic baseline discovery by @bomly-guy in #330
- Bound untrusted security inputs by @bomly-guy in #336
- Bound managed plugin archive resources by @bomly-guy in #332
- Verify filesystem containment boundaries by @bomly-guy in #326
- Redact MCP tool errors by @bomly-guy in #331
- Sanitize subprocess diagnostics by @bomly-guy in #334
- Document security and trust boundaries by @bomly-guy in #337
Full Changelog: v0.20.1...v0.20.2
Release artifacts
- Full builtin
bomlyarchives for Linux, macOS, and Windows. - Alternate
bomly-litearchives for users who prefer external Syft and Grype binaries. - Linux packages for Debian, RPM, Alpine, and Arch-compatible package managers.
- Homebrew, Scoop, and WinGet package-manager manifests or publishing pull requests.
SHA256SUMSfor release artifact verification, signed keylessly with cosign (SHA256SUMS.sigstore.json).- SLSA Build Level 3 provenance (
multiple.intoto.jsonl) generated by slsa-github-generator.
Each archive includes LICENSE, NOTICE, and a licenses/ directory with third-party license texts. See Verify release checksums for signature and provenance verification commands.
Contributors
bomly-guy
Assets 26
v0.20.1
Immutable
release. Only release title and notes can be modified.
What's Changed
- Centralize vulnerability remediation enrichment by @bomly-guy in #288
- feat(matchers): declare supported ecosystems on built-in matchers by @bomly-guy in #315
- build(deps): bump setuptools from 82.0.1 to 83.0.0 in /.github in the pip group across 1 directory by @dependabot[bot] in #313
Full Changelog: v0.20.0...v0.20.1
Release artifacts
- Full builtin
bomlyarchives for Linux, macOS, and Windows. - Alternate
bomly-litearchives for users who prefer external Syft and Grype binaries. - Linux packages for Debian, RPM, Alpine, and Arch-compatible package managers.
- Homebrew, Scoop, and WinGet package-manager manifests or publishing pull requests.
SHA256SUMSfor release artifact verification, signed keylessly with cosign (SHA256SUMS.sigstore.json).- SLSA Build Level 3 provenance (
multiple.intoto.jsonl) generated by slsa-github-generator.
Each archive includes LICENSE, NOTICE, and a licenses/ directory with third-party license texts. See Verify release checksums for signature and provenance verification commands.
Contributors
dependabot and bomly-guy
Assets 26
v0.20.0
Immutable
release. Only release title and notes can be modified.
What's Changed
- Add portable finding baselines by @bomly-guy in #297
- feat(cli): frame-based startup banner animations with variants and env gating by @bomly-guy in #298
- Reject unsupported finding severities in baselines by @bomly-guy in #300
- Strengthen vulnerability consolidation assurance by @bomly-guy in #299
- fix(osv): surface degraded batch enrichment by @bomly-guy in #301
- test(baseline): strengthen lifecycle assurance by @bomly-guy in #302
- test(engine): add canonical graph accounting invariants by @bomly-guy in #303
- test(auditors): expand policy and SPDX assurance by @bomly-guy in #304
- fix(plugin): fully isolate descriptor snapshots by @bomly-guy in #306
- test(interfaces): strengthen compact and plugin contracts by @bomly-guy in #307
- test(parsers): broaden hostile-input fuzz coverage by @bomly-guy in #305
- test(performance): record reproducible run evidence by @bomly-guy in #309
- test(sbom): add pinned interoperability assurance by @bomly-guy in #308
- fix(jvm): parse Gradle settings on Windows by @bomly-guy in #310
- ci(assurance): explain workflow results by @bomly-guy in #311
- test: update smoke golden files by @github-actions[bot] in #312
Full Changelog: v0.19.2...v0.20.0
Release artifacts
- Full builtin
bomlyarchives for Linux, macOS, and Windows. - Alternate
bomly-litearchives for users who prefer external Syft and Grype binaries. - Linux packages for Debian, RPM, Alpine, and Arch-compatible package managers.
- Homebrew, Scoop, and WinGet package-manager manifests or publishing pull requests.
SHA256SUMSfor release artifact verification, signed keylessly with cosign (SHA256SUMS.sigstore.json).- SLSA Build Level 3 provenance (
multiple.intoto.jsonl) generated by slsa-github-generator.
Each archive includes LICENSE, NOTICE, and a licenses/ directory with third-party license texts. See Verify release checksums for signature and provenance verification commands.
Contributors
bomly-guy
Assets 26
v0.19.2
Immutable
release. Only release title and notes can be modified.
What's Changed
- Stabilize policy and integration surfaces by @bomly-guy in #296
Full Changelog: v0.19.1...v0.19.2
Release artifacts
- Full builtin
bomlyarchives for Linux, macOS, and Windows. - Alternate
bomly-litearchives for users who prefer external Syft and Grype binaries. - Linux packages for Debian, RPM, Alpine, and Arch-compatible package managers.
- Homebrew, Scoop, and WinGet package-manager manifests or publishing pull requests.
SHA256SUMSfor release artifact verification, signed keylessly with cosign (SHA256SUMS.sigstore.json).- SLSA Build Level 3 provenance (
multiple.intoto.jsonl) generated by slsa-github-generator.
Each archive includes LICENSE, NOTICE, and a licenses/ directory with third-party license texts. See Verify release checksums for signature and provenance verification commands.
Contributors
bomly-guy
Assets 26
v0.19.1
Immutable
release. Only release title and notes can be modified.
What's Changed
- build(deps): bump actions/setup-java from 5.5.0 to 5.6.0 in the github-actions-minor group by @dependabot[bot] in #291
- build(deps): bump the github-actions-patch group with 4 updates by @dependabot[bot] in #292
- build(deps): bump actions/setup-python from 6.3.0 to 7.0.0 by @dependabot[bot] in #293
- build(deps): bump actions/setup-dotnet from 5.4.0 to 6.0.0 by @dependabot[bot] in #294
- build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by @dependabot[bot] in #295
- build(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 in the gomod-patch group by @dependabot[bot] in #290
- build(deps): bump the gomod-minor group with 2 updates by @dependabot[bot] in #289
Full Changelog: v0.19.0...v0.19.1
Release artifacts
- Full builtin
bomlyarchives for Linux, macOS, and Windows. - Alternate
bomly-litearchives for users who prefer external Syft and Grype binaries. - Linux packages for Debian, RPM, Alpine, and Arch-compatible package managers.
- Homebrew, Scoop, and WinGet package-manager manifests or publishing pull requests.
SHA256SUMSfor release artifact verification, signed keylessly with cosign (SHA256SUMS.sigstore.json).- SLSA Build Level 3 provenance (
multiple.intoto.jsonl) generated by slsa-github-generator.
Each archive includes LICENSE, NOTICE, and a licenses/ directory with third-party license texts. See Verify release checksums for signature and provenance verification commands.
Contributors
dependabot
Assets 26
v0.19.0
Immutable
release. Only release title and notes can be modified.
What's Changed
- ci(release): fail fast when the winget PAT is expired or revoked by @bomly-guy in #283
- Strengthen Node dependency graph fidelity by @bomly-guy in #275
- ci(smoke): resilient goldens pipeline — per-invocation timeout + parallel per-ecosystem regeneration by @bomly-guy in #284
- test: update smoke golden files by @github-actions[bot] in #285
- ci(smoke): parallel per-ecosystem goldens regeneration + build-tool subprocess timeouts by @bomly-guy in #286
Full Changelog: v0.18.2...v0.19.0
Release artifacts
- Full builtin
bomlyarchives for Linux, macOS, and Windows. - Alternate
bomly-litearchives for users who prefer external Syft and Grype binaries. - Linux packages for Debian, RPM, Alpine, and Arch-compatible package managers.
- Homebrew, Scoop, and WinGet package-manager manifests or publishing pull requests.
SHA256SUMSfor release artifact verification, signed keylessly with cosign (SHA256SUMS.sigstore.json).- SLSA Build Level 3 provenance (
multiple.intoto.jsonl) generated by slsa-github-generator.
Each archive includes LICENSE, NOTICE, and a licenses/ directory with third-party license texts. See Verify release checksums for signature and provenance verification commands.
Contributors
bomly-guy
Assets 26
v0.18.2
Immutable
release. Only release title and notes can be modified.
What's Changed
- fix(detectors): keep multi-module finding locations repo-relative by @bomly-guy in #282
Full Changelog: v0.18.1...v0.18.2
Release artifacts
- Full builtin
bomlyarchives for Linux, macOS, and Windows. - Alternate
bomly-litearchives for users who prefer external Syft and Grype binaries. - Linux packages for Debian, RPM, Alpine, and Arch-compatible package managers.
- Homebrew, Scoop, and WinGet package-manager manifests or publishing pull requests.
SHA256SUMSfor release artifact verification, signed keylessly with cosign (SHA256SUMS.sigstore.json).- SLSA Build Level 3 provenance (
multiple.intoto.jsonl) generated by slsa-github-generator.
Each archive includes LICENSE, NOTICE, and a licenses/ directory with third-party license texts. See Verify release checksums for signature and provenance verification commands.
Contributors
bomly-guy
Assets 25
v0.18.1
Immutable
release. Only release title and notes can be modified.
What's Changed
- feat(gradle): per-module manifests for multi-project builds + first-party enrichment skip by @bomly-guy in #271
Full Changelog: v0.18.0...v0.18.1
Release artifacts
- Full builtin
bomlyarchives for Linux, macOS, and Windows. - Alternate
bomly-litearchives for users who prefer external Syft and Grype binaries. - Linux packages for Debian, RPM, Alpine, and Arch-compatible package managers.
- Homebrew, Scoop, and WinGet package-manager manifests or publishing pull requests.
SHA256SUMSfor release artifact verification, signed keylessly with cosign (SHA256SUMS.sigstore.json).- SLSA Build Level 3 provenance (
multiple.intoto.jsonl) generated by slsa-github-generator.
Each archive includes LICENSE, NOTICE, and a licenses/ directory with third-party license texts. See Verify release checksums for signature and provenance verification commands.
Contributors
bomly-guy