What's Changed

• build(deps): bump actions/setup-java from 5.5.0 to 5.6.0 in the github-actions-minor group by @dependabot[bot] in #291
• build(deps): bump the github-actions-patch group with 4 updates by @dependabot[bot] in #292
• build(deps): bump actions/setup-python from 6.3.0 to 7.0.0 by @dependabot[bot] in #293
• build(deps): bump actions/setup-dotnet from 5.4.0 to 6.0.0 by @dependabot[bot] in #294
• build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by @dependabot[bot] in #295
• build(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 in the gomod-patch group by @dependabot[bot] in #290
• build(deps): bump the gomod-minor group with 2 updates by @dependabot[bot] in #289

Full Changelog: v0.19.0...v0.19.1

Release artifacts

• Full builtin bomly archives for Linux, macOS, and Windows.
• Alternate bomly-lite archives for users who prefer external Syft and Grype binaries.
• Linux packages for Debian, RPM, Alpine, and Arch-compatible package managers.
• Homebrew, Scoop, and WinGet package-manager manifests or publishing pull requests.
• SHA256SUMS for release artifact verification, signed keylessly with cosign (SHA256SUMS.sigstore.json).
• SLSA Build Level 3 provenance (multiple.intoto.jsonl) generated by slsa-github-generator.

Each archive includes LICENSE, NOTICE, and a licenses/ directory with third-party license texts. See Verify release checksums for signature and provenance verification commands.