0.2.15

Changelog

v0.2.15 (2025-04-08)

⚠ BREAKING-CHANGE

• The upgraded parser aligns with RFC 9535, and notlonger supports the $.[] notation. It must be converted into $[].
  This is important for the group extraction with OIDC, specifically
  with AWS Cognito.

Fixes

• prevent deadlock when inserting in parallel (cc7e933), closes #1531
• reap crashed jobs so they don't appear "stuck" in the UI (5cd120a), closes
  #1499

0.2.14

Changelog

v0.2.14 (2025-04-04)

Features

• collect and report SBOM supplier information (1dd52a7)

Fixes

• pythonver_cmp function to properly handle local versions (e4f6c3e)
• cvss scores with I:N and A:N score properly now (9f66ad3), closes #1519
• mavenver_cmp add logic to compare builds (d073efb)
• mavenver_cmp function fail to compare versions with build numbers properly
  (e24b49f)
• add a migration to fix null values for suppliers (153502a)
• ensure load order does not impact analysis graph dependency queries
  (28a8ccb)
• TC-2388 OSV range with last_affected (2e158d4)
• get_purl now deals with missing ns properly (fc9ecef), closes #1456
• set title for vunerabilities with non typical description language code
  (13ea3a9)

0.2.13

Changelog

v0.2.13 (2025-03-31)

Fixes

• use patched version of spdx-rs until the fix is merged and released
  (53e899b), closes #1492
• /sbom/by-package api can now sort results by name (f3dd287), closes #1476

0.2.12

Changelog

v0.2.12 (2025-03-28)

Features

• add score to response (2b28f63), closes #1473
• add pg_stats to the compose database (15f36b4)

Fixes

• add vulnerability details in purl details for product statuses (1c21296)
• purl components now properly encoded in Display impl (dfb430b)

0.2.11

Changelog

v0.2.11 (2025-03-25)

Features

• expose the group of an SBOM package (4cccd4f)
• allow purl's to be included in purl queries (cd9ce84)
• filter components by partial matches of a purl and/or cpe (f61f172), closes
  #1280
• drop redundant functions and refactor loops (6174528)
• add endpoint to process multiple purls (e8aaae0)

Fixes

• prevent an OOM situation by using a stream as result (a311672)

0.2.10

Changelog

v0.2.10 (2025-03-14)

Features

• adds metric of running importers (14acaa4)

Fixes

• prevent duplicate PURLs or CPEs being returned (123348a), closes #1417
• imageindex>imagevariant external sboms (2cb286d)
• dataset test (2aa3d21)
• issues is optional for advisory (c2c3249)
• fetch vulnerability description in the queries instead of loop (50bdcfb)
• fetch advisory issues in the queries instead of loop (4203ef6)
• improve perfromance of sbom/advisory endpoint (c78e877)
• prevent database passwords being logged (541ad10), closes #1409
• ensure we always detect a duplicate source document (92f223c), closes #1405
• prevent stack overflow (250160c), closes #1322
• terraform: only ensure the tag exists, don't require a value (6c78c45)

0.2.9

Changelog

v0.2.9 (2025-03-07)

Fixes

• prevent creating duplicate advisories when uploading in parallel (325b0fc),
  closes #1395
• ancestor query so that any external parent sboms are returned (994c701)
• don't create duplicate documents when ingesting in parallel (0ed6e7b),
  closes #1395
• upgrade antora from 3.1.9 to 3.1.10 (03eb218)
• analysis graph needs to consult graph_cache for external sboms, added tests
  (5949cff)
• external sbom cdx example and tightened related tests (4fd6dfd)
• find analysis components by q=purl (a8370b5), closes #1280

0.2.8

Changelog

v0.2.8 (2025-02-27)

Features

• enable multiple importer replicas to coordinate their work (ad6abd0), closes
  #1307

Fixes

• employ a cancel token to abort the long-running git clone (9e73943)
• sbom: validate CDX files during ingestion (805f671), closes #551

0.2.7

Changelog

v0.2.7 (2025-02-25)

Features

• add sbom node checksum entities (0ff50c6)

Fixes

• permission problem with containerized xtask dump (18aa037)

0.2.6

Changelog

v0.2.6 (2025-02-20)

Features

• introduct e2e tests based on hurl (009b7d9)
• add RH processing for SPDX as well (2b09639)
• add RH prod/comp relationships (82c8013)
• make max concurrent importers configurable (6acf514)
• introduce new dataset (ds4) (0a421bf)
• upgrade OTEL to 0.28 (f8ee2af)
• introduct db context in graph and put status cache there (ab602f6)

Fixes

• test_sbom_details_cyclonedx_osv set thread_stack_size (b8dc811)
• years range in ds4 not properly configured (389a7df)
• apply postgres config to compose file (ab5d523)
• use predictable ids for all entities during csaf ingestion (fd74a49)
• refactor version scheme matching logic (a652369)
• make status loading one-time event for csaf importing (329f9ee)
• improve status checking by introducing the global cache (e5b62ad)
• insert affected status for versions up to the fixed ones (a568016)