v1.11.0

Changelog

Features

• bed74cb: feat: add -license-confidence-threshold CLI flag (#755) (@dkr91)
• d7039a8: feat: harden gha workflows with zizmor (@nscuro)
• 1ac4e2d: feat: support cyclonedx 1.7 output (@nscuro)

Fixes

• 8820fcb: fix: disable cosign new bundle format (@nscuro)
• c6a4c56: fix: incorrect actions tag annotation (@nscuro)
• 9cb8ae4: fix: linter issues (@nscuro)
• 8c1b71f: fix: preserve resolved local replacement directory (#748) (@Eljees)
• 7fe274f: fix: skip hashes for modules without a directory (#747) (@Eljees)
• 489c363: fix: switch to stdlib slices package (@nscuro)
• 85929bf: fix: update test snapshots (@nscuro)

Building and Packaging

• 59ca4b6: build(deps): bump actions/checkout from 5.0.0 to 6.0.2 (@dependabot[bot])
• b506e33: build(deps): bump actions/setup-go from 6.0.0 to 6.2.0 (@dependabot[bot])
• 06ebcd2: build(deps): bump actions/setup-go from 6.2.0 to 7.0.0 (@dependabot[bot])
• 796b471: build(deps): bump apache/skywalking-eyes from 0.7.0 to 0.8.0 (@dependabot[bot])
• ef8c854: build(deps): bump aquasecurity/trivy-action from 0.35.0 to 0.36.0 (@dependabot[bot])
• 3e16074: build(deps): bump docker/login-action from 3.5.0 to 3.7.0 (@dependabot[bot])
• 0c199c6: build(deps): bump docker/login-action from 3.7.0 to 4.0.0 (@dependabot[bot])
• 0913ba2: build(deps): bump docker/login-action from 4.0.0 to 4.6.0 (@dependabot[bot])
• 54d7d46: build(deps): bump docker/setup-qemu-action from 3.6.0 to 4.0.0 (@dependabot[bot])
• 7e79bca: build(deps): bump docker/setup-qemu-action from 4.0.0 to 4.2.0 (@dependabot[bot])
• 84fa414: build(deps): bump github.com/CycloneDX/cyclonedx-go (@dependabot[bot])
• 0989a68: build(deps): bump github.com/CycloneDX/cyclonedx-go from 0.9.3 to 0.10.0 (@dependabot[bot])
• 7ed78cb: build(deps): bump github.com/go-git/go-git/v5 from 5.16.2 to 5.16.4 (@dependabot[bot])
• c2e4e1d: build(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to 5.19.2 (@dependabot[bot])
• f7639a5: build(deps): bump github.com/package-url/packageurl-go (@dependabot[bot])
• de1c664: build(deps): bump github.com/rs/zerolog from 1.34.0 to 1.35.1 (@dependabot[bot])
• 355b682: build(deps): bump github/codeql-action from 3.30.0 to 4.32.0 (@dependabot[bot])
• 7329a34: build(deps): bump github/codeql-action from 4.32.0 to 4.34.1 (@dependabot[bot])
• 72968ec: build(deps): bump golang from 1.25.6-alpine3.23 to 1.26.2-alpine3.23 (@dependabot[bot])
• 644a766: build(deps): bump golang.org/x/crypto from 0.47.0 to 0.52.0 (@dependabot[bot])
• 5dac7d1: build(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 (@dependabot[bot])
• c1f0dd6: build(deps): bump golang.org/x/mod from 0.31.0 to 0.32.0 (@dependabot[bot])
• 1f8aea5: build(deps): bump golang.org/x/mod from 0.37.0 to 0.39.0 (@dependabot[bot])
• c68ea7b: build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.3.0 (@dependabot[bot])
• 3a149fb: build(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.2.3 (@dependabot[bot])
• 76b1764: build(deps): bump sigstore/cosign-installer from 3.10.1 to 4.1.2 (@dependabot[bot])
• 3f318d7: build(deps): bump sigstore/cosign-installer from 3.9.2 to 4.1.0 (@dependabot[bot])
• 0c2b745: build(deps): bump the codeql group with 3 updates (@dependabot[bot])
• fa59ccf: build(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 (@dependabot[bot])

Others

• 4baa8b0: chore: bump go to 1.26 (@nscuro)
• d8d7a39: chore: bump trivy-action to v0.35.0 (@nscuro)
• b0f7bb1: chore: modernize goreleaser setup (@nscuro)