Features
- feat: add Rust crates support (#827) by @sidsri14
- Flag npm packages when provenance attestations disappear (#819) by @ChatchawanIllyes
- Exclude npm devDependencies by default in verify (#688) by @gyubin02
Bug fixes
- fix: false positive in fromCharCode obfuscation heuristic (#809) by @danraveh-ai
- fix: npm metadata checks for @types package roots (#833) by @homanp
- Run Yara rules in deterministic order to avoid non-deterministic scan output (#836) by @christophetd
- fix: run sandboxed archive scans from the temporary directory (#835) by @pasmud
- Reject crafted ZIPs that scan empty but unpack code (#790) by @dvlinuxx-max
- fix(deps): vuln pytest (patch → 7.4.4) (#801) by @gh-worker-campaigns-3e9aa4[bot]
- fix(deps): vuln major: packaging, pytest (#821) by @gh-worker-campaigns-3e9aa4[bot]
Chores
- Add SCFW GitHub Action into v3 workflows (#807) by @ikretz
- Bump disposable-email-domains from 0.0.214 to 0.0.225 (#825) by @dependabot[bot]
- Bump coverage from 7.15.0 to 7.15.2 (#826) by @dependabot[bot]
- Bump nono-py from 0.11.0 to 0.14.0 (#824) by @dependabot[bot]
- Bump mypy from 2.1.0 to 2.3.0 (#823) by @dependabot[bot]
- Bump boto3 from 1.43.36 to 1.43.53 (#822) by @dependabot[bot]
- Bump disposable-email-domains from 0.0.225 to 0.0.231 (#830) by @dependabot[bot]
- Bump boto3 from 1.43.36 to 1.43.56 (#829) by @dependabot[bot]
- Bump boto3 from 1.43.56 to 1.43.62 (#840) by @dependabot[bot]
- Bump disposable-email-domains from 0.0.231 to 0.0.237 (#839) by @dependabot[bot]
- Bump nono-py from 0.14.0 to 0.15.0 (#845) by @dependabot[bot]
- Bump boto3 from 1.43.62 to 1.43.67 (#844) by @dependabot[bot]
- Bump coverage from 7.15.2 to 7.15.4 (#843) by @dependabot[bot]
- Bump packaging from 26.2 to 26.3 (#842) by @dependabot[bot]
- test(npm): cover scoped package metadata scans (#849) by @SkxOverKill
- bump to 3.2.0 (#851) by @christophetd
Contributors
christophetd, homanp, and 10 other contributors