Skip to content

PatchFlow CLI v0.1.4

Choose a tag to compare

View all tags
@malik111110 malik111110 released this 04 Jul 02:54
v0.1.4
8ad1c2f

What's New

Embedded OCI Image Scanner

  • No external Trivy dependency — the image scanner is now embedded directly in the CLI as internal/imagescan/
  • Native Go, OCI-first scanner with vulnerability matching (NVD, OSV, Alpine, Debian, Ubuntu)
  • New flags: --input, --platform, --no-vulns, --severities, --format, --output
  • Image reference validation with security checks

License Detection Overhaul

Comprehensive improvements to license gathering across all ecosystems:

Metric Before After Improvement
Coverage 78.2% 89.6% +11.4pp
Unknown licenses 733 353 51.8% reduction
License findings 736 363 50.7% reduction

Benchmarked across 10 real-world projects with 3,270+ dependencies.

Go

  • golang.org/x/* modules: GitHub mirror mapping + BSD-3-Clause fallback
  • gopkg.in/* modules: 40+ repo mappings (yaml.v3, check.v1, ini.v1, etc.)
  • google.golang.org/* modules: protobuf, grpc, genproto, api, appengine
  • Go module proxy fallback for non-GitHub modules (VCS URL extraction)

Java/Maven

  • POM file parsing from Maven Central with <licenses> extraction
  • SCM URL extraction from POM to GitHub license lookup
  • Version resolution via search API (3 query formats) for "unknown" versions
  • 130+ groupId to GitHub repo mappings (Apache, Spring, Hibernate, JBoss, Google, Square, etc.)

npm

  • Repository URL extraction from npm registry metadata (string + object formats)
  • Full package metadata fallback for repo URL when version-specific response lacks it
  • Homepage URL fallback for GitHub repo discovery

Python

  • PyPI classifier-based fallback (40+ classifier to SPDX mappings)
  • Empty version handling (uses no-version endpoint)
  • pyproject.toml extras parsing fixed (test = ["pytest"] no longer creates bogus dependency)
  • pyproject.toml inline table license parsing (license = {file = "..."})

Ruby

  • Gemfile parser fixed for commas and quotes in package entries
  • Version constraint cleanup (~>, >=, etc. stripped before lookup)
  • source_code_uri, homepage_uri, repository_uri fallback for GitHub license

SPDX Classification

  • Mapping tables expanded from ~25 to 300+ entries
  • AFL licenses (1.1, 1.2, 2.0, 2.1, 3.0) added to permissive
  • Short GPL forms (GPL-2, GPL-3, GPLV2, GPLV3) added to copyleft
  • "Other"/"UNKNOWN"/"NOASSERTION" treated as uninformative, triggers GitHub fallback
  • Weak copyleft (LGPL) checked before strong copyleft (GPL) to fix substring misclassification

Installation

# Homebrew
brew install patchflow-security/tap/patchflow

# Scoop (Windows)
scoop install patchflow

# Direct download
curl -fsSL https://raw.githubusercontent.com/Patchflow-security/patchflow-cli/main/scripts/install.sh | bash

Verify

patchflow version --json

Full Changelog: v0.1.3...v0.1.4

Assets 17
Loading