v3.0.0

Installation

Cargo

cargo install uv-sbom

Python (PyPI)

pip install uv-sbom-bin

Pre-built Binaries

macOS (Apple Silicon):

curl -LO https://github.com/Taketo-Yoda/uv-sbom/releases/download/v3.0.0/uv-sbom-aarch64-apple-darwin.tar.gz
tar xzf uv-sbom-aarch64-apple-darwin.tar.gz
sudo mv uv-sbom /usr/local/bin/

macOS (Intel):

curl -LO https://github.com/Taketo-Yoda/uv-sbom/releases/download/v3.0.0/uv-sbom-x86_64-apple-darwin.tar.gz
tar xzf uv-sbom-x86_64-apple-darwin.tar.gz
sudo mv uv-sbom /usr/local/bin/

Linux (x86_64):

curl -LO https://github.com/Taketo-Yoda/uv-sbom/releases/download/v3.0.0/uv-sbom-x86_64-unknown-linux-gnu.tar.gz
tar xzf uv-sbom-x86_64-unknown-linux-gnu.tar.gz
sudo mv uv-sbom /usr/local/bin/

Windows:
Download the .zip file below and extract to your desired location.

Verify Installation

uv-sbom --version

See the README for full documentation.

What's Changed

• refactor(domain): move PEP 440 compatibility logic out of ports by @Taketo-Yoda in #729
• refactor(cli): extract per-field resolver functions from merge_config by @Taketo-Yoda in #730
• refactor(adapters): split osv_client.rs into mod/dto/cvss submodules by @Taketo-Yoda in #731
• chore(deps): bump the dependencies group with 4 updates by @dependabot[bot] in #732
• refactor(domain,application): make UpgradeAdvisor synchronous, move simulation loop to application layer by @Taketo-Yoda in #733
• refactor(application): add SeverityView::emoji() to remove duplicated severity-emoji mapping by @Taketo-Yoda in #734
• refactor(adapters): consolidate duplicated uv.lock TOML schema structs by @Taketo-Yoda in #747
• refactor(adapters): extract source_classifier.rs (PackageSource::to_kind/is_local) by @Taketo-Yoda in #748
• refactor(adapters): extract graph.rs (collect_all_deps, bfs_reachable) by @Taketo-Yoda in #749
• refactor(adapters): extract group_roots.rs (manifest_groups_v2/package_dev_dependencies_v3) by @Taketo-Yoda in #750
• chore(deps): bump uuid from 1.24.0 to 1.24.1 in the dependencies group by @dependabot[bot] in #751
• refactor(adapters): extract member_scope.rs from lockfile_parser by @Taketo-Yoda in #752
• refactor(ports): move PackageSourceKind unit tests to their defining file by @Taketo-Yoda in #754
• refactor(application): move shared generate_sbom test fixtures into mod.rs by @Taketo-Yoda in #761
• refactor(application): move filtering.rs tests out of tests.rs by @Taketo-Yoda in #762
• refactor(application): move checks.rs tests out of tests.rs by @Taketo-Yoda in #763
• refactor(application): move response.rs tests out of tests.rs by @Taketo-Yoda in #764
• refactor(application): move upgrade.rs tests out of tests.rs by @Taketo-Yoda in #765
• refactor(application): delete generate_sbom/tests.rs, verify mod declarations by @Taketo-Yoda in #766
• feat(cli): add --explain CLI flag and SbomRequest field by @Taketo-Yoda in #771
• feat(application): add ExplainView read model and wire into GenerateSbomUseCase by @Taketo-Yoda in #772
• feat(adapters): render Dependency Explanation section in Markdown output by @Taketo-Yoda in #773
• docs: document --explain flag with real captured output by @Taketo-Yoda in #774
• chore(deps): bump the dependencies group with 2 updates by @dependabot[bot] in #776
• chore(deps): bump softprops/action-gh-release from 3.0.2 to 3.0.3 by @dependabot[bot] in #775
• feat(cli)!: remove deprecated --check-cve flag by @Taketo-Yoda in #777
• chore(release): prepare v3.0.0 by @Taketo-Yoda in #778
• chore(release): v3.0.0 by @Taketo-Yoda in #779

Full Changelog: v2.8.1...v3.0.0