Skip to content

Releases: aesir-oss/pixi-sbom

Release list

Release v1.15.0

Release v1.15.0 Latest
Latest

Choose a tag to compare

View all tags
@aesir-oss-release-helper aesir-oss-release-helper released this 17 Oct 01:23
v1.15.0
3773708

1.15.0 - 2026-10-17

Features

  • input: Name the PEP 751 pylock.toml route for a plain pyproject.toml (#57) (#61) (b37f1ae)

Bug Fixes

  • cli: Give offline, proxy and no-proxy a line each in --version-details (#58) (#59) (49079d5)

Documentation

  • memory: Record where things stand after the split (#55) (a62d857)
  • without-pixi: Why an SBOM comes from a lock, and what the manifest beside it adds (#56) (#62) (fd62927)

Deps

  • Rustls 0.23.46 for RUSTSEC-2026-0346 to 0349 (#60) (c9c08a3)

Release artifacts

Artifact Platform
pixi-sbom-v1.15.0-linux-64.tar.gz Linux x86_64
pixi-sbom-v1.15.0-linux-aarch64.tar.gz Linux arm64
pixi-sbom-v1.15.0-osx-64.tar.gz macOS Intel
pixi-sbom-v1.15.0-osx-arm64.tar.gz macOS Apple Silicon
pixi-sbom-v1.15.0-win-64.zip Windows x86_64

Each archive has a .sha256 and a signed .sigstore.json provenance bundle beside it.

The same binary is attached as Python wheels (pixi_sbom-*.whl, no Python code) for Linux glibc and musl
x86_64 and aarch64, macOS x86_64 and arm64, and Windows x86_64, published to PyPI (TestPyPI for a release
candidate) as well. Where PyPI is out of reach, install one straight from this release:
pip install https://github.com/aesir-oss/pixi-sbom/releases/download/v1.15.0/<wheel>.

To check an archive was built by this repository's release workflow, from this tag, on a GitHub-hosted runner:

gh attestation verify pixi-sbom-v1.15.0-linux-64.tar.gz --repo aesir-oss/pixi-sbom \
  --signer-workflow aesir-oss/pixi-sbom/.github/workflows/release-artifacts.yml \
  --source-ref refs/tags/v1.15.0 \
  --deny-self-hosted-runners

Add --bundle pixi-sbom-v1.15.0-linux-64.tar.gz.sigstore.json to verify without reaching GitHub.

Full changelog: CHANGELOG.md

Assets 24

Release v1.15.0-rc.1

Release v1.15.0-rc.1 Pre-release
Pre-release

Choose a tag to compare

View all tags
@aesir-oss-release-helper aesir-oss-release-helper released this 17 Oct 00:28
v1.15.0-rc.1
3276eef

1.14.0 - 2026-10-14

Features

  • action: Install every version from aesir-oss/pixi-sbom (#25) (129ab52)

CI and Build

  • release: Create an aesir-oss/pixi-sbom-action release on every final (#24) (6dfa588)

Deps

  • Read YAML with serde-saphyr instead of serde_yaml; MSRV 1.89 (#23) (01263a5)

Release artifacts

Artifact Platform
pixi-sbom-v1.15.0-rc.1-linux-64.tar.gz Linux x86_64
pixi-sbom-v1.15.0-rc.1-linux-aarch64.tar.gz Linux arm64
pixi-sbom-v1.15.0-rc.1-osx-64.tar.gz macOS Intel
pixi-sbom-v1.15.0-rc.1-osx-arm64.tar.gz macOS Apple Silicon
pixi-sbom-v1.15.0-rc.1-win-64.zip Windows x86_64

Each archive has a .sha256 and a signed .sigstore.json provenance bundle beside it.

The same binary is attached as Python wheels (pixi_sbom-*.whl, no Python code) for Linux glibc and musl
x86_64 and aarch64, macOS x86_64 and arm64, and Windows x86_64, published to PyPI (TestPyPI for a release
candidate) as well. Where PyPI is out of reach, install one straight from this release:
pip install https://github.com/aesir-oss/pixi-sbom/releases/download/v1.15.0-rc.1/<wheel>.

To check an archive was built by this repository's release workflow, from this tag, on a GitHub-hosted runner:

gh attestation verify pixi-sbom-v1.15.0-rc.1-linux-64.tar.gz --repo aesir-oss/pixi-sbom \
  --signer-workflow aesir-oss/pixi-sbom/.github/workflows/release-artifacts.yml \
  --source-ref refs/tags/v1.15.0-rc.1 \
  --deny-self-hosted-runners

Add --bundle pixi-sbom-v1.15.0-rc.1-linux-64.tar.gz.sigstore.json to verify without reaching GitHub.

Full changelog: CHANGELOG.md

Loading

Release v1.14.0

Release v1.14.0

Choose a tag to compare

View all tags
@aesir-oss-release-helper aesir-oss-release-helper released this 14 Oct 03:51
v1.14.0
7fa3488

1.14.0 - 2026-10-14

Features

  • action: Install every version from aesir-oss/pixi-sbom (#25) (129ab52)

CI and Build

  • release: Create an aesir-oss/pixi-sbom-action release on every final (#24) (6dfa588)

Deps

  • Read YAML with serde-saphyr instead of serde_yaml; MSRV 1.89 (#23) (01263a5)

Release artifacts

Artifact Platform
pixi-sbom-v1.14.0-linux-64.tar.gz Linux x86_64
pixi-sbom-v1.14.0-linux-aarch64.tar.gz Linux arm64
pixi-sbom-v1.14.0-osx-64.tar.gz macOS Intel
pixi-sbom-v1.14.0-osx-arm64.tar.gz macOS Apple Silicon
pixi-sbom-v1.14.0-win-64.zip Windows x86_64

Each archive has a .sha256 and a signed .sigstore.json provenance bundle beside it.

The same binary is attached as Python wheels (pixi_sbom-*.whl, no Python code) for Linux glibc and musl
x86_64 and aarch64, macOS x86_64 and arm64, and Windows x86_64, published to PyPI (TestPyPI for a release
candidate) as well. Where PyPI is out of reach, install one straight from this release:
pip install https://github.com/aesir-oss/pixi-sbom/releases/download/v1.14.0/<wheel>.

To check an archive was built by this repository's release workflow, from this tag, on a GitHub-hosted runner:

gh attestation verify pixi-sbom-v1.14.0-linux-64.tar.gz --repo aesir-oss/pixi-sbom \
  --signer-workflow aesir-oss/pixi-sbom/.github/workflows/release-artifacts.yml \
  --source-ref refs/tags/v1.14.0 \
  --deny-self-hosted-runners

Add --bundle pixi-sbom-v1.14.0-linux-64.tar.gz.sigstore.json to verify without reaching GitHub.

Full changelog: CHANGELOG.md

Loading

Release v1.14.0-rc.1

Release v1.14.0-rc.1 Pre-release
Pre-release

Choose a tag to compare

View all tags
@aesir-oss-release-helper aesir-oss-release-helper released this 14 Oct 03:31
v1.14.0-rc.1
91d0b81

1.13.2 - 2026-10-14

Refactoring

  • Fold the shared modules back into the crate (532099c)

CI and Build

  • Stand alone as aesir-oss/pixi-sbom (6eb5513)

Deps

  • Name the serde_yaml issue by its number in this repository (#22) (ef1c5a6)

Release artifacts

Artifact Platform
pixi-sbom-v1.14.0-rc.1-linux-64.tar.gz Linux x86_64
pixi-sbom-v1.14.0-rc.1-linux-aarch64.tar.gz Linux arm64
pixi-sbom-v1.14.0-rc.1-osx-64.tar.gz macOS Intel
pixi-sbom-v1.14.0-rc.1-osx-arm64.tar.gz macOS Apple Silicon
pixi-sbom-v1.14.0-rc.1-win-64.zip Windows x86_64

Each archive has a .sha256 and a signed .sigstore.json provenance bundle beside it.

The same binary is attached as Python wheels (pixi_sbom-*.whl, no Python code) for Linux glibc and musl
x86_64 and aarch64, macOS x86_64 and arm64, and Windows x86_64, published to PyPI (TestPyPI for a release
candidate) as well. Where PyPI is out of reach, install one straight from this release:
pip install https://github.com/aesir-oss/pixi-sbom/releases/download/v1.14.0-rc.1/<wheel>.

To check an archive was built by this repository's release workflow, from this tag, on a GitHub-hosted runner:

gh attestation verify pixi-sbom-v1.14.0-rc.1-linux-64.tar.gz --repo aesir-oss/pixi-sbom \
  --signer-workflow aesir-oss/pixi-sbom/.github/workflows/release-artifacts.yml \
  --source-ref refs/tags/v1.14.0-rc.1 \
  --deny-self-hosted-runners

Add --bundle pixi-sbom-v1.14.0-rc.1-linux-64.tar.gz.sigstore.json to verify without reaching GitHub.

Full changelog: CHANGELOG.md

Loading

Release v1.13.2

Release v1.13.2

Choose a tag to compare

View all tags
@aesir-oss-release-helper aesir-oss-release-helper released this 14 Oct 00:15
v1.13.2
cd844bb

1.13.2 - 2026-10-14

Refactoring

  • Fold the shared modules back into the crate (532099c)

CI and Build

  • Stand alone as aesir-oss/pixi-sbom (6eb5513)

Deps

  • Name the serde_yaml issue by its number in this repository (#22) (ef1c5a6)

Release artifacts

Artifact Platform
pixi-sbom-v1.13.2-linux-64.tar.gz Linux x86_64
pixi-sbom-v1.13.2-linux-aarch64.tar.gz Linux arm64
pixi-sbom-v1.13.2-osx-64.tar.gz macOS Intel
pixi-sbom-v1.13.2-osx-arm64.tar.gz macOS Apple Silicon
pixi-sbom-v1.13.2-win-64.zip Windows x86_64

Each archive has a .sha256 and a signed .sigstore.json provenance bundle beside it.

The same binary is attached as Python wheels (pixi_sbom-*.whl, no Python code) for Linux glibc and musl
x86_64 and aarch64, macOS x86_64 and arm64, and Windows x86_64, published to PyPI (TestPyPI for a release
candidate) as well. Where PyPI is out of reach, install one straight from this release:
pip install https://github.com/aesir-oss/pixi-sbom/releases/download/v1.13.2/<wheel>.

To check an archive was built by this repository's release workflow, from this tag, on a GitHub-hosted runner:

gh attestation verify pixi-sbom-v1.13.2-linux-64.tar.gz --repo aesir-oss/pixi-sbom \
  --signer-workflow aesir-oss/pixi-sbom/.github/workflows/release-artifacts.yml \
  --source-ref refs/tags/v1.13.2 \
  --deny-self-hosted-runners

Add --bundle pixi-sbom-v1.13.2-linux-64.tar.gz.sigstore.json to verify without reaching GitHub.

Full changelog: CHANGELOG.md

Loading

Release v1.13.2-rc.1

Release v1.13.2-rc.1 Pre-release
Pre-release

Choose a tag to compare

View all tags
@aesir-oss-release-helper aesir-oss-release-helper released this 12 Oct 23:18
v1.13.2-rc.1
1e525a5

1.13.1 - 2026-10-12

Features

  • common: Create the shared crate with license normalization and terminal output (#56) (#102) (5e965b4)
  • common: One license verdict for pixi-sbom's gate and pixi-policy's rule (#59) (#103) (bf8fba8)
  • policy: Scaffold pixi-policy with the check command and the policy file (#60) (#110) (ce813ff)
  • policy: Text, JSON and SARIF output (#67) (#111) (8b20429)
  • policy: Bans rule, packages and versions that are never allowed (#62) (#113) (19c3db1)
  • policy: Licenses rules, allow, review and deny lists of SPDX licenses (#63) (#114) (533c026)
  • docs: One docs site with a section per extension (#6) (#126) (50d0be6)
  • policy: The policy key reference, in explain and the docs (#70) (#129) (25df26a)

Bug Fixes

  • release: Create the repository release with the release App's token (#95) (4295770)
  • release: A release candidate's notes list its own changes (#88) (#101) (7288d66)
  • ci: Allow the path-only dependency on the shared crate in cargo-deny (#108) (8721705)
  • ci: Build and smoke-test each extension's binary in its own matrix job (#118) (bcead7d)
  • deps: Let cargo-deny pass the unmaintained unsafe-libyaml advisory, tracked in #127 (#128) (44b9e75)

Refactoring

  • common: The lockfile facts model, separated from the SBOM model (#58) (#105) (3566293)

Documentation

  • claude: Record 1.13.0, the pixi-policy plan and the CI work in the roadmap (#97) (1457b39)
  • claude: Merge only when every check passed, and run cargo-deny locally for dependency changes (#109) (b9cd0d4)
  • whats-new: What 1.13.1 means: the docs' new home, and nothing else changing (#130) (746e6fe)

CI and Build

  • Cache Rust builds, and build the benchmarks and action binary in debug (#89) (#94) (e839216)
  • Run PR jobs only for the paths they cover, behind one CI result check (#90) (#96) (b9b29e1)
  • Release builds on main only, Performance on release candidates and weekly (#91) (#98) (38af913)
  • release: Rely on main's green CI instead of re-running the gate (#92) (#99) (b4c02dd)
  • release: Compile each platform once for its archive and wheel (#93) (#100) (02e202e)
  • release: Release the shared crate before the extensions that need it (#57) (#104) (4d1c30c)
  • release: Stop publishing to crates.io, and name the shared crate pixi-ext-common (#106) (#107) (71d339e)
  • release: Release pixi-policy through the shared release workflows (#69) (#120) (349fccc)

Release artifacts

Artifact Platform
pixi-sbom-v1.13.2-rc.1-linux-64.tar.gz Linux x86_64
pixi-sbom-v1.13.2-rc.1-linux-aarch64.tar.gz Linux arm64
pixi-sbom-v1.13.2-rc.1-osx-64.tar.gz macOS Intel
pixi-sbom-v1.13.2-rc.1-osx-arm64.tar.gz macOS Apple Silicon
pixi-sbom-v1.13.2-rc.1-win-64.zip Windows x86_64

Each archive has a .sha256 and a signed .sigstore.json provenance bundle beside it.

The same binary is attached as Python wheels (pixi_sbom-*.whl, no Python code) for Linux glibc and musl
x86_64 and aarch64, macOS x86_64 and arm64, and Windows x86_64, published to PyPI (TestPyPI for a release
candidate) as well. Where PyPI is out of reach, install one straight from this release:
pip install https://github.com/aesir-oss/pixi-sbom/releases/download/v1.13.2-rc.1/<wheel>.

To check an archive was built by this repository's release workflow, from this tag, on a GitHub-hosted runner:

gh attestation verify pixi-sbom-v1.13.2-rc.1-linux-64.tar.gz --repo aesir-oss/pixi-sbom \
  --signer-workflow aesir-oss/pixi-sbom/.github/workflows/release-artifacts.yml \
  --source-ref refs/tags/v1.13.2-rc.1 \
  --deny-self-hosted-runners

Add --bundle pixi-sbom-v1.13.2-rc.1-linux-64.tar.gz.sigstore.json to verify without reaching GitHub.

Full changelog: CHANGELOG.md

Loading

Release v1.13.1

Release v1.13.1

Choose a tag to compare

View all tags
@millsks millsks released this 14 Oct 03:05
v1.13.1
69dee72

1.13.1 - 2026-10-12

Features

  • common: Create the shared crate with license normalization and terminal output (#56) (#102) (56cc692)
  • common: One license verdict for pixi-sbom's gate and pixi-policy's rule (#59) (#103) (d127c88)
  • policy: Licenses rules, allow, review and deny lists of SPDX licenses (#63) (#114) (0ff1eb6)
  • docs: One docs site with a section per extension (#6) (#126) (b57f9a4)

Bug Fixes

  • release: A release candidate's notes list its own changes (#88) (#101) (d5f7ff6)

Refactoring

  • common: The lockfile facts model, separated from the SBOM model (#58) (#105) (45051ee)

Documentation

  • whats-new: What 1.13.1 means: the docs' new home, and nothing else changing (#130) (b90f946)

CI and Build

  • Cache Rust builds, and build the benchmarks and action binary in debug (#89) (#94) (b60d915)
  • Run PR jobs only for the paths they cover, behind one CI result check (#90) (#96) (552d3b7)
  • Release builds on main only, Performance on release candidates and weekly (#91) (#98) (54866b0)
  • release: Rely on main's green CI instead of re-running the gate (#92) (#99) (57b5c37)
  • release: Compile each platform once for its archive and wheel (#93) (#100) (452d190)
  • release: Release the shared crate before the extensions that need it (#57) (#104) (010e41c)
  • release: Stop publishing to crates.io, and name the shared crate pixi-ext-common (#106) (#107) (b609721)
  • release: Release pixi-policy through the shared release workflows (#69) (#120) (070ffbe)

Release artifacts

Artifact Platform
pixi-sbom-v1.13.1-linux-64.tar.gz Linux x86_64
pixi-sbom-v1.13.1-linux-aarch64.tar.gz Linux arm64
pixi-sbom-v1.13.1-osx-64.tar.gz macOS Intel
pixi-sbom-v1.13.1-osx-arm64.tar.gz macOS Apple Silicon
pixi-sbom-v1.13.1-win-64.zip Windows x86_64

Each archive has a .sha256 and a signed .sigstore.json provenance bundle beside it.

The same binary is attached as Python wheels (pixi_sbom-*.whl, no Python code) for Linux glibc and musl
x86_64 and aarch64, macOS x86_64 and arm64, and Windows x86_64, published to PyPI (TestPyPI for a release
candidate) as well. Where PyPI is out of reach, install one straight from this release:
pip install https://github.com/aesir-oss/pixi-ext-contrib/releases/download/pixi-sbom-v1.13.1/<wheel>.

To check an archive was built by this repository's release workflow, from this tag, on a GitHub-hosted runner:

gh attestation verify pixi-sbom-v1.13.1-linux-64.tar.gz --repo aesir-oss/pixi-ext-contrib \
  --signer-workflow aesir-oss/pixi-ext-contrib/.github/workflows/release-artifacts.yml \
  --source-ref refs/tags/pixi-sbom-v1.13.1 \
  --deny-self-hosted-runners

Add --bundle pixi-sbom-v1.13.1-linux-64.tar.gz.sigstore.json to verify without reaching GitHub.

Full changelog: CHANGELOG.md

First published 2026-10-12 at https://github.com/aesir-oss/pixi-ext-contrib/releases/tag/pixi-sbom-v1.13.1; copied here when pixi-sbom moved to aesir-oss/pixi-sbom.

Loading

Release v1.13.1-rc.1

Release v1.13.1-rc.1 Pre-release
Pre-release

Choose a tag to compare

View all tags
@millsks millsks released this 14 Oct 03:05
v1.13.1-rc.1
245a816

1.13.1-rc.1 - 2026-10-12

Features

  • common: Create the shared crate with license normalization and terminal output (#56) (#102) (56cc692)
  • common: One license verdict for pixi-sbom's gate and pixi-policy's rule (#59) (#103) (d127c88)
  • policy: Licenses rules, allow, review and deny lists of SPDX licenses (#63) (#114) (0ff1eb6)
  • docs: One docs site with a section per extension (#6) (#126) (b57f9a4)

Bug Fixes

  • release: A release candidate's notes list its own changes (#88) (#101) (d5f7ff6)

Refactoring

  • common: The lockfile facts model, separated from the SBOM model (#58) (#105) (45051ee)

Documentation

  • whats-new: What 1.13.1 means: the docs' new home, and nothing else changing (#130) (b90f946)

CI and Build

  • Cache Rust builds, and build the benchmarks and action binary in debug (#89) (#94) (b60d915)
  • Run PR jobs only for the paths they cover, behind one CI result check (#90) (#96) (552d3b7)
  • Release builds on main only, Performance on release candidates and weekly (#91) (#98) (54866b0)
  • release: Rely on main's green CI instead of re-running the gate (#92) (#99) (57b5c37)
  • release: Compile each platform once for its archive and wheel (#93) (#100) (452d190)
  • release: Release the shared crate before the extensions that need it (#57) (#104) (010e41c)
  • release: Stop publishing to crates.io, and name the shared crate pixi-ext-common (#106) (#107) (b609721)
  • release: Release pixi-policy through the shared release workflows (#69) (#120) (070ffbe)

Release artifacts

Artifact Platform
pixi-sbom-v1.13.1-rc.1-linux-64.tar.gz Linux x86_64
pixi-sbom-v1.13.1-rc.1-linux-aarch64.tar.gz Linux arm64
pixi-sbom-v1.13.1-rc.1-osx-64.tar.gz macOS Intel
pixi-sbom-v1.13.1-rc.1-osx-arm64.tar.gz macOS Apple Silicon
pixi-sbom-v1.13.1-rc.1-win-64.zip Windows x86_64

Each archive has a .sha256 and a signed .sigstore.json provenance bundle beside it.

The same binary is attached as Python wheels (pixi_sbom-*.whl, no Python code) for Linux glibc and musl
x86_64 and aarch64, macOS x86_64 and arm64, and Windows x86_64, published to PyPI (TestPyPI for a release
candidate) as well. Where PyPI is out of reach, install one straight from this release:
pip install https://github.com/aesir-oss/pixi-ext-contrib/releases/download/pixi-sbom-v1.13.1-rc.1/<wheel>.

To check an archive was built by this repository's release workflow, from this tag, on a GitHub-hosted runner:

gh attestation verify pixi-sbom-v1.13.1-rc.1-linux-64.tar.gz --repo aesir-oss/pixi-ext-contrib \
  --signer-workflow aesir-oss/pixi-ext-contrib/.github/workflows/release-artifacts.yml \
  --source-ref refs/tags/pixi-sbom-v1.13.1-rc.1 \
  --deny-self-hosted-runners

Add --bundle pixi-sbom-v1.13.1-rc.1-linux-64.tar.gz.sigstore.json to verify without reaching GitHub.

Full changelog: CHANGELOG.md

First published 2026-10-12 at https://github.com/aesir-oss/pixi-ext-contrib/releases/tag/pixi-sbom-v1.13.1-rc.1; copied here when pixi-sbom moved to aesir-oss/pixi-sbom.

Loading

Release v1.13.0

Release v1.13.0

Choose a tag to compare

View all tags
@millsks millsks released this 14 Oct 03:04
v1.13.0
8898b72

1.13.0 - 2026-10-11

Features

  • scan: Find installed environments in an unpacked container filesystem (#25) (#55) (512ef25)
  • lock: Read a JavaScript project's node_modules when it has no lockfile (#36) (#87) (2151eba)

Documentation

  • development: Name the shared crate aesir-pixi-ext-contrib-common and publish it (#54) (5f76db7)
  • examples: Two unpacked container images to scan (#31) (#86) (6970726)

CI and Build

  • release: A changelog per extension, filtered by the paths it is built from (#51) (#52) (a37aa49)
  • release: A pixi-ext-contrib release after each extension release, the only one marked Latest (#49) (#53) (dd437bb)

Release artifacts

Artifact Platform
pixi-sbom-v1.13.0-linux-64.tar.gz Linux x86_64
pixi-sbom-v1.13.0-linux-aarch64.tar.gz Linux arm64
pixi-sbom-v1.13.0-osx-64.tar.gz macOS Intel
pixi-sbom-v1.13.0-osx-arm64.tar.gz macOS Apple Silicon
pixi-sbom-v1.13.0-win-64.zip Windows x86_64

Each archive has a .sha256 and a signed .sigstore.json provenance bundle beside it.

The same binary is attached as Python wheels (pixi_sbom-*.whl, no Python code) for Linux glibc and musl
x86_64 and aarch64, macOS x86_64 and arm64, and Windows x86_64, published to PyPI (TestPyPI for a release
candidate) as well. Where PyPI is out of reach, install one straight from this release:
pip install https://github.com/aesir-oss/pixi-ext-contrib/releases/download/pixi-sbom-v1.13.0/<wheel>.

To check an archive was built by this repository's release workflow, from this tag, on a GitHub-hosted runner:

gh attestation verify pixi-sbom-v1.13.0-linux-64.tar.gz --repo aesir-oss/pixi-ext-contrib \
  --signer-workflow aesir-oss/pixi-ext-contrib/.github/workflows/release-artifacts.yml \
  --source-ref refs/tags/pixi-sbom-v1.13.0 \
  --deny-self-hosted-runners

Add --bundle pixi-sbom-v1.13.0-linux-64.tar.gz.sigstore.json to verify without reaching GitHub.

Full changelog: CHANGELOG.md

First published 2026-10-11 at https://github.com/aesir-oss/pixi-ext-contrib/releases/tag/pixi-sbom-v1.13.0; copied here when pixi-sbom moved to aesir-oss/pixi-sbom.

Loading

Release v1.13.0-rc.1

Release v1.13.0-rc.1 Pre-release
Pre-release

Choose a tag to compare

View all tags
@millsks millsks released this 14 Oct 03:04
v1.13.0-rc.1
05adf9d

1.12.0 - 2026-10-11

Features

  • Derive deterministic document ids and honor SOURCE_DATE_EPOCH (cc72a3e)
  • Write the SBOM to stdout with --output - (fc1c83f)
  • Add --all-platforms, symmetric with --all-environments (9dcd06e)
  • Cover CISA 2026 minimum elements (07c8c5a)
  • Link PyPI packages to the conda python package (fac06fd)
  • Enrich conda packages with PyPI purls so scanners can match them (85ffd58)
  • Look up PyPI licenses from the index with --pypi-licenses (2a0f0de)
  • Write CycloneDX 1.7 with --spec-version (8b13136)
  • Add --fetch-licenses with conda details from the package cache (23a8667)
  • Add --report to print package and license tables to the terminal (8d74219)
  • Read conda license details from channel archives by HTTP range (77a8597)
  • Read PyPI license details from wheels by HTTP range (96099b0)
  • Add a license policy gate with --allow-license, --deny-license and --require-license (1b0cf29)
  • Add a GitHub Action that runs the release binary (012e98c)
  • Write SPDX 3.0.1 JSON-LD with --format spdx --spec-version 3.0 (2bcfdf4)
  • Attach PEP 770 embedded SBOMs from wheels with --embedded-sboms (9ac664b)
  • Say why a license is not an SPDX expression (0280c50)
  • Read small .tar.bz2 archives whole for license details (29a13a7)
  • Scaffold the MkDocs documentation site (ce1a365)
  • Publish the documentation site to GitHub Pages on every release (68142af)
  • Link the documentation site and make the action Marketplace-ready (12c0df4)
  • Version the documentation site per release with mike (094dbfc)
  • Version the docs per release tag with a dev build from main (6f627aa)
  • Look up known vulnerabilities on OSV with --vulnerabilities osv (8c08627)
  • Add --report vulnerabilities in table, markdown, csv and json (9c2f910)
  • Gate on vulnerabilities with --fail-on-severity and accept them with --ignore-vuln (a4c4aab)
  • Flag findings in CISA's Known Exploited Vulnerabilities catalog with --kev (175b38d)
  • Write vulnerabilities as SARIF and expose the vulnerability flags in the action (0262b24)
  • Leave packages out with --exclude, --include and --exclude-kind (9a5cd54)
  • Read settings from pixi-sbom.toml or [tool.pixi-sbom] before the command line (381a4ec)
  • Report what changed since a previous document with --report diff --against (d81c832)
  • Describe an installed environment without a lockfile with --prefix (4336163)
  • Sign the documents with a GitHub artifact attestation from the action (370adbe)
  • Support cargo binstall and publish the crate from the release workflow (900391a)
  • Render report tables with comfy-table and colour them with --color (753b37d)
  • Show progress bars while the enrichment fetches run (e0b4311)
  • Flag yanked PyPI releases and gate on them with --fail-on-yanked (cd1f60f)
  • Report how far behind its index each package is (3b1890f)
  • Report which packages cap the interpreter with --report python (#135) (e46854c)
  • Mark the dependencies the workspace declared itself (#136) (a4da5b6)
  • Name phantom, undeclared and unused dependencies with --report phantom (#137) (a358b9d)
  • Gate a run on what changed with --fail-on-diff (#138) (28a00f9)
  • Compare an installed environment with its lockfile (#139) (8492623)
  • Describe every workspace in a tree with --scan (#140) (f9cd174)
  • Read an existing document with --from-sbom (#141) (2d47b0f)
  • Exempt a package from the license policy with --ignore-license (#142) (d98e1b2)
  • Write the assessments as a standalone VEX with --vex (#143) (8a019c7)
  • Draw the dependency tree and group the licenses view (#144) (6a428f3)
  • Read the cargo auditable crate list out of installed binaries (#145) (569c6de)
  • Record the OpenSSF Scorecard of each package with --scorecard (#146) (81c7242)
  • Log every request and the whole error chain behind a failure (#164) (a6c3f31)
  • Say which input and which settings a run chose (#167) (9764b1b)
  • Say what a run will talk to before it talks to anything (#168) (cd0a6c2)
  • Say where every fact about a package...
Read more
Loading