v1.50.0

Added Features

• Add bun binary classifier [PR #5103 @rezmoss]

Bug Fixes

• Fix Cargo PURLs for local workspace packages [PR #5105 @3nesdeniz]
• Decode golang symbols [PR #5089 @wagoodman]
• CPE vendor field incorrectly includes publisher URL for SUSE RPM packages [Issue #5073] [PR #5081 @Eljees]
• apk-db-cataloger silently drops the entire APK catalog when one installed-DB field exceeds 64 KB [Issue #5094] [PR #5100 @cyphercodes]

Additional Changes

• package-lock.json v1: nested dependencies entries are never cataloged (flat top-level iteration only) [Issue #5101] [PR #5108 @Eljees]
• consider vendored golang packages in module attribution [PR #5093 @kzantow]
• Fix inverted bounds check dropping every Erlang string with a backslash [PR #5110 @arpitjain099]

Dependencies

14 dependency changes (14 updated). 1 vulnerability remediated.

🟢 Remediated (1)

• GHSA-hrxh-6v49-42gf (High) — google.golang.org/grpc

Updated (14 packages)

• github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 → v1.32.0
• github.com/cncf/xds/go v0.0.0-ee656c7 → v0.0.0-dba9d58
• github.com/envoyproxy/go-control-plane/envoy v1.36.0 → v1.37.0
• github.com/envoyproxy/protoc-gen-validate v1.3.0 → v1.3.3
• github.com/gpustack/gguf-parser-go v0.24.1 → v0.25.0
• go.opentelemetry.io/contrib/detectors/gcp v1.39.0 → v1.43.0
• google.golang.org/genproto/googleapis/api v0.0.0-9d38bb4 → v0.0.0-afd174a
• google.golang.org/genproto/googleapis/rpc v0.0.0-6f92a3b → v0.0.0-afd174a
• google.golang.org/grpc v1.80.0 → v1.82.1 (🟢 remediated GHSA-hrxh-6v49-42gf)
• modernc.org/cc/v4 v4.28.4 → v4.29.0
• modernc.org/ccgo/v4 v4.34.4 → v4.34.6
• modernc.org/gc/v3 v3.1.3 → v3.1.4
• modernc.org/libc v1.73.4 → v1.74.1
• modernc.org/sqlite v1.53.0 → v1.54.0

(Full Changelog)