Skip to content

v1.1.0

Choose a tag to compare

View all tags
@tstromberg tstromberg released this 25 Aug 21:32
· 46 commits to main since this release
v1.1.0
b007767

Features

  • Added artifact-matrix resolution for npm, PyPI, RubyGems, Go modules, and Cargo crates.

  • Added strict ECMA-427 PURL canonicalization and identity normalization.

  • Expanded source reference extraction, including escaped imports and package-manager
    commands.

  • Improved OCI image flattening and layer metadata handling.

Bugfixes

  • Hardened registry fetching against SSRF, malformed coordinates, and unsafe URL
    interpolation.

  • Added checksum verification for PURL-selected artifacts.

  • Fixed Go proxy escaping, npm dist-tag resolution, and platform-specific artifact selection.

  • Made cache writes atomic and bounded decompression resistant to oversized or tampered
    entries.

Optimizations

  • Unified cached registry-document reads and stale-cache fallback behavior.
  • Added bounded OCI layer counts and total decompressed-size limits.
  • Improved artifact ranking and deterministic preferred-candidate selection.

Full Changelog: v1.0.0...v1.1.0

Assets 2
Loading