Skip to content

v0.18.0

Marketplace
Marketplace

Choose a tag to compare

View all tags
@bact bact released this 16 Sep 09:41
· 1167 commits to main since this release
v0.18.0
f5d6cf5
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release adds support for Flit, PDM, Poetry, and uv_build projects. It now supports more lock file formats, including the new PEP 751 pylock.toml. It also fixes a number of non-security bugs, see details in CHANGELOG.

Note

Limitation notes: While Pitloom can work with any Python project, it currently gathers more information from Flit, Hatchling, PDM, Poetry, setuptools, and uv_build projects. Support for build with compiled artefacts (maturin, scikit-build-core, meson-python) is in the plan. See full limitation notes.

Install for CLI/Python API:

pip install -U pitloom

Install for AI coding assistant:

See the website on how to install Pitloom AI skills and the Claude Code plugin.
Try asking the AI agent to "generate SBOM for this project".

Report issues: https://github.com/bact/pitloom/issues

What's Changed

  • Add Poetry backend wheel discovery and poetry.lock deps by @bact in #198
  • Reorganize generator and models_wheel tests by @bact in #199
  • Add pitloom fragment validate CLI command by @bact in #200
  • Add --debug flag / PITLOOM_DEBUG for DEBUG output by @bact in #201
  • Add loom verify-wheel and validate-wheel commands by @bact in #202
  • Add comments on canonical sort function by @bact in #203
  • Cross-check SBOM name/version in verify-wheel and embed-wheel by @bact in #204
  • PDM and Flit backend support by @bact in #205
  • Add PEP 639 license-files support with SBOM bundling by @bact in #207
  • Add PEP 751 pylock.toml resolved-dependency support by @bact in #208
  • Add --use-lockfile flag to control lock-file resolution by @bact in #210
  • Add conflict detection for dependency version (beyond license) by @bact in #211
  • Use lock-file SHA-256 hashes in offline builds and prioritised over PyPI online by @bact in #212
  • Skip Merkle-root hashing in embed-wheel's file rescan by @bact in #213
  • Add in-tree .dist-info/.egg-info metadata source by @bact in #214
  • Add uv_build file discovery via --allow-build build-and-read by @bact in #215
  • Add uv_build metadata regression test by @bact in #216

Full Changelog: v0.17.0...v0.18.0

Contributors

bact
Assets 7
Loading