v0.21.0

Pitloom 0.21.0 makes the SBOM for a Python project or an AI model more complete and the same on every surface (CLI, library, Hatchling hook, GitHub Action). Many of the fixes and improvements in this release are a direct result of the feedback received during our demo at the ETSI Security Conference 2026. We greatly appreciate the valuable comments and discussions from the community.

• Dependencies: extras are hasOptionalDependency, pinned by uv.lock, poetry.lock or pdm.lock; authors are originatedBy Agents.
• Licences: values such as Apache2 or MIT License are read as SPDX ids through licenseid; the original text stays in the provenance.
• AI models and datasets: model producer and parameter count, SHA-512 next to SHA-256, dataset licences from Croissant and Hub cards.
• Stable ids: ID registry format 3; loom id generate --namespace IRI.
• Git sources: repository and page URLs (GitLab, Gitiles, cgit, Azure DevOps), redirects followed, optional clone size cap.
• Fixed: a fragment's description now replaces one generated from a CRFsuite model's labels (the 0.20.2 known issue, #349).

Before you upgrade

• licenseid>=0.6.0 is required; run licenseid update once.
• ID registry format 2 is now an ERROR:; regenerate with loom id generate.
• A project with extras or requirements files gets a different doc_uuid.

Install for CLI/Python API:

pip install -U pitloom

Install for AI coding assistant:

See the website on how to install Pitloom AI skills and the Claude Code plugin.
Try asking the AI agent to "generate SBOM for this project".

Report issues: https://github.com/bact/pitloom/issues

What's changed

• Record the v0.20.2 wheel SBOM verification by @bact in #299
• List extras and all authors on every route by @bact in #300
• Registry v3: one typed ID table, loom datasets and models by @bact in #305
• Add AI model producer and parameter count to AIPackage by @bact in #306
• Key ID registry by path; gate model lookups by hash by @bact in #308
• G7 AI SBOM coverage: SHA-512, datasets, conformance tests by @bact in #309
• Hub model description: pass the whole card to the description helper by @bact in #310
• Harden dataset readers, merge duplicate datasets, tidy docs by @bact in #311
• Roadmap: PyPI package ingestion (loom pypi) by @bact in #313
• A software-agent creator is the author, not the supplier by @bact in #312
• loom.Run names one dataset as a model card does by @bact in #314
• NumPy reader: type-check on numpy 2.3 and 2.5 by @bact in #315
• Lessons and field notes from PR #311 to #315 by @bact in #316
• Generate SBOMs from Git repository and page URLs by @bact in #317
• Save lessons and field notes from the Git URL work by @bact in #318
• Add the SBOM format gaps ledger and the rule to use it by @bact in #324
• Harden the Hatchling hook, export, enrich and embed-wheel by @bact in #322
• Harden the lock-file readers against hostile and malformed input by @bact in #323
• Read the staged SBOM from build_data, not from the hook's private state by @bact in #325
• Lock refusals say 'Cannot read'; refuse sbom-files name clash ignoring case by @bact in #326
• Refresh the src file-size snapshot after the lock splits by @bact in #329
• Say how to build the licence database in the test-sandbox note by @bact in #330
• Mask and escape what warnings name by @bact in #331
• Read every spelling of a Hugging Face model URL, and say so by @bact in #332
• Require licenseid 0.5.0 by @bact in #333
• Keep the default SBOM name inside the output directory by @bact in #334
• Quote paths in messages; one line per record by @bact in #335
• Follow pip when joining requirements lines by @bact in #337
• Quote paths in raised error messages by @bact in #336
• Add id import --project-dir; warn of sdist path clashes by @bact in #338
• Key a symlinked project by where it is by @bact in #341
• Spell source paths as the OS and project do by @bact in #340
• Add max_bytes to fetch_git_project: stop a fetch past a size cap by @bact in #339
• Keep URL credentials only on same-origin git redirects by @bact in #342
• Parse SourceHut tree URLs with slash branch names by @bact in #343
• Kill the whole git process tree on timeout (Windows) by @bact in #344
• Plan target resolution and Package-URL targets for 0.22.0 by @bact in #348
• Note the Hugging Face Spaces limitation and a direction by @bact in #350
• Read more Git hosts: Bitbucket, SourceHut, Azure, cgit by @bact in #347
• A fragment value replaces one generated from a model file by @bact in #349
• Prepare release 0.21.0 by @bact in #346
• Design: how Pitloom records a resolved licence value by @bact in #351
• Exclude pipdeptree 4.2.10 (no macOS arm64 wheel) by @bact in #358
• Fold a respelt JSON copy of a curated fragment value by @bact in #352
• Create one Agent per person name by @bact in #353
• Stop very long versions crashing parsers by @bact in #354
• Explain a bad % in setup.cfg by @bact in #355
• Tag setuptools stderr lines by @bact in #356
• Warn on an unknown id in an SPDX-only field by @bact in #357
• Pin the conformance checker to spec-not-covered (2355afc) by @bact in #360
• Read a declared licence value through licenseid.resolve by @bact in #359
• Release 0.21.0: date, sweep and fixes by @bact in #361

Full Changelog: v0.20.2...v0.21.0