v0.27.0

What's Changed

• docs: name the owning package in doc comments that still said sdk. by @bomly-guy in #477
• Adopt bomly-sdk v0.14 and emit the scan record by @bomly-guy in #483
• build(deps): bump anyio from 4.14.1 to 4.14.2 in /.github in the pip group across 1 directory by @dependabot[bot] in #478
• build(deps): bump actions/setup-java from 6.0.0 to 6.0.1 in the github-actions-patch group by @dependabot[bot] in #482
• build(deps): bump the github-actions-minor group with 4 updates by @dependabot[bot] in #481
• build(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 by @dependabot[bot] in #479
• build(deps): bump github.com/mark3labs/mcp-go from 1.0.0 to 1.1.1 in the gomod-minor group across 1 directory by @dependabot[bot] in #485
• build(deps): bump the pip group across 1 directory with 3 updates by @dependabot[bot] in #487

Full Changelog: v0.26.0...v0.27.0

---

Release artifacts

• Full builtin bomly archives for Linux, macOS, and Windows.
• Alternate bomly-lite archives for users who prefer external Syft and Grype binaries.
• Linux packages for Debian, RPM, Alpine, and Arch-compatible package managers.
• Homebrew, Scoop, and WinGet package-manager manifests or publishing pull requests.
• SHA256SUMS for release artifact verification, signed keylessly with cosign (SHA256SUMS.sigstore.json).
• SLSA Build Level 3 provenance (multiple.intoto.jsonl) generated by slsa-github-generator.

Each archive includes LICENSE, NOTICE, and a licenses/ directory with third-party license texts. See Verify release checksums for signature and provenance verification commands.