v0.30.0

What's Changed

• build(deps): bump jvmreach-analyzer to v0.4.1, and unblock the local gates by @bomly-guy in #530
• build(deps): bump certifi from 2026.6.17 to 2026.10.19 in /.github in the pip group across 1 directory by @dependabot[bot] in #529
• feat: adopt bomly-sdk v0.16.0 -- transactional component calls and a shared component lifetime (#415, #416) by @bomly-guy in #532
• feat: preflight declared component requirements and disclose plugin access by @bomly-guy in #531
• docs(agents): hold ADR requests to the bar, and record criteria for plugin-author and developer docs by @bomly-guy in #534
• build(deps): bump the pip group across 1 directory with 2 updates by @dependabot[bot] in #533
• build(deps): pin the built-in plugins that declare requirements and access by @bomly-guy in #536
• build(deps): bump filelock from 3.29.4 to 4.2.1 in /.github in the pip group across 1 directory by @dependabot[bot] in #537
• test: update smoke golden files by @github-actions[bot] in #538

Full Changelog: v0.29.0...v0.30.0

---

Release artifacts

• Full builtin bomly archives for Linux, macOS, and Windows.
• Alternate bomly-lite archives for users who prefer external Syft and Grype binaries.
• Linux packages for Debian, RPM, Alpine, and Arch-compatible package managers.
• Homebrew, Scoop, and WinGet package-manager manifests or publishing pull requests.
• SHA256SUMS for release artifact verification, signed keylessly with cosign (SHA256SUMS.sigstore.json).
• SLSA Build Level 3 provenance (multiple.intoto.jsonl) generated by slsa-github-generator.

Each archive includes LICENSE, NOTICE, and a licenses/ directory with third-party license texts. See Verify release checksums for signature and provenance verification commands.