v0.9.4

What's Changed

• test(wire): pin the v1 plugin wire's lenient decode by @bomly-guy in #56

Full Changelog: v0.9.3...v0.9.4

v0.9.3

What's Changed

• ci: port the CLI's supply-chain and quality workflows, add README badges by @bomly-guy in #46
• build(deps): bump google.golang.org/grpc from 1.83.0 to 1.83.1 in the go_modules group across 1 directory by @dependabot[bot] in #47
• build(deps): bump actions/checkout from 4 to 7 by @dependabot[bot] in #51
• build(deps): bump github/codeql-action/upload-sarif from 4.37.7 to 4.37.9 in the github-actions-patch group by @dependabot[bot] in #50
• build(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 in the gomod-patch group across 1 directory by @dependabot[bot] in #49
• build(deps): bump github.com/CycloneDX/cyclonedx-go from 0.11.0 to 0.12.0 in the gomod-minor group across 1 directory by @dependabot[bot] in #52
• fix(security): address Scorecard and CodeQL findings by @bomly-guy in #53

New Contributors

• @dependabot[bot] made their first contribution in #47

Full Changelog: v0.9.2...v0.9.3

v0.9.2

What's Changed

• feat: NodePURL answers what package URL a node publishes by @bomly-guy in #44
• fix: a PyPI version takes its PEP 440 canonical form before minting by @bomly-guy in #45

Full Changelog: v0.9.1...v0.9.2

v0.9.1

What's Changed

• fix(detectorkit): PropagateScopes stands down when the root is absent from the graph by @bomly-guy in #40
• fix: a generic fallback identity keeps its ecosystem when reconstructed from the PURL alone by @bomly-guy in #41
• fix: bound the component descriptor name, so a license source cannot outgrow its own contract by @bomly-guy in #42

Full Changelog: v0.9.0...v0.9.1

v0.9.0

What's Changed

• feat: node accessors, prototype construction, and identity fallbacks (ships as v0.9.0) by @bomly-guy in #36

Full Changelog: v0.8.0...v0.9.0

v0.8.0

What's Changed

• fix: two defects found migrating plugins to v0.7.0 (ships as v0.8.0) by @bomly-guy in #31

Full Changelog: v0.7.0...v0.8.0

v0.7.0

What's Changed

• feat: conformance pins the typed-node wire; docs adopt the union by @bomly-guy in #21
• feat: component-level SBOM assertions are typed model fields by @bomly-guy in #22
• feat: external references are typed model fields, sourced from the format libraries by @bomly-guy in #23
• docs(cpe): record the third declined library and the reason by @bomly-guy in #25
• fix: a Unicode host publishes as punycode, not as percent escapes by @bomly-guy in #24
• feat: phase 1.4 model fields — scope mapping, edge kinds, usage attribution, document assertions by @bomly-guy in #30

Full Changelog: v0.6.0...v0.7.0

v0.6.0

What's Changed

• feat: purlkit type profiles, identity split, and origin merging by @bomly-guy in #16
• feat!: the typed graph-node union — identity is the canonical PURL by @bomly-guy in #17

Full Changelog: v0.5.1...v0.6.0

v0.5.1

What's Changed

• Delegate identity ecosystem aliases to purlkit by @bomly-guy in #9
• Remove repeated PURL reparsing by @bomly-guy in #10
• Move purlkit to the official package-url library by @bomly-guy in #11

Full Changelog: v0.5.0...v0.5.1

v0.5.0

What's Changed

• docs: add agent guidance recording the SDK-first placement rule by @bomly-guy in #4
• ci: gate API compatibility with gorelease against the latest tag by @bomly-guy in #5
• build: require Go 1.27 by @bomly-guy in #6
• feat: purlkit — one home for package-URL behavior by @bomly-guy in #7
• feat: spdxkit — one home for SPDX license behavior by @bomly-guy in #8

Full Changelog: v0.4.2...v0.5.0