Release v4.0.1

caxa 4.0.1 makes the metadata file it writes for each binary (binary-metadata.json by default, or the name given to --metadata-file) describe that binary accurately, so an SBOM built from it, such as cdxgen's -t caxa, matches what the binary extracts. The binary itself and its payload format are unchanged.

The dependency graph now names the versions Node would load. Dependencies are resolved the way Node's module lookup does it, walking up from each package's own directory and following pnpm-style symlinks, so a package installed at several versions points at the right one. Optional and peer dependencies that are installed are linked too, and the binary's top-level component depends on every package nothing else requires, so no component is left unreachable.

The bundled Node runtime now lists only what ships. Before, it listed every shared library the build machine loaded, which on macOS meant several hundred entries from /usr/lib and /System. It now lists the libraries compiled into Node and the ones caxa copies into the app, all with scope required. The modules and napi entries are gone, since they are ABI numbers and not libraries.

Lazy members are recorded. With --lazy or --lazy-auto, the package that contains each lazy file carries a cdx:caxa:lazyMember property, so an SBOM consumer can tell that the file inside the archive is a placeholder until first use. Windows builds record none, because Windows extracts lazy members up front.

This release is #19.

Full Changelog: v4.0.0...v4.0.1

Release v4.0.0

caxa 4.0 rewrites the runtime stub in Rust and is built for large applications, such as the full cdxgen binary with its native plugins. The stub is about 0.5 MB instead of 3 MB, and all seven targets are cross-compiled from one host.

Payloads are now compressed and extracted in parallel frames (payload format v2). For cdxgen on macOS arm64, the build went from 187 s to 50 s and the cold start from 1.4 s to 0.8 s, for under 1% of binary size. Payload bytes stay identical across repeat builds and core counts.

Large executables that most runs never start can be extracted on first use with --lazy or --lazy-auto, and on Unix a low-priority background prefetcher fills them in after the app starts. With cdxgen's plugins lazy, a cold start writes 187 MB instead of 610 MB. Large files decode straight into place, so neither the stub nor the prefetcher needs more than a few megabytes of memory for them, and files over 32 MiB decode on several threads. The bundled Node runtime is now stripped of its symbol table, which saves about 2.5 MB per binary and 18 to 24 MB of writes on every cold start.

Most builds upgrade without changes. Native zstd outputs default to the v2 format, so only tools that parse caxa binaries themselves, or custom stubs from 3.x, need --payload-format v1. A 4.0 build extracts into a new cache directory, and caxa does not remove the old ones. Stripping Node needs strip on Linux and strip plus codesign on macOS; without them caxa warns and bundles Node as it is, and --no-strip-node turns stripping off. The README's "Upgrading from 3.x" section has the full list, and docs/performance.md has the measurements, including the ideas we tried and dropped. Contributors now need Rust, zig and cargo-zigbuild instead of Go.

This release collects #12 (Rust stub), #14 (parallel payload), #15 and #16 (lazy members, prefetch and in-place decode), #17 (stripped Node and parallel parts) and #18 (docs, and fixes to --upx-args and the API types).

Full Changelog: v3.1.1...v4.0.0

Release v3.1.1

What's Changed

• Use cdx-purl to emit valid purls by @prabhu in #11

Full Changelog: v3.1.0...v3.1.1

Release v3.1.0

Reduced binary size with aggressive zstd compression. Other performance improvements.

Full Changelog: v3.0.3...v3.1.0

Release v3.0.3

Migrate to cdxgen org.

Full Changelog: v3.0.1...v3.0.3

Release v3.0.1

Ignore hbom*

Full Changelog: v3.0.0...v3.0.1

Release v3.0.0

Major change with zstd compression and batched builds.

What's Changed

• feat: add portable Node bundling, zstd payloads, and batch build support by @prabhu in #8
• update packages by @prabhu in #9

Full Changelog: v2.0.13...v3.0.0

Release v2.0.13

Full Changelog: v2.0.12...v2.0.13

Release v2.0.12

What's Changed

• Track parent component version, arch, and platform by @prabhu in #7

Full Changelog: v2.0.11...v2.0.12

Release v2.0.11

components and dependencies in the metadata file are usable directly in a CycloneDX SBOM.

Full Changelog: v2.0.8...v2.0.11