v3.6.1-dk.2

3.6.1-dk.2 (2026-10-01)

Features

• sbom: add --warnings-non-fatal flag to sbom validate (#331) (91e1a30)
• sbom: carry STREEBOG source-distribution digests through the CycloneDX 1.6 SBOM (#383) (1065a95)
• sbom: generate file-based package SBOMs without docker.sock (#307) (6681160)
• sbom: mark only entry-point packages as directly attackable (#332) (a0b171e)
• sbom: report the source language of cataloged packages (#328) (df4ba44)

Bug Fixes

• ci: honor cancellation of build and test workflows (#381) (63f7581)
• sbom, vex, build: keep artifacts with the image in every repository (#282) (5544c87)
• sbom: restore the build after the file-based SBOM scan merge (#380) (4d67f69)
• sbom: stop ispras validation failing on containers without a description (#382) (c3c9abd)
• sbom: stop printing every validation finding twice in sbom validate (#350) (6f0af68)