Skip to content

0.14.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 14 Jun 20:03
· 181 commits to main since this release
0.14.0
fe1ced6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release 0.14.0 (released 2026-06-14)

  • Update Winget manifest to the Windows Package Manager Community Repository on new release (#1263)
  • Check for new dfetch version during dfetch check & dfetch environment (#1262)
  • Respect the superproject's line-ending preference (#1260)
  • Strip user:password@ userinfo before storing metadata (#1206)
  • Warn when a project URL uses a plaintext transport scheme (#1229)
  • Documentation and threat-model clarifications for existing release attestation support (#1208)
  • Report SVN externals fetched during update (#1220)
  • Use .cdx.json as the default extension for CycloneDX SBOM reports (#1118)
  • Embed base64-encoded license text in SBOM licenses[].text when a license is successfully identified (#1112)
  • Set SBOM licenses to the SPDX expression NOASSERTION when a license file is not found or cannot be classified (#1112)
  • Add a dfetch:license:finding property to SBOM when NOASSERTION is set, explaining the reason (#1112)
  • Add dfetch:license:threshold and dfetch:license:tool SBOM properties (#1116)
  • Add dfetch:license:<spdx-id>:confidence SBOM property for per-licence confidence scores (#1116)
  • Use github purl, repo and version for a github release archive in SBOM (#1063)
  • Allow dfetch freeze to accept project names to freeze only specific projects (#1063)
  • Edit manifest in-place when freezing inside a git or SVN superproject, preserving comments and layout (#1063)
  • Add new remove command to remove projects from manifest and disk (#26)
  • Fix "unsafe symlink target" error for archives containing relative .. symlinks (#1122)
  • Print runtime errors (e.g. svn not available on system) directly in context of the failing subproject instead of collecting and showing them at the end (#1096)
  • Fix dfetch add crashing with a ValueError when the remote URL has a trailing slash (#1137)
  • Fix unhelpful error message when a metadata file is malformed (#1145)
  • Fix arbitrary file write via malicious tar/zip symlink (#1152)
  • Prevent SSH command injection (#1152)
  • Allow manifests with no projects key so dfetch add can bootstrap empty manifest (#1197)
  • Fix ValueError when generating a PackageURL (e.g. for an SBOM) from an empty or path-only remote URL
  • Fix SSH shorthand URLs (git@host:path) being incorrectly joined with / when used as url-base with repo-path (#1247)
  • Run svn+ssh:// connections in non-interactive mode to prevent hanging (#1230)
Assets 14
Loading