Repository navigation
This release adds opt-in Jupyter notebook statistics, 17 new tool definitions (13 of them security tools), SBOM and security audit discovery, and a new license matcher. Building from source now requires Go 1.27; the release binaries are built with Go 1.27.3.
Notebooks
brief --json --notebooks . adds a notebooks field with one entry per .ipynb file (#238):
{
"path": "analysis.ipynb",
"status": "ok",
"language": "python",
"language_source": "kernelspec",
"code_cells": 2,
"code_lines": 3,
"code_bytes": 31,
"output_bytes": 75,
"file_bytes": 381
}output_bytes is the size of saved cell outputs, counted separately from code so a notebook full of embedded plots doesn't look like a large codebase. Cell contents and outputs are never included in the report. With the option on, a notebook's kernel language also counts towards languages, so a repository containing only Python notebooks reports Python. Parsing covers notebook formats 3 and 4 and stops at 32 files, 8 MiB per file and 32 MiB in total. Files over a size limit are listed with a size_limit or byte_limit status, and notebooks past the 32nd are counted in skipped_files. The field is JSON only and is absent without the option.
Detection
New tools: Jupytext, nbstripout, Papermill and PyMoDAQ (#238, #241), plus Checkov, CodeQL, Dependency Review Action, Gitleaks, Harden-Runner, OpenSSF Scorecard, Qodana, Secretlint, Syft, cargo-deny, detect-secrets, ggshield and zizmor in the security category (#235, #239).
The security tools are recognised from their official GitHub Actions as well as config files and dependencies, and Grype, Trivy, TruffleHog and Snyk gained the same workflow detection. SonarQube config is now found in any directory, where before only the repository root was checked. Snakemake workflows named snakefile in lowercase are detected (#240).
PyPI dependencies are matched by canonical name, so FLask matches flask and MYST_PARSER matches myst-parser. The spelling declared in the manifest is kept in the dependencies output (#243).
Resources
Two new fields: resources.metadata.sbom for CycloneDX and SPDX documents (bom.json, *.cdx.json, *.spdx.json and similar), and resources.security.security_audit for files named security-audit* or security-review*. Both are searched for in every directory, as are threat models, which now also match prefixed names such as api-threat-model.md (#235).
When README.md and README.html sit side by side, readme now reports the Markdown file; 0.15.0 picked the HTML one (#242).
Changelog matching no longer uses wildcards, which stops source files such as history.go being reported as the changelog. It now matches CHANGELOG, CHANGES, HISTORY, NEWS and CHANGE, bare or with a .md, .txt, .rst or .adoc extension. Other names that 0.15.0 accepted, such as CHANGELOG.markdown or CHANGELOG-1.x.md, are no longer reported (#235).
License identification moved from licensecheck to git-pkgs/licenses. A license file containing only an SPDX-License-Identifier: line now gets a license_type, and results for unusual license texts may differ from 0.15.0 (#234).
brief diff
A changed manifest or lockfile now keeps the languages and development tools that are detected from its dependencies, so a package.json change still reports TypeScript and a yarn.lock change still reports Storybook. A changed manifest that doesn't declare the dependency no longer keeps them. Changed paths are read NUL-separated from git, which fixes filenames containing non-ASCII characters or newlines (#233).
Go API
kb.MatchPathPattern, ToolDef.MatchesPath, ResourceInfo.MatchesPath and KnowledgeBase.Resource let other programs classify a file path against the knowledge base without copying its rules (#235). ResourceInfo has a new Recursive field, detect.Engine has NotebookStats, and brief.Report has Notebooks.
Fixes
Archive inspection no longer counts the global PAX header as a file, so a one-file git archive tarball reports one entry instead of two (#244).
Full changelog: v0.15.0...v0.16.0