v2.1.0

What's Changed

• chore: next development release by @ruromero in #601
• build(deps): bump yaml from 1.10.2 to 1.10.3 in /ui by @dependabot[bot] in #590
• build(deps): bump picomatch from 2.3.1 to 2.3.2 in /ui by @dependabot[bot] in #591
• build(deps): bump node-forge from 1.3.3 to 1.4.0 in /ui by @dependabot[bot] in #593
• build(deps): bump lodash from 4.17.23 to 4.18.1 in /ui by @dependabot[bot] in #598
• build(deps): bump follow-redirects from 1.15.11 to 1.16.0 in /ui by @dependabot[bot] in #600
• build(deps): bump brace-expansion from 1.1.12 to 1.1.13 in /ui by @dependabot[bot] in #594
• feat: allow adding cve filter. Addresses TC-4319 by @ruromero in #602
• fix: validate license responses by @ruromero in #604
• fix: processing licenses with + sign by @ruromero in #605
• feat(sbom): extract component hashes from CycloneDX and SPDX SBOMs by @ruromero in #606
• feat: PEP 691 registry client for PyPI trusted library recommendations by @ruromero in #607
• build(deps): bump ip-address from 10.1.0 to 10.2.0 in /ui by @dependabot[bot] in #603
• build(deps): bump fast-uri from 3.1.0 to 3.1.2 in /ui by @dependabot[bot] in #608
• build(deps): bump @babel/plugin-transform-modules-systemjs from 7.29.0 to 7.29.4 in /ui by @dependabot[bot] in #609
• fix: recommend when no vulnerabilities are reported by @ruromero in #610
• fix: handle missing concluded license in project license summary card by @a-oren in #611
• fix(licenses): return 400 for empty body on POST /api/v5/licenses by @a-oren in #612
• fix: report vulnerabilities with null severity when CVSS scores are missing by @a-oren in #613
• fix(licenses): preserve original license name for non-standard deps.dev licenses by @a-oren in #614
• feat(ui): sort batch report tabs alphabetically by PURL key by @ruromero in #616
• fix(batch): preserve deterministic key ordering in batch analysis response by @ruromero in #615
• fix(licenses): resolve AmbiguousMethodCallException in getLicense route by @a-oren in #618
• feat(api): surface recommendations as provider-level map grouped by source by @a-oren in #620
• fix: handle missing vulnerability severity to prevent report crash by @Strum355 in #619
• revert: skip CVEs without CVSS scores for release by @ruromero in #622
• feat: add Codecov integration with JaCoCo coverage by @ptomanRH in #617
• build(deps): bump shell-quote from 1.8.3 to 1.8.4 in /ui by @dependabot[bot] in #624
• feat(licenses): instrument deps.dev routes with ProviderRoutePolicy by @ruromero in #623
• fix(licenses): reduce batch size to match deps.dev API response cap by @ruromero in #625
• feat(api): add unknown severity counter to backend and UI report by @ruromero in #621
• fix(trustify): report CVEs without CVSS scores by @ruromero in #626
• fix(api): map null severity to unknown counter by @ruromero in #628
• feat(hardened): add Hummingbird hardened image recommendation provider by @a-oren in #627
• feat(hardened): wire hardened image recommendations into analysis pipeline by @a-oren in #631
• build(deps): bump tar from 7.5.11 to 7.5.16 in /ui by @dependabot[bot] in #634
• fix(hardened): remove PURL qualifier double-encoding and enable Hummingbird URL by @ruromero in #636
• fix(hardened): preserve multiple recommendations per base image by @a-oren in #637
• fix(hardened): enable hardened recommendations for single analysis and fix cache leakage (TC-4987) by @a-oren in #639
• feat(trustify): migrate DA backend from Trustify v2 to v3 endpoints by @ruromero in #638
• fix(trustify): merge remediation data across purl_statuses with advisory attribution (TC-5019) by @ruromero in #640
• feat(hardened): add deployment-time registry prefix replacement map (TC-5107) by @ruromero in #642
• fix(lock): replace invalid SET NX GET with SET NX + GET by @ruromero in #646
• refactor(hardened): remove UBI recommendation code and configuration by @a-oren in #647
• build(deps): bump launch-editor from 2.12.0 to 2.14.1 in /ui by @dependabot[bot] in #629
• build(deps): bump form-data from 3.0.4 to 3.0.5 in /ui by @dependabot[bot] in #630
• build(deps): bump ws from 7.5.10 to 7.5.13 in /ui by @dependabot[bot] in #632
• feat(report): improve remediation display with GHSA links and version range popovers (TC-4523) by @ruromero in #643
• build(deps): bump @babel/core from 7.29.0 to 7.29.7 in /ui by @dependabot[bot] in #633
• build(deps): bump http-proxy-middleware from 2.0.9 to 2.0.10 in /ui by @dependabot[bot] in #635
• build(deps): bump websocket-driver from 0.7.4 to 0.7.5 in /ui by @dependabot[bot] in #644
• build(deps): bump shell-quote from 1.8.4 to 1.10.0 in /ui by @dependabot[bot] in #649
• build(deps): bump body-parser from 1.20.4 to 1.20.6 in /ui by @dependabot[bot] in #651
• build(deps): bump tar from 7.5.16 to 7.5.22 in /ui by @dependabot[bot] in #652
• build(deps): bump brace-expansion from 1.1.14 to 1.1.18 in /ui by @dependabot[bot] in #653
• build(deps): bump ip-address from 10.2.0 to 10.5.0 in /ui by @dependabot[bot] in #654
• build(deps): bump fast-uri from 3.1.2 to 3.1.6 in /ui by @dependabot[bot] in #655
• build(deps): bump nanoid from 3.3.11 to 3.3.18 in /ui by @dependabot[bot] in #656
• build(deps): bump js-yaml from 3.14.2 to 3.15.1 in /ui by @dependabot[bot] in #657
• fix(summary): deduplicate CVE IDs across purls in VulnerabilityCounter by @ruromero in #658
• build(deps): bump postcss-selector-parser from 6.1.2 to 6.1.4 in /ui by @dependabot[bot] in #660
• build(deps): bump browserslist from 4.28.1 to 4.28.8 in /ui by @dependabot[bot] in #661
• build(deps): bump js-yaml from 3.15.1 to 3.15.2 in /ui by @dependabot[bot] in #663
• build(deps): bump colord from 2.9.3 to 2.10.0 in /ui by @dependabot[bot] in #662
• fix: show N/A cvsScore in Unknown vulns by @ruromero in #665

New Contributors

• @a-oren made their first contribution in #611
• @Strum355 made their first contribution in #619
• @ptomanRH made their first contribution in #617

Full Changelog: v2.0.0...v2.1.0