v0.3.0

Features

• Severity in the JSON report: severity and a stable rule id on every pattern and binary delta finding, per-package maxSeverity, and summary.maxSeverity, summary.bySeverity and summary.findingsBySeverity. All fields are additive; label is unchanged (#23, #28).
• Binary evidence files: with artifacts-dir, flagged binaries get capped .lockscan-strings.txt and .lockscan-imports.txt files, referenced from the finding as evidence (#25, #30).

Fixes

• Fewer binary false positives: binary:base64 ignores data tables and pure-hex runs, and binaries are paired across versions ignoring a leading build hash (#24, #29).
• Fewer Python pattern false positives: comments, docstrings and string contents are ignored, and exec:eval/exec/compile match the builtin only. ddtrace 4.15.6: 626 → 137 hits (#22, #31).
• Release check: 6.6 now matches an upstream v6.6.0 tag (#26, #27).

Dependencies

• adm-zip 0.5.17 → 0.6.1 (fixes several advisories for untrusted ZIPs), tar 7.5.22, lockdelta 0.1.10 (#32).

v0.2.1

Security

• Archive symlinks: tarball extraction no longer creates symlink or hardlink entries, and zip/wheel extractors skip symlink entries. A package could ship a file as a symlink to a sensitive path (e.g. /proc/self/environ) and make lockscan, or a later step using artifacts-dir, read it (#20, #21).
• New findings archive:symlink-escape (high) and archive:symlink (moderate) report such links with their target.

v0.2.0

Features

• json-to-file: write the full JSON report (identical to the report output) to a file, creating parent directories, so large reports avoid env-var and output size limits (#16, #18).
• artifacts-dir: keep extracted artifacts in a lockscan-* subdirectory for the rest of the job, exposed as the artifacts-path output and removed by a post step even on failure (#17, #19).

v0.1.7

Features

• Code-signature regressions: flag native binaries whose Developer ID (Mach-O) or Authenticode (PE) signature was dropped or changed signer between versions (#13, #14). Extensionless executables and .exe files are now scanned too.
• Build provenance regressions: flag dropped or changed build attestations on npm (SLSA/Sigstore), PyPI (PEP 740) and JSR (#13, #14). New provenanceRegressions summary counter.

Chore

• Fix Biome template, unused-code and stale suppression warnings (#15)

v0.1.6

What's Changed

• feat(cli): add --quiet flag to suppress progress logs by @lachaib in #12

Full Changelog: v0.1.5...v0.1.6

v0.1.5

What's Changed

• chore: migrate pnpm from 11.0.9 to 12.2.1 by @vincentbasp in #10

New Contributors

• @vincentbasp made their first contribution in #10

Full Changelog: v0.1.4...v0.1.5

v0.1.4

What's Changed

• fix(registry-check): require corroboration for round-version confusion signal by @lachaib in #9

Full Changelog: v0.1.3...v0.1.4

v0.1.3

What's Changed

• fix(binary-scan): match native symbols against imported table only by @lachaib in #5
• Extend binary symbol scanning to npm native addons (.node files) by @lachaib in #7

Full Changelog: v0...v0.1.3

v0.1.2

What's Changed

• feat(severity): reduce false positives for lateral refactors within pattern families by @lachaib in #1
• feat(php): add PHP Composer ecosystem support by @lachaib in #2
• feat(binary-scan): differentiate suspicious string labels with per-label severity by @lachaib in #3

New Contributors

• @lachaib made their first contribution in #1

Full Changelog: v0...v0.1.2

v0.1.1

What's Changed

• feat(severity): reduce false positives for lateral refactors within pattern families by @lachaib in #1
• feat(php): add PHP Composer ecosystem support by @lachaib in #2
• feat(binary-scan): differentiate suspicious string labels with per-label severity by @lachaib in #3

New Contributors

• @lachaib made their first contribution in #1

Full Changelog: v0...v0.1.2