v0.3.0

Features

• Severity in the JSON report: severity and a stable rule id on every pattern and binary delta finding, per-package maxSeverity, and summary.maxSeverity, summary.bySeverity and summary.findingsBySeverity. All fields are additive; label is unchanged (#23, #28).
• Binary evidence files: with artifacts-dir, flagged binaries get capped .lockscan-strings.txt and .lockscan-imports.txt files, referenced from the finding as evidence (#25, #30).

Fixes

• Fewer binary false positives: binary:base64 ignores data tables and pure-hex runs, and binaries are paired across versions ignoring a leading build hash (#24, #29).
• Fewer Python pattern false positives: comments, docstrings and string contents are ignored, and exec:eval/exec/compile match the builtin only. ddtrace 4.15.6: 626 → 137 hits (#22, #31).
• Release check: 6.6 now matches an upstream v6.6.0 tag (#26, #27).

Dependencies

• adm-zip 0.5.17 → 0.6.1 (fixes several advisories for untrusted ZIPs), tar 7.5.22, lockdelta 0.1.10 (#32).