SecuLens 1.4.0 - Composer Version Semantics

• Packagist matching now follows Composer version normalization: one to four numeric parts (e.g. 5.4.0.1), build metadata ignored, and stability order dev < alpha < beta < RC < stable < patch (a, b, pl, p aliases and -dev suffixes included).
• Branch versions such as dev-main and 1.x-dev remain unassessed, and other unrecognized Composer syntax is reported as unknown instead of guessed.
• Add a shared Composer version test corpus (composer-versions.json) used identically by the TypeScript, Python and PHP implementations.

SecuLens for Python 1.3.0 - Require Python 3.11+

• Require Python 3.11 or later. Python 3.10 reached end of life in October 2026; installers on 3.10 keep resolving 1.2.0.

SecuLens 1.2.0 - Offline SBOM & Report Schema Validation

• Add seculens validate for offline JSON Schema validation of SPDX 2.2/2.3 and CycloneDX 1.4–1.7 SBOMs and SecuLens reports (--kind report).
• Bundle the official upstream SPDX and CycloneDX schemas with source hashes and licenses, plus the cross-language report schema report-1.1.schema.json.
• Export validateDocument / validate_document / Validation::validate from the library API.

SecuLens 1.1.0 - Supply Chain Protection & Model Context Protocol (MCP) Server

What's Changed in SecuLens 1.1.0

🛡️ Supply Chain Threat Protection

• Lifecycle Script Detection (SC-LIFECYCLE-SCRIPT): Scans package.json, package-lock.json, and composer.json for install scripts (preinstall, install, postinstall, etc.) to prevent arbitrary execution during dependency installation.
• Supply-Chain AST Static Analysis: Detects hazardous patterns including dynamic process spawning (child_process / subprocess), environment variable enumeration (process.env, os.environ, $_ENV), and sensitive path references (~/.ssh, id_rsa, ~/.aws).

🤖 Model Context Protocol (MCP) stdio Server

• Introduces seculens mcp command across TypeScript, Python, and PHP implementations with zero external dependencies.
• Fully compatible with Claude Desktop, Cursor, Antigravity, and other AI agents.
• Exposes tools: seculens_scan, seculens_analyze, seculens_check_license, and seculens_generate_report.

🔍 Lockfile Integrity & Cool-off Checks

• Lockfile Integrity Verification: Flags hash mismatches between SBOM and lockfiles (SC-INTEGRITY-MISMATCH) and insecure HTTP resolution URLs (SC-INSECURE-REGISTRY-URL).
• Release Age (Cool-off) Check (--cool-off): Flags packages released within a specified threshold (e.g. 7 days) to guard against zero-day compromised releases.
• Transitive Dependency Depth: Automatically calculates and assigns depth levels to dependency components.

⚙️ Automation & Security

• Added weekly Dependabot automated dependency update configuration.
• Added GitHub Actions pull request dependency review workflow.
• Reinforced .gitignore across all ecosystems.

SecuLens for Python 1.0.0

SecuLens 1.0.0 aligns the release version across the independent Python, JavaScript/TypeScript and PHP implementations.

• SPDX and CycloneDX SBOM assessment, native OSV vulnerability matching and license policy evaluation.
• Language-native AST review and complexity checks.
• English-default/Japanese interactive wizard and customer Word reports with a cover, severity summary and finding tables.
• Includes the output file safety fixes from the preceding maintenance release.

Language-specific AST rules, supported language versions and SBOM generation adapters are documented in each implementation's README. Findings are assessment evidence, not a guarantee of security or legal compliance.

SecuLens for Python 0.3.2

Protect CLI report and SBOM output from destination symlink overwrite by replacing generated files from a private temporary location. New report files use restrictive Unix permissions.

Python and TypeScript SBOM generation now has a five-minute timeout. PHP local JSON input/output rejects URL and stream wrapper paths.

Regression tests cover preservation of symlink target files. Dependency audits reported no known vulnerabilities in the installed dependencies at review time; this is not a guarantee of absence of unknown defects.

SecuLens Python 0.3.1 — masahiroid

Move the SecuLens repositories and package links to masahiroid.

Python: https://github.com/masahiroid/seculens-python
TypeScript: https://github.com/masahiroid/seculens

Includes the bilingual interactive wizard and customer Word reporting from 0.3.0. PyPI publisher settings use owner masahiroid, repository seculens-python, workflow publish.yml, environment pypi.

SecuLens Python 0.3.0 — Interactive Wizard

Run seculens without arguments to launch interactive setup. English is the default; select ja for Japanese, or run seculens wizard --lang ja. The selected language also applies to the Word report.

Choose assessment of an existing SBOM or SBOM generation. Enter database, optional policy / source review, customer / target / preparer, report style and output settings, then review and confirm. Customer report layout is the wizard default. Existing scan / sbom options remain available.

Invalid input paths and choices prompt again. EOF, declined execution and Ctrl+C cancel safely. OSV package-name / ecosystem disclosure is shown before fetching. Python generation requires Syft; TypeScript generation uses npm.

Validated: Python 54 tests; TypeScript 27 tests; actual terminal interaction; independent package-install runs produce Japanese Word reports from the bare command.

SecuLens Python 0.2.0 — Customer Reports

Customer-facing Word reports with a cover, severity-colored summary, tabular findings register, numbered recommendations, component coverage and evidence.

Use --report-style customer --customer "Customer" --target "System" --issuer "Preparer" --lang ja. Standard report mode remains available.

Severity uses CVSS 3.0/3.1 base scoring and advisory labels, retaining source evidence in JSON schema 1.1. Unsupported or missing scores remain Unrated; CVSS 2/4 calculation is not supported.

Both native implementations pass package-install smoke tests and live OSV snapshot parity. Python: 47 tests. TypeScript: 20 tests. Japanese Word sample reports were visually checked on all 18 pages.

SecuLens for Python 0.1.0

SecuLens for Python 0.1.0 is an independent Python implementation for SBOM vulnerability matching, SPDX license policy evaluation, Python AST review and customer-facing Word/JSON reports.

• Imports CycloneDX 1.4–1.7 JSON and SPDX 2.2/2.3 JSON; optional Syft generation supports both formats.
• Performs local OSV matching for npm, PyPI and supported Composer versions, saves snapshots/hashes, and distinguishes incomplete coverage.
• Reviews Python AST security candidates and function complexity without executing source.
• Generates Japanese/English Word reports; Japanese font is bundled and embedded under SIL OFL.

Validation: 25 tests; Python 3.10, 3.13 and 3.14 CI; dependency audit; build and metadata checks; fresh wheel installation; actual Syft generation; same assessment result as TypeScript against a live OSV snapshot; all pages of the Japanese sample report visually checked.

This is an early release. Full SAST, reachability and legal compliance determinations are outside its scope. The demonstration advisory snapshot is synthetic. PyPI publication is pending account publisher configuration. Install the attached wheel with pip install seculens-0.1.0-py3-none-any.whl.