0.8.0

Scanner signatures that can actually pass, hardening against hostile input, and a weekly re-scan workflow.

Added

• --trivy-archive/--grype-archive and --trivy-checksums/--grype-checksums: before the scanner runs,
  cosign checks the release's Sigstore bundle on the checksums file (or the archive), the checksums file must list
  the archive's SHA-256 (matched by name, or by hash when the archive was saved under another name), and the
  executable must be byte-for-byte the one inside the archive. An archive with neither a checksums file nor a
  bundle is compared but noted as unanchored.
• --govulncheck-sha256 (checked before govulncheck runs) and --govulncheck-version. The Docker or crane
  executable used to copy binaries out of an image is recorded with its SHA-256 in assessment.json.
• examples/scheduled-rescan: a GitHub workflow that re-scans an inventory weekly, carries decisions forward,
  keeps the reports as an artifact (also when a run fails) and opens an issue listing the Act now findings no
  decision has set aside and releases under a week old. A fingerprint in the issue title means the same list is
  reported once while its issue is open. It needs only contents: read and issues: write and never commits.
• A warning when --sbom, --trivy-arg/--grype-arg, --image-src, --release-tag, a scanner pin for a
  scanner that does not run, or a govulncheck option without --reachability would have no effect.

Changed

• --trivy-cosign-bundle and --grype-cosign-bundle need the matching --*-archive (B10). Trivy signs its
  release archives and checksums file and Grype only its checksums file; neither signs the extracted executable,
  so a bundle checked against the executable could never pass on a real release (confirmed on Trivy 0.76.1).
• Option abbreviations are refused (--offlin no longer means --offline), and --top, --timeout,
  --grace-days and --unshipped-days are range checked before any work.

Fixed

• A .tar.gz or .zip without PKG-INFO (apache-tomcat-9.0.98.tar.gz) was looked up on PyPI and reported as
  not published; it is now unsupported (B20).
• A missing scanner left an empty output folder behind (B24).

Security

• pom.properties and package.json larger than 1 MB are never read; a small archive could inflate to gigabytes in
  memory (S2).
• packages.csv header cells and values joined with ;, , or a tab are guarded against spreadsheet formulas,
  not only a leading = (signed numbers such as -1 are left alone), and reading findings.csv back undoes the
  guard exactly, even for notes that already contain a quote before = (S3, S4).
• summary.md escapes Markdown and HTML in every line built from data (title, headings, paragraphs, lists and
  tables), so a package name, tag or advisory title cannot add links, images or raw HTML (S5).
• Registry identities read from inside an artifact must be valid coordinates (no path segments or ..) and are
  URL-quoted, so a tampered file cannot steer the checksum lookup to another package (S6).
• Advisory text and workflow files are length-capped before pattern matching, which could take seconds on crafted
  input (S7).
• Unreadable archives no longer crash the run, and the temporary copy of an artifact is always removed (S8).
• govulncheck is pinned like Trivy and Grype (S9).

0.7.0

Decisions and versions you can trust, a check for brand-new releases, and a CI gate.

Added

• New-release check: every language package version the run knows about (inventory entries, or the image's or
  lockfile's package list) is looked up on deps.dev, and versions published fewer than --release-age-days ago
  (default 7; 0 turns it off) are flagged in a warning, a "New releases" tile and section, the executive summary,
  and packages.csv (new published and new_release columns). Compromised releases are usually live for hours
  or days before they are pulled and before any advisory exists. Up to 400 lookups per run.
• --fail-on for CI: exit 3 when any of malicious, kev, act, critical, high, recent or mismatch is
  found, naming which. Findings set aside by evidence or an assessor decision do not count; malicious packages
  always do. A gate whose check is turned off (--offline, --release-age-days 0, --no-registry-check) is
  refused, and one whose check could not run fully (deps.dev errors, no package list) exits 1 rather than pass.
• findings.csv column triage_justification (optional OpenVEX justification), so decisions survive
  findings.csv to OpenVEX and back unchanged.
• Issue templates; security reports are pointed to private advisories.

Changed

• Breaking for existing findings.csv files: mitigated in triage_status now means not affected with the
  justification inline_mitigations_already_exist (CycloneDX protected_by_mitigating_control), not fixed: a
  compensating control is not a fix. A mitigated row now needs triage_notes; one without stops the run
  (exit 2), where 0.6 read it as fixed. Rows already saved as fixed are unchanged.
• A decision for another version of a finding that is still present is no longer listed as resolved.
• An inventory's "upgrade to" is the lowest listed fix that is fixed for every finding on its release line.
• PyPI metadata: current summary, Python 3.10 to 3.13 classifiers, Documentation and Sample report links. CI also
  runs Python 3.11 and 3.12.

Fixed

• Two decisions for one vulnerability in one package at two versions overwrote each other; the one for the
  installed version now wins (B3).
• The tool could not read back its own openvex.json for OS packages (pkg:deb/ubuntu/libc6 loaded as package
  ubuntu/libc6); the distro namespace is dropped, the epoch qualifier read, and encoded versions decoded
  (7.88.1-10%2Bdeb12u14) (B4).
• Notes starting with -, =, + or @ gained a quote, and multi-line notes were flattened, after a round trip
  (B18, B21).
• OSV commit hashes from GIT ranges could become the fix and "upgrade to" version (B5).
• Letter-patched versions sorted wrong (OpenSSL 1.1.1m below 1.1.1l), so their fixes were missed; OpenSSL's
  letters past z (0.9.8za to 0.9.8zh) sort after z, and PEP 440 pre-releases such as 1.0a stay before
  1.0 (B6).
• "Upgrade to at least" could name a version that still had a vulnerability fixed on another release line (B7).
• PyPI names in an inventory purl column were not normalised, so OSV's fixes never matched (B8).
• The same Go fix appeared twice when sources disagreed on the v prefix (B19).
• The sdist now contains the test fixtures, so its tests run (B11).
• A malformed pinned hash (--trivy-sha256, --grype-sha256, verify --sha256) is an input error, exit 2 (B16).
• Placeholder versions such as 4.x, 4.1.X and 31.+ are refused in an inventory (B17).

0.6.1

Fixes from the 0.6.0 review: no report may look cleaner than the checks behind it.

Fixed

• Sources that did not run (CISA KEV, exploit indexes, EPSS, OSV malicious package data) were shown as green
  zeros, and Routine reasons said "no exploit indexed, EPSS below 0.1" even with --offline. They now show as
  "not checked" with the reason, Routine reasons name only the checks that ran, a warning says a zero means not
  checked, and the summary line adds not_checked=. Fix-date coverage no longer blames an ecosystem when dates
  were not looked up.
• A wrong or empty file given to --from-trivy-json or --from-grype-json (for example Grype JSON as Trivy, or
  {}) gave findings=0 and exit 0. It is now refused with exit 2, saying what the file looks like (an SBOM is
  named as such). UTF-16 files, as Windows PowerShell 5.1 redirection writes them, are read. An imported Trivy or
  Grype report for a different image than --image (another repository, tag or digest) gives a warning.
• An renv.lock scan whose OSV lookup failed reported green zeros and exit 0; with OSV its only source, it now
  stops with exit 1, as does an inventory (previously exit 2 there).
• An impossible date (--as-of 2026-02-30, or one in scanner, API or Debian and Go release data) crashed the
  run; it is now a usage error, or skipped in data.
• verify printed OK sha256 and then failed on a missing --cosign-identity; all options are checked first.

Security

• With --trivy-sha256 or --grype-sha256, the scanner's hash (and cosign signature, if given) is checked
  before the binary is executed at all; previously its --version ran first. Cosign now runs once per scanner,
  not twice. doctor records the hash before
  running --version and notes that the binary was not verified.

v0.6.0

Artifact integrity (JAR, wheel, sdist and npm .tgz checked against the registry's published checksum), a one-page executive summary for package inventories, and CycloneDX VEX export for Dependency-Track. See CHANGELOG.md.

v0.5.0

Assessor decisions carry between runs: --decisions reads an earlier findings.csv or OpenVEX, sets aside not_affected and fixed findings with the note as the reason, and writes openvex.json. README example and likelihood tables are now generated from the code. See CHANGELOG.md.

v0.4.0

Upgrade comparison for package inventories: what is still known to affect the minimum fix version and the latest stable release, with major-version warnings. --no-latest skips the latest-release lookup. Go fix versions carry the v prefix. See CHANGELOG.md.

v0.3.0

Package inventory input: pass a CSV of packages (ecosystem,name,version or purl, plus owner or system columns) to check what an organisation already uses against OSV, with a per-package packages.csv and report section. Malicious releases are flagged. See CHANGELOG.md.

v0.2.4

Malicious packages come first in reports: warnings at the top, a Malicious packages tile, a red header, and a per-package count. Adds examples/compromised-npm with six well-known compromised npm releases. See CHANGELOG.md.

v0.2.3

Compromised releases of trusted packages are flagged reliably: CWE-506 malware advisories count as malicious even without an OpenSSF MAL- entry (ua-parser-js 0.7.29, event-stream 3.3.6), npm scoped names are decoded, and MAL- entries merge with their GitHub advisory. See CHANGELOG.md.

v0.2.2

Report fixes for path scans without a repository: findings.csv always written, n/a instead of a green 0 when there is no release date, a Project health hint instead of empty rows, fewer false 'Check conditions', and a cleaner plan line. See CHANGELOG.md.