v1.1.0

1.1.0 (2026-09-08)

Bug Fixes

• tests: do not fail the harness when a run exits before reading stdin (c0a0723)

Features

• coverage: read Go coverage profiles (b4c1b3c)
• coverage: read Istanbul coverage maps (f594706)
• coverage: support Clover, and stop it being mistaken for Cobertura (a85daf1)
• quality: read ESLint's json output (feea6c8)
• sarif: write SARIF, so any linter can reach GitHub code scanning (6d0087f)
• sbom: read and write CycloneDX JSON (26e7d2c)
• sbom: read and write CycloneDX XML (488857c)
• sbom: read and write SPDX 3 JSON-LD (adc44b1)
• sbom: read and write SPDX JSON, completing CycloneDX ↔ SPDX (96e0469)
• security: read Trivy JSON, and give the pivot a component (96444d8)
• security: write GitLab dependency-scanning and container-scanning reports (b94ef2b)
• security: write GitLab SAST reports, so any SAST tool feeds the dashboard (ef59799)
• tests: read go test -json (a63476c)
• tests: read TAP (ac9a7e7)
• tests: read TRX, so dotnet test results reach any platform (a0d8c4e)