v26.8.0

What's Changed

• chore(deps): cover bun, uv, and docker in Dependabot config by @vpetersson in #284
• chore(deps): bump python from 3.13-slim-trixie to 3.14-slim-trixie in the docker group by @dependabot[bot] in #286
• chore(deps-dev): bump ruff from 0.12.12 to 0.15.22 in the uv group by @dependabot[bot] in #288
• chore(deps): bump the github-actions group with 3 updates by @dependabot[bot] in #287
• chore(deps): exclude test-data fixtures from Dependabot scans by @vpetersson in #289
• chore(deps): bump the uv group with 3 updates by @dependabot[bot] in #302
• chore(deps): bump the github-actions group with 5 updates by @dependabot[bot] in #301
• Isolate wizard discovery tests from the developer's git config by @vpetersson-bot in #305
• Fix arm64 image build (Rust toolchain for pipdeptree) and build images on PRs by @vpetersson-bot in #304
• docs: correct SPDX version coverage and document SPEC_VERSION by @vpetersson-bot in #306
• Reject spec versions nothing can generate at config time by @vpetersson-bot in #307
• Recognize Cargo.toml so lockless Rust crates are discovered by @vpetersson-bot in #310
• chore(deps): bump docker/login-action from 4.4.0 to 4.6.0 in the github-actions group by @dependabot[bot] in #308
• chore(deps): bump the uv group with 5 updates by @dependabot[bot] in #309
• fix(wizard): handle plan limits, workspace scoping, and clean errors by @vpetersson in #303
• Authenticate the license-database release lookup by @vpetersson-bot in #314
• Add Reload to the wizard's Components screen by @vpetersson-bot in #315
• Stop shipping bomctl by @vpetersson-bot in #318
• Stop shipping dev dependencies in the published image by @vpetersson-bot in #316
• chore(deps): bump the github-actions group with 2 updates by @dependabot[bot] in #338
• chore(deps): bump the uv group with 2 updates by @dependabot[bot] in #337
• Fetch every non-Python tool instead of baking it in: 515MB image to 106MB, and stop silent SBOM quality downgrades by @vpetersson-bot in #320
• Cache enrichment lookups across runs for every source, and fix ClearlyDefined extraction by @vpetersson-bot in #339
• Treat SOURCE_DIR as an input source, and document it as a last resort by @vpetersson-bot in #340
• feat: submodule SBOM support — discovery annotation + attach-or-backfill by @vpetersson-bot in #341
• Serve ClearlyDefined through clearly-cached by @vpetersson-bot in #343
• Stop using ClearlyDefined's copyright parties as the supplier by @vpetersson-bot in #344
• Say 3.11 everywhere the project already requires it by @vpetersson-bot in #345
• Let makeAggregateBom see the reactor it aggregates by @vpetersson-bot in #347
• Don't walk into symlinked directories during discovery by @vpetersson-bot in #346
• Keep looking when a generator describes nothing by @vpetersson-bot in #348
• Decline a PEP 621 manifest instead of failing on it by @vpetersson-bot in #349
• Fix two failures found in telemetry, and stop three sources of noise by @vpetersson-bot in #350
• Keep the wizard's action row on screen at every terminal size by @vpetersson-bot in #342
• Ask a source only when it can fill something missing by @vpetersson-bot in #355
• Tick the shallowest lockfiles, not every one of them by @vpetersson-bot in #354
• Recognise .NET project files, not just the lock file nobody writes by @vpetersson-bot in #353
• Stop describing every file in a container as a component by @vpetersson-bot in #352
• Say what Package.swift is missing instead of writing an empty SBOM by @vpetersson-bot in #351
• Drop the Rust stage and C build deps the image no longer needs by @vpetersson-bot in #356
• Recognise Haskell, Erlang and Clojure by @vpetersson-bot in #357
• Stop unharvested coordinates disabling ClearlyDefined by @vpetersson-bot in #358
• Re-source the lifecycle data from vendors, and notice when it goes stale by @vpetersson-bot in #359
• Wire up the PHP bundle, so a composer.json is not silently empty by @vpetersson-bot in #360
• Exclude tests/test-data from Dependabot for github-actions too by @vpetersson-bot in #362
• chore(deps): bump the github-actions group with 2 updates by @dependabot[bot] in #366
• Make bundle materialisation safe between processes by @vpetersson-bot in #361
• Fall back to the pinned build tool when a project's wrapper cannot run by @vpetersson-bot in #363
• Tell sbomify when a release is a prerelease by @vpetersson-bot in #369
• Take the component version from the release tag, and offer to normalise it by @vpetersson-bot in #368
• Don't default to a lockfile that describes the tooling by @vpetersson-bot in #367
• Tell Composer what version this package is by @vpetersson-bot in #371
• Fix three env-var resolution defects that surface outside Docker by @vpetersson-bot in #370
• Let a caller put Go's caches outside the attested bundle by @vpetersson-bot in #373
• chore: persist agent memory into repo docs and skills by @vpetersson in #293
• chore(deps): bump the uv group, and move the Dockerfile pin with it by @vpetersson-bot in #375
• Stop the root component identifying itself as the mount point by @vpetersson-bot in #374
• Let generators read a workspace they do not own by @vpetersson-bot in #372
• Resolve manifests rather than refuse them, and disclose when versions were inferred by @vpetersson-bot in #377
• chore(deps): cryptography 50.0.0 and Debian security updates at build by @aurangzaib048 in #378
• chore(deps): bump the github-actions group with 2 updates by @dependabot[bot] in #380
• chore(deps): bump the uv group, and move the Dockerfile pin with it by @vpetersson-bot in #381
• chore(deps): bump the uv group across 1 directory with 8 updates by @dependabot[bot] in #379
• Fix three failures found in the Sentry sweep by @vpetersson-bot in #385
• Bump version to 26.8.0 by @vpetersson-bot in #386

New Contributors

• @vpetersson-bot made their first contribution in #305

Full Changelog: v26.7.0...v26.8.0