v1.41.0

What's Changed

Added

• Import dependency identifications from another project. The "Import identifications from…" flow now has an Include dependencies option that previews the source project's declared dependency identifications in a dedicated table and imports them alongside file/component identifications. Dependencies are matched by manifest path and PURL, and honor the same Override previous work toggle.

Fixed

• Fixed a crash when importing identifications from another project.
• Fixed a crash when accepting a dependency that has no license.

Full Changelog: v1.40.1...v1.41.0

v1.40.1

What's Changed

Fixed

• Files with no-match or filtered status that were manually identified are now included in the CSV report.

Full Changelog: v1.40.0...v1.40.1

v1.40.0

What's Changed

Added

• The inventory usage options are now a configurable catalog. It ships with non-deletable defaults (file, snippet, pre-requisite, Dynamic library, Original code, Separate work, Other (Development tool)) and lets you create your own usages on the fly from the identify dialog and delete custom ones. Custom usages are saved in the workspace settings and shared across projects.
• Snippet compare view now has a match navigator that re centers both editors on the snippet match, with previous/next controls to step through files that have more than one snippet match.

Fixed

• Importing a result.json no longer fails when a result has an empty version or latest value.
• Snippet match highlight in the compare view no longer disappears after scrolling: the match is now marked on the scrollbar, and scrolling one editor keeps the other aligned on its corresponding match.
• Dependency scanning no longer crashes when a project is scanned with Include all file types enabled.

Full Changelog: v1.39.2...v1.40.0

v1.39.2

What's Changed

Fixed

• Fixed hidden settings on the new project screen

Changed

• Enhance UI for project creation settings
• Refactored ProjectSettings.tsx file

Full Changelog: v1.39.1...v1.39.2

v1.39.1

What's Changed

Fixed

• Fixed crash with "A JavaScript error occurred in the main process" at the end of scans and rescans when the project workspace lives on a network share (UNC/SMB). Transient sharing-violation errors during the final rename of result.json (e.g. antivirus scanning the temp file, slow file-handle release on SMB) are now absorbed by an exponential-backoff retry; persistent failures surface as a graceful "Scan Paused" message instead of crashing the main process. Each retry attempt is logged to project.log for diagnostics.

Full Changelog: v1.39.0...v1.39.1

v1.39.0

What's Changed

Added

• File viewer now caps loaded files at 250 MB and shows a distinct "File is too large to display"

Fixed

• Binary content now skips redundant hash computations for improved performance

Full Changelog: v1.38.0...v1.39.0

v1.38.0

What's Changed

Added

• New option in the project creation settings to unpack nested archives (archives inside archives). When enabled, the scanner descends up to 3 levels deep by default; you can adjust the depth from the same setting. Archives nested deeper than the configured limit are skipped and reported in the post-scan dialog.
• Rescan now reports which files were added, modified, or removed since the last scan, so you can see at a glance what changed.

Changed

• Smarter rescans: when a file's contents change between scans, its previous identification is automatically cleared so the new match can be reviewed. Previously, identifications could silently go stale if the underlying file changed.
• Redesigned the post-scan dialog as a two-pane layout (stage list on the left, messages on the right) that now also surfaces warnings and informational messages from each scan stage, with severity counts (errors, warnings, info) in the header.

Fixed

• Your identification and ignore decisions on dependencies are now preserved across rescans.
• Exporting and re-importing a project created from a .wfp winnowing file now works correctly. Previously the project source was mis-tagged on import, causing failures or incorrect behavior when reopening the project. Existing WFP projects that ended up mis-tagged on disk are automatically corrected the next time they are opened.
• Removing a project no longer produces a stream of log errors from the file logger still pointing at the deleted project directory.
• Migration logs now go to the project's own project.log instead of the shared workspace ws.log, making it easier to diagnose problems on a specific project.

Full Changelog: v1.37.1...v1.38.0

v1.37.1

What's Changed

Fixed

• AppImage sandbox wrapper causing launch failure over SSH by using ELECTRON_DISABLE_SANDBOX env var instead of --no-sandbox CLI flag
• Async race condition in appimage-fix.js afterPack hook
• Updated scanoss dependency to v0.38.1 which fixes decompression failing on Windows when scanning from UNC network paths

Full Changelog: v1.37.0...v1.37.1

v1.37.0

What's Changed

Added

• Added "Include all file types" option in project creation settings to bypass default file and folder filters

Changed

• Removed url, url_hash and release_date from mandatory string fields in scan result validation
• Updated vulnerability report links to dynamically resolve URL based on source (NVD or OSV)

Fixed

• Fixed dependency import from raw result files

Full Changelog: v1.36.0...v1.37.0

v1.36.0

What's Changed

Changed

• Upgraded scanoss.js SDK to v0.38.0 with support for Gradle Kotlin DSL (build.gradle.kts) and version catalog (libs.versions.toml) dependency parsing

Fixed

• Fixed AppImage sandbox permission crash on Linux (Ubuntu 24.04+) by re-enabling afterPack hook

Full Changelog: v1.35.1...v1.36.0