v0.8.0

What's New

Added

• components releases — list a component's releases for a PURL (version, date, notes, URL). --requirement narrows to a version or semver range; --limit / --offset paginate.
• scanoss.SetLogger — one logger for every SDK package. pkg/filter also reports which rules were applied and every exclusion at Debug, so "why was my file skipped?" is now answerable.
• wfp.Stream — fingerprint into an io.Writer, writing each file's block as it finishes instead of holding the whole WFP in memory. wfp.StreamFolder is Folder's collection with Stream's memory profile.
• Scan.WFPReader — scan a WFP straight from an io.ReaderAt. Same as Scan.WFP, minus the requirement that it fit in memory.
• sbom.Inventory.Add — one entry per component, merging evidence as it goes. When a component is both detected and declared, detected wins (scope and metadata).

Fixed

• A scan that fingerprinted nothing now fails and names the cause instead of looking like an empty success.
• SkipDirs and friends add to the built-in exclusion lists instead of replacing them, and keep applying when the built-in flags are off.
• Fingerprint failures are reported — directories handed to wfp.Files included — and advance the progress callback, so done finally reaches total.
• scan --include deps no longer applies the scanning folder rules to the manifest stage, so manifests in otherwise-excluded folders are picked up.
• Inverted size bounds (min > max) are warned about and ignored instead of silently excluding every file they matched.
• DecorationPipeline.Run skips an unsupported service with a warning instead of discarding the whole run.
• An unset Scope counts as detected on a merge, as the field always documented.
• wfp.Files / wfp.Folder output and Result.Files are sorted by path, so multi-threaded runs of the wfp command are byte-reproducible.
• The SDK writes nothing to stderr until you call SetLogger.

Changed

• An enrichment failure no longer fails the command — it warns, still emits the base inventory, and exits 0.
• Scan.Folder and Scan.Files spill the WFP to a temporary file and upload from it, so peak memory no longer grows with the tree you scan. Two consequences: the uploaded WFP's block order is now completion order and varies between runs (scan results are unaffected — only the byte layout), and Scan.WFP still takes the bytes you hand it.
• The scan upload reads the WFP from any io.ReaderAt and chunk requests carry an explicit length, so they can be replayed on a retry. No public API change.
• The combined WFP stream is built once, as bytes — the string-to-bytes conversion that duplicated the entire WFP at peak is gone.

Breaking changes

• scanpipeline streams the WFP through a temporary file. Result.WFP is gone — pass Options.WFPWriter to keep the stream as it's generated: a file to save it, a bytes.Buffer for the old behavior. Block order is completion order and varies between runs.
• The filter profiles read the project's settings themselves: filter.Scanning(s), Fingerprinting(s), Dependencies(s). DefaultOptions is gone.
• filter.Options renames: FolderDefaults / FileDefaults → BuiltinFolderRules / BuiltinFileRules, PreserveDependencyManifests → KeepManifests, SkipExtensions → SkipExts. New: SkipDirExts, SkipPatterns, SizeRules.
• pkg/scanner and pkg/fingerprint/wfp merge into pkg/wfp: Folder collects and fingerprints; Files fingerprints a list as-is.
• scanpipeline API: Build / Enrich give way to Enricher (which returns an error); Options.Filter / DependencySettings → ScanFilters / DependencyFilters; Result.ProcessErrors is now []error; new EnrichError.
• DependencyParser.ParseFiles returns the per-file errors as map[string]error instead of printing them.
• The Service values DecorationPipeline rejects are unexported.
• pkg/output is now internal/output and no longer part of the public API.

Removed

Was	Now
scanner.GenerateWFP, wfp.GenerateFingerprint, wfp.CombineFingerprints, WorkerPool	wfp.Folder / wfp.Files
scanner.CollectFiles(WithOptions)	filter.Collect with a profile
the exported filter matcher machinery	the filter profiles above
settings.Resolve and the per-operation *Filter helpers	compose Detect(dir) then Load(path)
settings.GetSBOMData / SBOMData / FormatSBOMParam	pkg/postprocess, which applies BOM rules in v3
the manifest-format types and string helpers in dependencies/parsers	ParseFile
Config.Logger	scanoss.SetLogger
parsers.RemoveDuplicates, output.Writer.WriteFormat, DefaultPostSize, GRAM_WFP1, WINDOW_WFP1	—

Install

Prebuilt binary: download the archive for your platform below, extract it,
and move scanoss-cli onto your PATH. On Linux (amd64):

tar xzf scanoss-cli-linux-amd64.tar.gz
sudo mv scanoss-cli /usr/local/bin/

Verify a download against checksums.txt:

sha256sum -c --ignore-missing checksums.txt

Go:

go install github.com/scanoss/scanoss.go/cmd/scanoss-cli@latest

See the README and
CLIENT_HELP.md
to get started.

v0.7.0

What's New

Fixed

• Transient network failures no longer abort an entire scan. Network errors, truncated responses, and 429/5xx status codes are now retried with exponential backoff. A server-provided Retry-After header continues to take precedence.
• Chunks already held by the server are treated as successful. A 409 RANGE_CONFLICT response indicates the upload completed and no longer fails the scan.
• Incomplete enrichment is now reported. Components left without data by a failed request are named on stderr, preventing a partial result from being mistaken for a complete one.

Added

• Config.RetryBackoffBase — the initial backoff interval, doubled on each subsequent attempt. Defaults to 250ms.

Changed

• Config.MaxRetries now applies to all transient failures, not only to 429/503 responses carrying Retry-After. A negative value disables retries, consistent with Timeout.

Breaking changes

• Config.MaxRetryAfter has been renamed to Config.MaxServerRetryWait.
• ChunkError.Index has been replaced by ChunkError.Purls, which identifies the components left without data.
• Decoration pipeline results are now typed per layer. PipelineResult.Services is replaced by Licenses, Cryptography, Geoprovenance, and Vulnerabilities, each of type *Layer[T]. Unreadable responses are collected in Errors.
• The scansource adapters no longer carry a From suffix: FromScanResult becomes Inventory, LicensesFrom becomes Licenses, and so on. LicenseKey becomes Key.

Install

Prebuilt binary: download the archive for your platform below, extract it,
and move scanoss-cli onto your PATH. On Linux (amd64):

tar xzf scanoss-cli-linux-amd64.tar.gz
sudo mv scanoss-cli /usr/local/bin/

Verify a download against checksums.txt:

sha256sum -c --ignore-missing checksums.txt

Go:

go install github.com/scanoss/scanoss.go/cmd/scanoss-cli@latest

See the README and
CLIENT_HELP.md
to get started.

v0.6.0

What's New

Fixed

• Better match accuracy — rank, release_date and artifact_name now reach the inventory. Before, two components matching the same file looked equally strong.
• No more hangs — requests time out after 120s (Config.Timeout, negative to disable).
• Fewer false errors — any 2xx counts as success; 201 and 204 used to fail.

Breaking

• New client constructor — scanoss.New(Config) replaces scanoss.Option and the With* options. Proxy, CACertFile, InsecureTLS and Timeout are now fields. NewHTTPClient and HTTPClientOptions are private.
• WithScanIDNotify is a ScanOption — pass it to the scan call, not the client.
• pkg/api and pkg/batch removed

Install

Prebuilt binary: download the archive for your platform below, extract it,
and move scanoss-cli onto your PATH. On Linux (amd64):

tar xzf scanoss-cli-linux-amd64.tar.gz
sudo mv scanoss-cli /usr/local/bin/

Verify a download against checksums.txt:

sha256sum -c --ignore-missing checksums.txt

Go:

go install github.com/scanoss/scanoss.go/cmd/scanoss-cli@latest

See the README and
CLIENT_HELP.md
to get started.

v0.5.0

Changelog

New

• Replace rules now work. If your settings file says "swap component A for
  component B," scan results are now actually rewritten to show component B.
  Before, the rule was sent to the server but the results still showed the old
  component. Rules can target a package, a file path, or both — when more than
  one rule matches, the most specific one is used.
  (The license field in replace rules isn't supported yet.)

Fixed

• Progress bars no longer go backwards or finish before reaching 100%.
• Scans no longer hang forever when the session expires — you now get an error.
• Running a command without its required input now fails clearly instead of
  quietly reporting success. (scanoss-cli scan with an empty folder variable
  used to look like it worked.)
• Fixed a crash when the scan pipeline was started without a client.
• Enrichment steps now appear as soon as they start, not after the first result.

Changed

• Scan status is checked every 2 seconds instead of 5, so progress updates faster.
• --default-filters is replaced by two clearer flags: --all-extensions and
  --all-folders.

Breaking changes

Progress reporting was redesigned around reporters instead of callbacks:

• Removed: Progress, ProgressFunc, WithProgress, PipelineProgress,
  DecorationPipeline.OnProgress, .Snapshot
• Use instead: ScanReporter / DecorationReporter via WithScanReporter /
  WithDecorationReporter; decoration methods now take opts ...DecorateOption
• pkg/scanpipeline reports all layers through Options.OnProgress, replacing
  OnCollect, OnFingerprint and OnDependencies
• pkg/scanpipeline no longer parses --include; Layer, Set and
  ParseLayers moved to the CLI. Options now takes Services and
  SourceDeclared; Build and Enrich signatures changed
• filter.Options.Defaults split into FileDefaults and FolderDefaults

Install

Prebuilt binary: download the archive for your platform below, extract it,
and move scanoss-cli onto your PATH. On Linux (amd64):

tar xzf scanoss-cli-linux-amd64.tar.gz
sudo mv scanoss-cli /usr/local/bin/

Verify a download against checksums.txt:

sha256sum -c --ignore-missing checksums.txt

Go:

go install github.com/scanoss/scanoss.go/cmd/scanoss-cli@latest

See the README and
CLIENT_HELP.md
to get started.

v0.4.0

Changelog

Added

• config — store api-url, api-key, proxy and ca-cert in
  ~/.scanoss/settings.json instead of repeating flags: config set, get, list, unset,
  path. The API key is never displayed. Every setting resolves as
  flag > SCANOSS_<KEY> > config file > default.
• --proxy and --ca-cert on every command that reaches the API. --proxy overrides
  HTTP_PROXY/HTTPS_PROXY for one run and honours NO_PROXY; --ca-cert adds a PEM file's
  certificates to the system pool, verification still on. PAC is not supported.
• scanoss.NewHTTPClient builds an *http.Client with the same proxy and CA settings.
• --min-size / --max-size on scan and wfp, and --all-hidden to include dotfiles
  (version-control metadata stays excluded).
• --default-filters, --gitignore and --settings on wfp, so it collects files exactly
  the way scan does. --settings on dependencies likewise.
• SDK: filter.FingerprintOptions, filter.DependencyOptions, filter.HiddenSource,
  settings.FingerprintFilter(), settings.DependencyFilter().

Changed

• Files under 100 bytes are no longer skipped.
• pkg/filter is the single source of filtering rules, applied once during collection. The
  fingerprint layer no longer filters, so GenerateWFP and GenerateFingerprint fingerprint
  whatever they are given — a caller passing a list that did not come from collection now gets
  every file. This is the only change here that fails silently rather than at compile time.
• SDK, breaking — removed: wfp.ShouldSkipFile, filter.NewMatcher,
  filter.DefaultSkippedDirs, filter.IngestOptions, and filter.Defaults'
  MinSize/MaxSize. Use filter.Build(filter.DefaultSource(filter.StdDefaults())) plus
  manifests.Is to compose rules; filter.CommonSkippedDirs /ScanOnlySkippedDirs
  /DependencyOnlySkippedDirs; filter.DependencyOptions; and filter.Options.MinSize/MaxSize.
  Callers starting from DefaultOptions/ScanOptions need no change.

Fixed

• Version-control metadata is never collected. .git could be fingerprinted and uploaded when
  the built-in filters and the hidden rule were both off — including .git/config, which can carry
  credentials.
• License identifiers are validated against the SPDX list. A non-canonical id is normalised;
  an unrecognised one, or a malformed expression, becomes a declared LicenseRef instead of
  producing an SBOM that fails validation.
• SBOM packages carry the component name, not the full PURL. CycloneDX gained a
  serialNumber, and the tool version moved to its own field.
• results returns the same inventory as scan, so a resumed scan can be rendered and
  converted. It accepts --format and --include.
• --default-filters=false really disables them — extension-skipped files were dropped anyway
  by a second, uncounted filter in the fingerprint layer.
• dependencies honours scanoss.json and reports what it filtered; scan --include deps
  and dependencies no longer disagree over examples/. A skip rule now also overrules the
  manifest exemption, so excluding a manifest by name works.
• --min-size/--max-size were ignored together with --default-filters=false.
• Zero-byte files and symbolic links are no longer fingerprinted, and the raw format emits
  "components": [] rather than null when nothing matched.

Install

Prebuilt binary: download the archive for your platform below, extract it,
and move scanoss-cli onto your PATH. On Linux (amd64):

tar xzf scanoss-cli-linux-amd64.tar.gz
sudo mv scanoss-cli /usr/local/bin/

Verify a download against checksums.txt:

sha256sum -c --ignore-missing checksums.txt

Go:

go install github.com/scanoss/scanoss.go/cmd/scanoss-cli@latest

See the README and
CLIENT_HELP.md
to get started.

v0.3.0

Changelog

Changed

• BREAKING — the raw inventory format now reports matched line ranges as structured objects
  ({"start_line": 82, "end_line": 209}) instead of "82-209" strings, matching the shape the scan
  engine already returns. schema_version is 2.0; a 1.0 document carrying string ranges no
  longer parses. CycloneDX and SPDX output is unchanged.

Install

Prebuilt binary: download the archive for your platform below, extract it,
and move scanoss-cli onto your PATH. On Linux (amd64):

tar xzf scanoss-cli-linux-amd64.tar.gz
sudo mv scanoss-cli /usr/local/bin/

Verify a download against checksums.txt:

sha256sum -c --ignore-missing checksums.txt

Go:

go install github.com/scanoss/scanoss.go/cmd/scanoss-cli@latest

See the README and
CLIENT_HELP.md
to get started.

v0.2.0

Changelog

• Renamed the CLI binary from scanoss to scanoss-cli. The go install path is now
  go install github.com/scanoss/scanoss.go/cmd/scanoss-cli@latest.

Install

Prebuilt binary: download the archive for your platform below, extract it,
and move scanoss-cli onto your PATH. On Linux (amd64):

tar xzf scanoss-cli-linux-amd64.tar.gz
sudo mv scanoss-cli /usr/local/bin/

Verify a download against checksums.txt:

sha256sum -c --ignore-missing checksums.txt

Go:

go install github.com/scanoss/scanoss.go/cmd/scanoss-cli@latest

See the README and
CLIENT_HELP.md
to get started.

v0.1.0

Changelog

Added

• scan <path> — fingerprint a file or folder (WFP winnowing), upload to the SCANOSS v3 batch
  API in parallel chunks, and poll to completion; an interrupted scan resumes with
  scanoss results <scan-id>. --format raw|spdx|cyclonedx selects the output and
  --include deps,vulns,licenses,crypto,geo opts into extra layers, narrowed to what the chosen
  format can render (a layer it can't represent is skipped with an up-front notice).
  scan wfp <file> scans a pre-generated WFP.
• wfp <path> — generate WFP fingerprints only, without uploading.
• results <scan-id> — resume or poll a previous scan by its id.
• sbom <input> — offline: produce an SBOM from a scanoss raw inventory, or convert between
  CycloneDX 1.7 and SPDX 2.3 (input format detected from content). No API calls; best-effort (data
  a target can't represent — e.g. SPDX vulnerabilities — is dropped with a warning).
• enrich <input> — online: decorate an existing raw inventory, CycloneDX, or SPDX with the
  purl-keyed layers vulns/licenses/crypto/geo, with no source tree or re-scan (re-runnable
  to refresh). The output format defaults to the input's; --format converts in the same pass.
• dependencies [path] — parse local manifests, or query direct/transitive dependencies for a
  PURL.
• attributions [sbom] — attribution text from an SBOM file or a PURL.
• Decoration commands over the SCANOSS Services API v3: vulnerabilities, licenses,
  cryptography, geoprovenance, copyright, and components.
• raw output (default) — a neutral inventory in a versioned envelope (schema_version +
  metadata + components + vulnerabilities): detected and declared components in one
  components list tagged by scope, per-component layers (licenses, cryptography,
  geoprovenance) inline, and vulnerabilities as a flat top-level list. Each component records
  where it came from in evidence — scanned files that matched (match_type file/snippet) or
  the manifest that declared it (match_type declared). A bare scan (no --include) makes no
  decoration calls.
• SBOM export — SPDX 2.3 and CycloneDX 1.7, with the SCANOSS url_hash preserved (an SPDX
  OTHER external reference / a CycloneDX scanoss:url_hash property) and vulnerability detail
  (CVSS score/vector/method, CWE, EPSS).
• Declared dependencies (--include deps) are sourced directly from the project's manifests
  (package.json, go.mod, …) and decorated alongside the scan matches — no dependency-resolution
  round trip.
• File filtering — built-in defaults, .gitignore, and scanoss.json rules; client-side
  bom.remove.
• Progress & status output — live progress bars for every phase (fingerprint, upload, server,
  dependency parsing, each enrichment layer); status notices with icons and color (⚠ warnings,
  ℹ info, ✓ success) on an interactive terminal (Windows 10+ included), disabled when
  piped/redirected or NO_COLOR is set; a Results written to <path> line for --output.
• -v, --verbose — structured log/slog debug output on stderr (the scan flow, each API
  request with method/URL/status/duration, fingerprinting, and decoration).
• Go SDK (pkg/scanoss) — scan and decoration services with a parallel decoration pipeline;
  pkg/scanpipeline assembles a neutral sbom.Inventory, and pkg/sbom reads and writes
  CycloneDX and SPDX (with WithTool/WithAuthor/WithTimestamp document-metadata options).
• C shared library (libscanoss) with Node.js and Python bindings.

Install

Prebuilt binary: download the archive for your platform below, extract it,
and move scanoss onto your PATH. On Linux (amd64):

tar xzf scanoss-linux-amd64.tar.gz
sudo mv scanoss /usr/local/bin/

Verify a download against checksums.txt:

sha256sum -c --ignore-missing checksums.txt

Go:

go install github.com/scanoss/scanoss.go/cmd/scanoss@latest

See the README and
CLIENT_HELP.md
to get started.