What's New

Added

components releases — list a component's releases for a PURL (version, date, notes, URL). --requirement narrows to a version or semver range; --limit / --offset paginate.
scanoss.SetLogger — one logger for every SDK package. pkg/filter also reports which rules were applied and every exclusion at Debug, so "why was my file skipped?" is now answerable.
wfp.Stream — fingerprint into an io.Writer, writing each file's block as it finishes instead of holding the whole WFP in memory. wfp.StreamFolder is Folder's collection with Stream's memory profile.
Scan.WFPReader — scan a WFP straight from an io.ReaderAt. Same as Scan.WFP, minus the requirement that it fit in memory.
sbom.Inventory.Add — one entry per component, merging evidence as it goes. When a component is both detected and declared, detected wins (scope and metadata).

A scan that fingerprinted nothing now fails and names the cause instead of looking like an empty success.
SkipDirs and friends add to the built-in exclusion lists instead of replacing them, and keep applying when the built-in flags are off.
Fingerprint failures are reported — directories handed to wfp.Files included — and advance the progress callback, so done finally reaches total.
scan --include deps no longer applies the scanning folder rules to the manifest stage, so manifests in otherwise-excluded folders are picked up.
Inverted size bounds (min > max) are warned about and ignored instead of silently excluding every file they matched.
DecorationPipeline.Run skips an unsupported service with a warning instead of discarding the whole run.
An unset Scope counts as detected on a merge, as the field always documented.
wfp.Files / wfp.Folder output and Result.Files are sorted by path, so multi-threaded runs of the wfp command are byte-reproducible.
The SDK writes nothing to stderr until you call SetLogger.

An enrichment failure no longer fails the command — it warns, still emits the base inventory, and exits 0.
Scan.Folder and Scan.Files spill the WFP to a temporary file and upload from it, so peak memory no longer grows with the tree you scan. Two consequences: the uploaded WFP's block order is now completion order and varies between runs (scan results are unaffected — only the byte layout), and Scan.WFP still takes the bytes you hand it.
The scan upload reads the WFP from any io.ReaderAt and chunk requests carry an explicit length, so they can be replayed on a retry. No public API change.
The combined WFP stream is built once, as bytes — the string-to-bytes conversion that duplicated the entire WFP at peak is gone.

scanpipeline streams the WFP through a temporary file. Result.WFP is gone — pass Options.WFPWriter to keep the stream as it's generated: a file to save it, a bytes.Buffer for the old behavior. Block order is completion order and varies between runs.
The filter profiles read the project's settings themselves: filter.Scanning(s), Fingerprinting(s), Dependencies(s). DefaultOptions is gone.
filter.Options renames: FolderDefaults / FileDefaults → BuiltinFolderRules / BuiltinFileRules, PreserveDependencyManifests → KeepManifests, SkipExtensions → SkipExts. New: SkipDirExts, SkipPatterns, SizeRules.
pkg/scanner and pkg/fingerprint/wfp merge into pkg/wfp: Folder collects and fingerprints; Files fingerprints a list as-is.
scanpipeline API: Build / Enrich give way to Enricher (which returns an error); Options.Filter / DependencySettings → ScanFilters / DependencyFilters; Result.ProcessErrors is now []error; new EnrichError.
DependencyParser.ParseFiles returns the per-file errors as map[string]error instead of printing them.
The Service values DecorationPipeline rejects are unexported.
pkg/output is now internal/output and no longer part of the public API.

Was	Now
scanner.GenerateWFP, wfp.GenerateFingerprint, wfp.CombineFingerprints, WorkerPool	wfp.Folder / wfp.Files
scanner.CollectFiles(WithOptions)	filter.Collect with a profile
the exported filter matcher machinery	the filter profiles above
settings.Resolve and the per-operation *Filter helpers	compose Detect(dir) then Load(path)
settings.GetSBOMData / SBOMData / FormatSBOMParam	pkg/postprocess, which applies BOM rules in v3
the manifest-format types and string helpers in dependencies/parsers	ParseFile
Config.Logger	scanoss.SetLogger
parsers.RemoveDuplicates, output.Writer.WriteFormat, DefaultPostSize, GRAM_WFP1, WINDOW_WFP1	—

Prebuilt binary: download the archive for your platform below, extract it,
and move scanoss-cli onto your PATH. On Linux (amd64):

tar xzf scanoss-cli-linux-amd64.tar.gz
sudo mv scanoss-cli /usr/local/bin/

Verify a download against checksums.txt:

sha256sum -c --ignore-missing checksums.txt

Go:

go install github.com/scanoss/scanoss.go/cmd/scanoss-cli@latest

See the README and
CLIENT_HELP.md
to get started.