BOMHort 0.6.1

Container Images

All images are signed with cosign (keyless) and attested with SLSA provenance.

docker pull ghcr.io/seebom-labs/bomhort/api-gateway:0.6.1
docker pull ghcr.io/seebom-labs/bomhort/parsing-worker:0.6.1
docker pull ghcr.io/seebom-labs/bomhort/ingestion-watcher:0.6.1
docker pull ghcr.io/seebom-labs/bomhort/cve-refresher:0.6.1
docker pull ghcr.io/seebom-labs/bomhort/ui:0.6.1

Verify signatures:

cosign verify --certificate-identity-regexp="https://github.com/seebom-labs/bomhort" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/seebom-labs/bomhort/api-gateway:0.6.1

Helm Chart

helm install bomhort oci://ghcr.io/seebom-labs/bomhort/charts/bomhort --version 0.6.1

SBOM

An SPDX SBOM for this release is attached as bomhort-0.6.1.spdx.json.

What's Changed

📖 Documentation

• Helm chart and docs update after some migration problems by @koksay in #252

Full Changelog: v0.6.0...v0.6.1

BOMHort 0.6.0

BOMHort 0.6.0 - Rebrand, Global Search & Security Hardening

This is the release where SeeBOM becomes BOMHort. Alongside the rebrand it ships a brand-new faceted global search, fixes the Kubernetes health probes, and includes a full security-patch sweep (Go, UI, and dependencies). It is the last pre-1.0 minor with breaking infrastructure changes - a one-time migration is required for existing deployments.

---

Breaking Changes - SeeBOM -> BOMHort

The project was renamed from SeeBOM to BOMHort. The name was too easily confused with CBOM (Cryptography Bill of Materials) when spoken aloud. This is a breaking infrastructure change: the Helm chart, Kubernetes namespace, ClickHouse database, container image paths, and PVC/CHI names all changed.

Resource	Old (<= v0.5.0)	New (v0.6.0)
Helm chart	seebom	bomhort
Namespace	seebom	bomhort
ClickHouse database	seebom	bomhort
ClickHouse host (CHI)	chi-seebom-clickhouse-seebom-cluster-0-0	chi-bomhort-clickhouse-bomhort-cluster-0-0
Container images	ghcr.io/seebom-labs/seebom/*	ghcr.io/seebom-labs/bomhort/*
PVC	seebom-sbom-data	bomhort-sbom-data
UI auth entrypoint	15-seebom-auth.envsh	15-bomhort-auth.envsh

Migration path (existing users)

A built-in data-migration Job ships with the chart. It copies all ClickHouse tables from the old seebom instance to the new bomhort instance using ClickHouse's remote() function, as a Helm post-upgrade hook - no manual SQL, no re-ingest required.

helm upgrade --install bomhort ./deploy/helm/bomhort \
  -n bomhort --create-namespace \
  --set dataMigration.enabled=true \
  --set dataMigration.source.host=chi-seebom-clickhouse-seebom-cluster-0-0.seebom.svc.cluster.local \
  --set dataMigration.source.database=seebom \
  --set dataMigration.source.passwordSecret.secretName=clickhouse-migration-source \
  --set dataMigration.source.passwordSecret.key=password

• Do not delete the old seebom namespace until you've verified data integrity - the Job connects to the old ClickHouse cross-namespace.
• After verification, set dataMigration.enabled=false and remove the old release.
• The migration is idempotent: it skips tables that already contain data in the target.
• Full step-by-step guide: Deployment Guide -> section 11 "Upgrading from v0.5.0 or Earlier (SeeBOM -> BOMHort)".

Verified locally against a real v0.5.0-era seebom database (28 SBOMs, 1,525 vulnerabilities, 447 license records): all tables migrated 1:1 with zero failures.

---

New Features

Global Search (faceted, cross-entity)

• New endpoint GET /api/v1/search?q=&limit= - runs 4 facets concurrently: packages, projects, vulnerabilities, and licenses (ILIKE matching across sbom_packages, sboms, vulnerabilities, license_compliance)
• Navbar typeahead: 300 ms debounce, 2-char minimum, keyboard navigation, grouped result dropdown with deep links (package -> detail, project -> SBOM, vulnerability -> CVE Impact, license -> overview)
• Full results page at /search (reads ?q=, up to 50 hits per facet)
• CVE query-param alias: the CVE Impact page now accepts both ?vuln= and ?cve=
• API surface grows to 24 endpoints

---

Fixes

• Health probes actually registered (/livez, /readyz): both paths were whitelisted in auth middleware and documented, but no handlers were ever registered on the mux - so Kubernetes liveness/readiness probes returned 404. Now GET /livez (always 200) and GET /readyz (pings ClickHouse, 503 when the DB is unreachable) are wired up, with unit tests for healthy / DB-down / liveness cases.
• Global search ILIKE wildcard escaping - user input containing %/_ is escaped so it can't broaden the match.
• Missing Helm migration 012_add_cluster_column.up.sql added to the chart's migrations/ folder. The migrations ConfigMap globs migrations/*.sql, so a fresh install/upgrade previously never created the cluster column - breaking the API/workers and the new data-migration Job.
• make kind-up now points to ./local/setup.sh (the script was moved during the rebrand; the target still called a non-existent root ./setup.sh).
• Docs endpoint count corrected to a consistent 24 across README, ARCHITECTURE_PLAN, RELEASE.md, AGENTS.md, and example values.
• Docs SEO: keep canonical/sitemap URLs on HTTPS so Google indexes the docs site (dropped the --baseURL override that poisoned links with http://).
• Removed the post-install hook from the migration Job (simpler, ArgoCD-friendly lifecycle).
• Release workflow: lowercase the repository name for GHCR pushes so the 0.6.0 release build publishes correctly (#250).
• UI Docker build: bump the UI builder Node image to v22.23.1, fixing the v0.6.0 release build (#251).

---

Security

• Go 1.25.11 -> 1.25.12 - fixes GO-2026-5856 (Encrypted Client Hello privacy leak in crypto/tls). govulncheck ./... -> 0 affecting vulnerabilities.
• UI npm overrides:
  • esbuild ^0.28.1 - fixes GHSA-g7r4-m6w7-qqqr (dev-server arbitrary file read on Windows)
  • @hono/node-server ^2.0.10 - fixes GHSA-frvp-7c67-39w9 (path traversal) and GHSA-9mqv-5hh9-4cgg (WebSocket handshake memory-leak DoS)
  • npm audit (ui + docs) -> 0 vulnerabilities

---

Maintenance

Dependency Updates

• go directive: 1.25.11 -> 1.25.12
• github.com/protobom/protobom (#187, #220)
• github.com/minio/minio-go/v7 (#205)
• github.com/ClickHouse/clickhouse-go/v2 (#204)
• Angular / UI packages (Dependabot batches)

GitHub Actions Updates

• actions/checkout 6.0.2 -> 6.0.3 -> 7.0.0 (#186, #199)
• actions/setup-node 6.4.0 -> 7.0.0 (#232)
• actions/setup-go 6.4.0 -> 6.5.0 (#210)
• docker/login-action 4.2.0 -> 4.4.0 (#224)
• docker/build-push-action 7.2.0 -> 7.3.0 (#223)
• docker/setup-buildx-action 4.1.0 -> 4.2.0 (#219)
• softprops/action-gh-release 3.0.0 -> 3.0.1 -> 3.0.2 (#200, #230)
• github/codeql-action 4.36.0 -> 4.36.2 (#189); upload-sarif 4.36.2 -> 4.37.3 (#237)
• actions/attest-build-provenance 4.1.0 -> 4.1.1 (#207)
• azure/setup-helm 5.0.0 -> 5.0.1 (#208)

---

Documentation

• New section 11 migration guide (SeeBOM -> BOMHort) in the Deployment Guide
• Global search endpoint documented in the API reference
• Mobile optimization + leaner top navigation (#203)
• Google Search Console site verification for docs.bomhort.dev
• HTTPS canonical/sitemap fix for search indexing

---

Contributors

• @jeefy
• @koksay
• @mfahlandt
• @dependabot

New Contributors

• @jeefy made their first contribution - welcome aboard! Jeffrey built the new faceted global search feature (the cross-entity /api/v1/search endpoint, the navbar typeahead, and the full results page).

---

Container Images

All images are signed with cosign (keyless) and attested with SLSA provenance. Note the new bomhort image paths.

docker pull ghcr.io/seebom-labs/bomhort/api-gateway:0.6.0
docker pull ghcr.io/seebom-labs/bomhort/parsing-worker:0.6.0
docker pull ghcr.io/seebom-labs/bomhort/ingestion-watcher:0.6.0
docker pull ghcr.io/seebom-labs/bomhort/cve-refresher:0.6.0
docker pull ghcr.io/seebom-labs/bomhort/ui:0.6.0

Verify signatures:

cosign verify --certificate-identity-regexp="https://github.com/seebom-labs/bomhort" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/seebom-labs/bomhort/api-gateway:0.6.0

Helm Chart

helm install bomhort oci://ghcr.io/seebom-labs/bomhort/charts/bomhort --version 0.6.0

SBOM

An SPDX SBOM for this release is attached as bomhort-0.6.0.spdx.json.

---

Upgrade Notes

• Breaking (existing deployments): chart/namespace/database/image paths renamed - follow the migration steps above (or Deployment Guide section 11). New installs are unaffected.
• Schema: 012_add_cluster_column.up.sql is now shipped in the chart; fresh installs get the cluster column from the start.
• Health probes: if you previously worked around the /livez//readyz 404s, you can remove those workarounds - the probes now respond correctly.
• No application config changes are required beyond the rename; all v0.5.0 feature flags (AUTH_ENABLED, ui.enabled, USE_PROTOBOM, cluster assignment, etc.) carry over unchanged.

Full Changelog: v0.5.0...v0.6.0

v0.5.0

Multi-Cluster, Multi-Format & Project Views

This release transforms SeeBOM into a multi-cluster, multi-format SBOM platform with project-level grouping, optional API authentication, and significant Kubernetes deployment improvements. The API grows from 19 to 24 endpoints.

New Features

Project List View (#8)

• Projects page (/projects): Groups all SBOMs by project with aggregated package count, vulnerability count, and latest ingestion timestamp
• Depth-aware S3 path parsing: Automatically derives org/project (5+ path segments) or project (4 segments) from S3 source paths
• Document name fallback: Non-S3 SBOMs extract project name from the document_name field (text before -)
• Search with debounce: Instant filtering across all projects

Multi-Format SBOM Parsing (#55)

• CycloneDX JSON (1.0–1.7) — built-in parser with component, license, and dependency mapping
• Protobom backend (opt-in via USE_PROTOBOM=true) for maximum format coverage
• Format auto-detection: Any .json file is accepted — format is determined at parse time by probing JSON fields (spdxVersion, bomFormat, predicateType)

Multi-Cluster Support (#131, #132, #133)

• Cluster-aware data model: New cluster LowCardinality(String) column on all core tables (migration 012)
• Per-bucket cluster assignment: Set "cluster": "prod-eu" in S3_BUCKETS JSON config
• Cluster endpoints: GET /api/v1/clusters, GET /api/v1/clusters/{name}/stats, GET /api/v1/clusters/{name}/sboms
• Fully optional — single-instance deployments need no config changes

API Authentication (#134)

• Opt-in auth middleware: AUTH_ENABLED=true + SERVICE_TOKEN and/or API_KEYS
• Accepts Authorization: Bearer, X-Service-Token, and X-API-Key headers
• Timing-attack safe via crypto/subtle.ConstantTimeCompare
• UI auto-wiring: nginx proxy injects SERVICE_TOKEN upstream — browser never sees the secret
• Public paths (/healthz, /livez, /readyz, OPTIONS) always bypass auth

SBOM Download (#144)

• GET /api/v1/sboms/{id}/download — streams original SBOM file from S3 or local filesystem
• Content-Disposition header with original filename
• Download button in SBOM list and detail views

Kubernetes Enhancements

• Health probes (#137): /livez (liveness), /readyz (readiness with ClickHouse ping)
• Ingress template (#59): Controller-agnostic, supports any IngressClass (Envoy Gateway, Contour, ALB)
• Headless mode (#139): ui.enabled=false skips all UI Kubernetes resources

Ingestion Improvements

• SBOM_IGNORE_PREFIX env var (default _) to skip demo/example files during scanning
• S3 shared settings inheritance — JSON-configured buckets inherit S3_ENDPOINT, S3_REGION, etc.
• Generic .json file acceptance (format auto-detected at parse time)

---

Security

• Go 1.25.11 — fixes GO-2026-5037, GO-2026-5038, GO-2026-5039 (stdlib)
• golang.org/x/crypto v0.50.0 → v0.52.0, golang.org/x/net v0.53.0 → v0.55.0 — fixes 19 advisories (#149)
• Fuzz parser hardening — recover() from goccy/go-json panics on malformed input
• Example SBOMs updated — lodash 4.18.0, express 4.21.2 (clears Scorecard findings)
• .osv-scanner.toml added for example SBOM false positive suppression

---

Tests

• 5 new backend test functions (scanner ignore prefix, generic JSON, config shared settings)
• 3 new frontend tests (project list: create, load, search debounce)
• Total: 16 Go packages passing, 15 Angular spec files with 57 tests passing

---

Resolved Issues

#	Title
#8	Project List View — aggregated multi-version SBOM overview
#55	CycloneDX Support — parse CycloneDX 1.4+ SBOMs
#59	Expose API externally — Ingress, TLS, and public access
#131	Cluster-aware data model — support multi-cluster/fleet SBOM management
#132	Cluster listing endpoint — discover clusters with SBOM coverage
#133	Cluster-detail endpoints — per-cluster SBOM and vulnerability views
#134	API authentication — service token and API key support
#137	Enhanced health checks — readiness, liveness, and dependency checks
#139	Headless mode — API-only deployment without Angular UI
#144	Make SBOMs Downloadable
#149	fix(security): bump golang.org/x/* and qs to patch May 2026 advisories

---

Helm Chart Fixes (ArgoCD compatibility)

• Make batch job cleanup optional for argocd by - @koksay
• Remove lookup function from helm chart (not working with ArgoCD) by - @koksay
• Fix secret lookup issue in the helm chart by - @koksay

---

Maintenance

Dependency Updates

• go directive: 1.25.10 → 1.25.11 (fixes 3 stdlib CVEs)
• golang.org/x/crypto: v0.50.0 → v0.52.0
• golang.org/x/net: v0.53.0 → v0.55.0
• golang.org/x/sys: v0.43.0 → v0.45.0
• minio/minio-go/v7: bumped (#164)
• @angular/cli, build, cdk: 21.2.11 → 21.2.12 (#158, #159, #161)
• vitest: 4.1.6 → 4.1.7
• qs: 6.15.1 → 6.15.2 (fixes GHSA-q8mj-m7cp-5q26)
• Dockerfile: golang:1.24-alpine → golang:1.25-alpine

GitHub Actions Updates

• docker/login-action: 4.1.0 → 4.2.0 (#151)
• docker/setup-buildx-action: 4.0.0 → 4.1.0 (#150)
• docker/build-push-action: 7.1.0 → 7.2.0 (#152)
• github/codeql-action: 4.35.3 → 4.36.0 (#130)

CI/Build Fixes

• UI Dockerfile: --platform=$BUILDPLATFORM on builder stage (fixes ARM64 QEMU crash)
• Deploy-docs workflow: Go version pinned to 1.25.11

---

Documentation

• Complete API reference with all 24 endpoints (#146)
• Multi-format SBOM support documented across landing page, architecture, FAQ, and README
• Testing guide updated (366 test invocations across backend + frontend)
• Release checklist and major version policy added
• Architecture decisions #33–#36 added to decision log

---

Contributors

• @mfahlandt
• @koksay
• @dependabot

---

Container Images

All images are signed with cosign (keyless) and attested with SLSA provenance.

docker pull ghcr.io/seebom-labs/seebom/api-gateway:0.5.0
docker pull ghcr.io/seebom-labs/seebom/parsing-worker:0.5.0
docker pull ghcr.io/seebom-labs/seebom/ingestion-watcher:0.5.0
docker pull ghcr.io/seebom-labs/seebom/cve-refresher:0.5.0
docker pull ghcr.io/seebom-labs/seebom/ui:0.5.0

Verify signatures:

cosign verify --certificate-identity-regexp="https://github.com/seebom-labs/seebom" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/seebom-labs/seebom/api-gateway:0.5.0

Helm Chart

helm install seebom oci://ghcr.io/seebom-labs/seebom/charts/seebom --version 0.5.0

SBOM

An SPDX SBOM for this release is attached as seebom-0.5.0.spdx.json.

Upgrade Notes

• Schema migration: 012_add_cluster_column.up.sql runs automatically (adds cluster column with empty default — non-breaking)
• No breaking changes: All new features are opt-in or additive
• Drop-in upgrade: update container images and restart
• New Helm values available: apiGateway.auth.*, ingress.*, ui.enabled

What's Changed

• feat: add multi-format SBOM parsing (CycloneDX + protobom backend) by @mfahlandt
• feat(#131): cluster-aware data model with per-bucket assignment by @mfahlandt
• feat(#132,#133,#137): cluster endpoints + health probes by @mfahlandt
• feat(#134): optional API authentication with service token + API keys by @mfahlandt
• feat(#134): wire UI nginx proxy to inject SERVICE_TOKEN upstream by @mfahlandt
• feat(#139): headless mode (API-only deployment) by @mfahlandt
• feat: SBOM download endpoint (#144) by @mfahlandt
• feat(helm): add optional Ingress template (#59) by @mfahlandt
• feat: add Project List View (#8) by @mfahlandt
• feat: project list view with depth-aware grouping and multi-format docs by @mfahlandt
• fix(security): bump golang.org/x/* and qs to patch May 2026 advisories by @mfahlandt
• fix(spdx,vex): recover from goccy/go-json decoder panics on malformed input by @mfahlandt
• fix(docker): pin UI builder to host platform — fixes ARM64 QEMU crash by @mfahlandt
• fix(ci): bump Go to 1.25.11 in deploy-docs workflow by @mfahlandt
• chore: update Go to 1.25.11 — fixes 3 stdlib CVEs by @mfahlandt
• fix(helm): make batch job cleanup optional for ArgoCD by @korayoksay
• fix(helm): remove lookup function (not compatible with ArgoCD) by @korayoksay
• fix(helm): secret lookup issue by @korayoksay
• deps(go): bump github.com/minio/minio-go/v7 by @dependabot in #164
• deps(npm): bump @angular/build from 21.2.11 to 21.2.12 by @dependabot in #159
• deps(npm): bump @angular/cdk from 21.2.11 to 21.2.12 by @dependabot in #158
• deps(npm): bump @angular/cli from 21.2.11 to 21.2.12 by @dependabot in #161
• deps(actions): bump docker/login-action from 4.1.0 to 4.2.0 by @dependabot in #151
• deps(actions): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @dependabot in #150
• deps(actions): bump docker/build-push-action from 7.1.0 to 7.2.0 by @dependabot in #152
• deps(actions): bump github/codeql-action from 4.35.3 to 4.36.0 by @dependabot in #130
  Full Changelog: v0.4.0...v0.5.0

SeeBOM 0.4.3

Container Images

All images are signed with cosign (keyless) and attested with SLSA provenance.

docker pull ghcr.io/seebom-labs/seebom/api-gateway:0.4.3
docker pull ghcr.io/seebom-labs/seebom/parsing-worker:0.4.3
docker pull ghcr.io/seebom-labs/seebom/ingestion-watcher:0.4.3
docker pull ghcr.io/seebom-labs/seebom/cve-refresher:0.4.3
docker pull ghcr.io/seebom-labs/seebom/ui:0.4.3

Verify signatures:

cosign verify --certificate-identity-regexp="https://github.com/seebom-labs/seebom" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/seebom-labs/seebom/api-gateway:0.4.3

Helm Chart

helm install seebom oci://ghcr.io/seebom-labs/seebom/charts/seebom --version 0.4.3

SBOM

An SPDX SBOM for this release is attached as seebom-0.4.3.spdx.json.

What's Changed

Other Changes

• Make batch job cleanup optional for argocd by @koksay in #129

Full Changelog: v0.4.2...v0.4.3

SeeBOM 0.4.2

Container Images

All images are signed with cosign (keyless) and attested with SLSA provenance.

docker pull ghcr.io/seebom-labs/seebom/api-gateway:0.4.2
docker pull ghcr.io/seebom-labs/seebom/parsing-worker:0.4.2
docker pull ghcr.io/seebom-labs/seebom/ingestion-watcher:0.4.2
docker pull ghcr.io/seebom-labs/seebom/cve-refresher:0.4.2
docker pull ghcr.io/seebom-labs/seebom/ui:0.4.2

Verify signatures:

cosign verify --certificate-identity-regexp="https://github.com/seebom-labs/seebom" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/seebom-labs/seebom/api-gateway:0.4.2

Helm Chart

helm install seebom oci://ghcr.io/seebom-labs/seebom/charts/seebom --version 0.4.2

SBOM

An SPDX SBOM for this release is attached as seebom-0.4.2.spdx.json.

Full Changelog: v0.4.1...v0.4.2

SeeBOM 0.4.1

Container Images

All images are signed with cosign (keyless) and attested with SLSA provenance.

docker pull ghcr.io/seebom-labs/seebom/api-gateway:0.4.1
docker pull ghcr.io/seebom-labs/seebom/parsing-worker:0.4.1
docker pull ghcr.io/seebom-labs/seebom/ingestion-watcher:0.4.1
docker pull ghcr.io/seebom-labs/seebom/cve-refresher:0.4.1
docker pull ghcr.io/seebom-labs/seebom/ui:0.4.1

Verify signatures:

cosign verify --certificate-identity-regexp="https://github.com/seebom-labs/seebom" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/seebom-labs/seebom/api-gateway:0.4.1

Helm Chart

helm install seebom oci://ghcr.io/seebom-labs/seebom/charts/seebom --version 0.4.1

SBOM

An SPDX SBOM for this release is attached as seebom-0.4.1.spdx.json.

Full Changelog: v0.4.0...v0.4.1

SeeBOM 0.4.0

Package Search & Dependency Discovery

This release adds package search - a feature to quickly find any dependency by name across all ingested SBOMs and see every project that uses it. This is particularly useful for supply chain incident response, such as identifying exposure to compromised packages (e.g., the TanStack supply chain attack).

---

New Features

Package Search (fuzzy name matching)

• Search page (/package-search): Type any package name (e.g., @tanstack/query, golang.org/x/net) and instantly see all matching packages with project counts and version lists
• Debounced input with ILIKE fuzzy matching - partial names work (e.g., tanstack finds all @tanstack/* packages)
• Expandable results showing the first 5 projects per package inline

Package Detail (full project list)

• Detail page (/package-search/:name): Click any search result to see ALL projects using that specific package (paginated)
• Each row links directly to the SBOM detail page for drill-down into vulnerabilities and licenses

Backend

• GET /api/v1/packages/search?q=&page=&page_size= - Fuzzy ILIKE search, paginated, returns project count + versions + 5-project preview
• GET /api/v1/packages/detail?name=&page=&page_size= - All projects using a specific package, paginated with SBOM links

Tests

• 8 new Vitest tests for package search models (response parsing, pagination, URL encoding, sorting)
• Total: 14 test files, 53 frontend tests passing

Documentation

• Architecture docs updated (19 endpoints, 13 UI routes)
• Hugo docs site: architecture page + testing page updated with Angular/Vitest test inventory

---

Supply Chain Incident Response Example

To check if any of your ingested projects use a compromised TanStack package:

1. Open Pkg Search in the SeeBOM navbar
2. Search for tanstack
3. Review the results - each entry shows how many projects use it and which versions
4. Click "View all projects ->" for the full affected project list

---

Maintenance

Dependency Updates

• go directive: 1.25.9 -> 1.25.10 (fixes GO-2026-4918, GO-2026-4917)
• @angular/core, common, compiler, forms, platform-browser, router: 21.2.11 -> 21.2.13
• @angular/cdk: 21.2.7 -> 21.2.11
• @angular/build, cli: -> 21.2.11
• @angular/compiler-cli: 21.2.11 -> 21.2.13
• jsdom: 29.0.2 -> 29.1.1
• vitest: 4.1.4 -> 4.1.6

GitHub Actions Updates

• docker/build-push-action: v6.18.0 -> v7.1.0
• sigstore/cosign-installer: v3.8.2 -> v4.1.2
• actions/attest-build-provenance: v2.3.0 -> v4.1.0
• anchore/sbom-action: v0.20.0 -> v0.24.0
• actions/labeler: v6.0.1 -> v6.1.0

CI Fixes

• Fixed cosign v4 --bundle format for release artifact signing (replaces deprecated --output-signature/--output-certificate)

---

Contributors

• @mfahlandt
• @dependabot

---

Container Images

All images are signed with cosign (keyless) and attested with SLSA provenance.

docker pull ghcr.io/seebom-labs/seebom/api-gateway:0.4.0
docker pull ghcr.io/seebom-labs/seebom/parsing-worker:0.4.0
docker pull ghcr.io/seebom-labs/seebom/ingestion-watcher:0.4.0
docker pull ghcr.io/seebom-labs/seebom/cve-refresher:0.4.0
docker pull ghcr.io/seebom-labs/seebom/ui:0.4.0

Verify signatures:

cosign verify --certificate-identity-regexp="https://github.com/seebom-labs/seebom" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/seebom-labs/seebom/api-gateway:0.4.0

Helm Chart

helm install seebom oci://ghcr.io/seebom-labs/seebom/charts/seebom --version 0.4.0

SBOM

An SPDX SBOM for this release is attached as seebom-0.4.0.spdx.json.

Upgrade Notes

• No schema migration needed - queries the existing sbom_packages table
• No new dependencies added
• Drop-in upgrade: update container images and restart

What's Changed

• feat: add package search with fuzzy name matching and detail page by @mfahlandt in #126
• deps(npm): bump @angular/cdk from 21.2.7 to 21.2.10 in /ui by @dependabot in #124
• deps(npm): bump vitest from 4.1.4 to 4.1.6 in /ui by @dependabot in #122
• deps(actions): bump actions/labeler from 6.0.1 to 6.1.0 by @dependabot in #116
• deps: bump Go 1.25.10, Angular 21.2.13, CDK 21.2.11, jsdom 29.1.1, Actions by @mfahlandt in #127
• deps(actions): bump anchore/sbom-action from 0.20.0 to 0.24.0 by @dependabot in #115
• fix(ci): use cosign v4 --bundle format for release signing by @mfahlandt in #128

Full Changelog: v0.3.2...v0.4.0

SeeBOM 0.3.2

Container Images

All images are signed with cosign (keyless) and attested with SLSA provenance.

docker pull ghcr.io/seebom-labs/seebom/api-gateway:0.3.2
docker pull ghcr.io/seebom-labs/seebom/parsing-worker:0.3.2
docker pull ghcr.io/seebom-labs/seebom/ingestion-watcher:0.3.2
docker pull ghcr.io/seebom-labs/seebom/cve-refresher:0.3.2
docker pull ghcr.io/seebom-labs/seebom/ui:0.3.2

Verify signatures:

cosign verify --certificate-identity-regexp="https://github.com/seebom-labs/seebom" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/seebom-labs/seebom/api-gateway:0.3.2

Helm Chart

helm install seebom oci://ghcr.io/seebom-labs/seebom/charts/seebom --version 0.3.2

SBOM

An SPDX SBOM for this release is attached as seebom-0.3.2.spdx.json.

What's Changed

📖 Documentation

• security: attach provenance bundle, fix remaining CVEs, add pre-release scan docs by @mfahlandt in #109

🔧 Maintenance

• deps(actions): bump github/codeql-action from 3.28.16 to 4.35.3 by @dependabot[bot] in #97

Full Changelog: v0.3.1...v0.3.2

SeeBOM 0.3.1

Container Images

All images are signed with cosign (keyless) and attested with SLSA provenance.

docker pull ghcr.io/seebom-labs/seebom/api-gateway:0.3.1
docker pull ghcr.io/seebom-labs/seebom/parsing-worker:0.3.1
docker pull ghcr.io/seebom-labs/seebom/ingestion-watcher:0.3.1
docker pull ghcr.io/seebom-labs/seebom/cve-refresher:0.3.1
docker pull ghcr.io/seebom-labs/seebom/ui:0.3.1

Verify signatures:

cosign verify --certificate-identity-regexp="https://github.com/seebom-labs/seebom" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/seebom-labs/seebom/api-gateway:0.3.1

Helm Chart

helm install seebom oci://ghcr.io/seebom-labs/seebom/charts/seebom --version 0.3.1

SBOM

An SPDX SBOM for this release is attached as seebom-0.3.1.spdx.json.

What's Changed

🔧 Maintenance

• security: improve OpenSSF Scorecard (pin images, sign releases, fix vulns) by @mfahlandt in #106
• fix: correct mikebom binary path in release workflow by @mfahlandt in #107
• fix: revert to anchore/sbom-action for SBOM generation by @mfahlandt in #108

Full Changelog: v0.3.0...v0.3.1

SeeBOM 0.3.0

Container Images

All images are signed with cosign (keyless) and attested with SLSA provenance.

docker pull ghcr.io/seebom-labs/seebom/api-gateway:0.3.0
docker pull ghcr.io/seebom-labs/seebom/parsing-worker:0.3.0
docker pull ghcr.io/seebom-labs/seebom/ingestion-watcher:0.3.0
docker pull ghcr.io/seebom-labs/seebom/cve-refresher:0.3.0
docker pull ghcr.io/seebom-labs/seebom/ui:0.3.0

Verify signatures:

cosign verify --certificate-identity-regexp="https://github.com/seebom-labs/seebom" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/seebom-labs/seebom/api-gateway:0.3.0

Helm Chart

helm install seebom oci://ghcr.io/seebom-labs/seebom/charts/seebom --version 0.3.0

SBOM

An SPDX SBOM for this release is attached as seebom-0.3.0.spdx.json.

🚀 Features

Version Skew Detection Endpoint and UI (#37)

New feature to surface packages with inconsistent versions across projects, helping teams identify dependency drift and prioritize updates.

• Backend: New endpoint GET /api/v1/stats/version-skew with server-side pagination and ILIKE search filter
• Frontend: New /version-skew route with paginated table, expandable rows showing per-version project breakdown, and project links for drill-down
• Debounced search input for package name filtering

In-Toto Attestation Envelope Support (#19)

The SPDX parser now supports in-toto attestation envelopes where the SPDX content is wrapped inside the predicate field (common with Syft/BuildKit-generated container SBOMs).

GitHub License Resolution

Extended the license scanner to resolve unknown licenses via the GitHub API, including 50+ well-known Go module→GitHub repo mappings.

S3 Credentials in Secrets

Added the option to provide S3 credentials via Kubernetes Secrets for secure SBOM bucket access.

🐛 Bug Fixes

• fix: Show package names for permissive licenses in SBOM license breakdown (#66)
• fix: InToto envelope parsing bugfix (#65)
• fix: Dashboard number display formatting
• fix: Ingestion pipeline stability improvements (#19)
• fix: "Most used package by project" now shows real project names
• fix: SBOM search fixed to return correct results
• fix: Correct SHA hash for ossf/scorecard-action v2.4.3 (#102)
• fix: Link to GOVERNANCE.md from feature template

---

🔒 Security

OpenSSF Scorecard Integration (#101)

• Added Scorecard workflow (.github/workflows/scorecard.yml) for weekly supply-chain security assessment
• Results published as SARIF to GitHub Security tab
• Added OpenSSF badges to README

OpenSSF Baseline Compliance

• Added CONTRIBUTING.md (required by baseline)
• Added .github/dependabot.yml for automated dependency updates (Go, npm, Actions, Hugo)
• Added .github/CODEOWNERS for required review enforcement
• Added .github/workflows/codeql.yml for SAST scanning (Go + TypeScript)
• Pinned ALL GitHub Actions to commit SHAs across all workflows

---

📖 Documentation

• Add SEO improvements for docs.seebom.dev: robots.txt, Open Graph image, meta tags (#104)
• Add OpenSSF badges section to README

---

🔧 Maintenance

Dependency Updates

• github.com/ClickHouse/clickhouse-go/v2 bumped (3 updates)
• github.com/minio/minio-go/v7 bumped (2 updates)
• github.com/goccy/go-json bumped
• @angular/cdk 21.2.1 → 21.2.7
• @angular/cli 21.2.1 → 21.2.5
• @angular/build 21.2.1 → 21.2.5
• vitest 4.0.18 → 4.1.4
• jsdom 28.1.0 → 29.0.2

GitHub Actions Updates

• actions/checkout 4.2.2 → 6.0.2
• actions/setup-go 5.5.0 → 6.4.0
• actions/setup-node 4.4.0 → 6.4.0
• actions/upload-artifact 4.6.0 → 7.0.1
• actions/upload-pages-artifact 3.0.1 → 5.0.0
• actions/deploy-pages 4.0.5 → 5.0.0
• actions/configure-pages 5.0.0 → 6.0.0
• actions/labeler 5.0.0 → 6.0.1
• docker/login-action 3.4.0 → 4.1.0
• docker/setup-buildx-action 3.10.0 → 4.0.0
• github/codeql-action 3.28.16 → 4.35.1
• softprops/action-gh-release 2.2.2 → 3.0.0
• azure/setup-helm 4.3.0 → 5.0.0

---

📦 Upgrade Notes

• The new /api/v1/stats/version-skew endpoint is available immediately — no migration needed (queries existing sbom_packages table).
• If upgrading from v0.2.0, no schema migrations are required.
• The in-toto support may surface additional packages from previously unparseable SBOMs. Consider running make re-ingest to re-process all SBOMs.

---

🙏 Contributors

Thanks to everyone who contributed to this release!

• @mfahlandt
• @arewm

New Contributors

• @arewm made their first contribution in #39
• @dependabot[bot] made their first contribution in #21

---

Full Changelog: v0.2.0...v0.3.0