Skip to content

SeeBOM 0.4.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 14 May 01:26
v0.4.0
This tag was signed with the committer’s verified signature.
mfahlandt Mario
GPG key ID: 8342B3E5F174341A
Verified
Learn about vigilant mode.
48dfb61

Package Search & Dependency Discovery

This release adds package search - a feature to quickly find any dependency by name across all ingested SBOMs and see every project that uses it. This is particularly useful for supply chain incident response, such as identifying exposure to compromised packages (e.g., the TanStack supply chain attack).

New Features

Package Search (fuzzy name matching)

  • Search page (/package-search): Type any package name (e.g., @tanstack/query, golang.org/x/net) and instantly see all matching packages with project counts and version lists
  • Debounced input with ILIKE fuzzy matching - partial names work (e.g., tanstack finds all @tanstack/* packages)
  • Expandable results showing the first 5 projects per package inline

Package Detail (full project list)

  • Detail page (/package-search/:name): Click any search result to see ALL projects using that specific package (paginated)
  • Each row links directly to the SBOM detail page for drill-down into vulnerabilities and licenses

Backend

  • GET /api/v1/packages/search?q=&page=&page_size= - Fuzzy ILIKE search, paginated, returns project count + versions + 5-project preview
  • GET /api/v1/packages/detail?name=&page=&page_size= - All projects using a specific package, paginated with SBOM links

Tests

  • 8 new Vitest tests for package search models (response parsing, pagination, URL encoding, sorting)
  • Total: 14 test files, 53 frontend tests passing

Documentation

  • Architecture docs updated (19 endpoints, 13 UI routes)
  • Hugo docs site: architecture page + testing page updated with Angular/Vitest test inventory

Supply Chain Incident Response Example

To check if any of your ingested projects use a compromised TanStack package:

  1. Open Pkg Search in the SeeBOM navbar
  2. Search for tanstack
  3. Review the results - each entry shows how many projects use it and which versions
  4. Click "View all projects ->" for the full affected project list

Maintenance

Dependency Updates

  • go directive: 1.25.9 -> 1.25.10 (fixes GO-2026-4918, GO-2026-4917)
  • @angular/core, common, compiler, forms, platform-browser, router: 21.2.11 -> 21.2.13
  • @angular/cdk: 21.2.7 -> 21.2.11
  • @angular/build, cli: -> 21.2.11
  • @angular/compiler-cli: 21.2.11 -> 21.2.13
  • jsdom: 29.0.2 -> 29.1.1
  • vitest: 4.1.4 -> 4.1.6

GitHub Actions Updates

  • docker/build-push-action: v6.18.0 -> v7.1.0
  • sigstore/cosign-installer: v3.8.2 -> v4.1.2
  • actions/attest-build-provenance: v2.3.0 -> v4.1.0
  • anchore/sbom-action: v0.20.0 -> v0.24.0
  • actions/labeler: v6.0.1 -> v6.1.0

CI Fixes

  • Fixed cosign v4 --bundle format for release artifact signing (replaces deprecated --output-signature/--output-certificate)

Contributors

Container Images

All images are signed with cosign (keyless) and attested with SLSA provenance.

docker pull ghcr.io/seebom-labs/seebom/api-gateway:0.4.0
docker pull ghcr.io/seebom-labs/seebom/parsing-worker:0.4.0
docker pull ghcr.io/seebom-labs/seebom/ingestion-watcher:0.4.0
docker pull ghcr.io/seebom-labs/seebom/cve-refresher:0.4.0
docker pull ghcr.io/seebom-labs/seebom/ui:0.4.0

Verify signatures:

cosign verify --certificate-identity-regexp="https://github.com/seebom-labs/seebom" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/seebom-labs/seebom/api-gateway:0.4.0

Helm Chart

helm install seebom oci://ghcr.io/seebom-labs/seebom/charts/seebom --version 0.4.0

SBOM

An SPDX SBOM for this release is attached as seebom-0.4.0.spdx.json.

Upgrade Notes

  • No schema migration needed - queries the existing sbom_packages table
  • No new dependencies added
  • Drop-in upgrade: update container images and restart

What's Changed

  • feat: add package search with fuzzy name matching and detail page by @mfahlandt in #126
  • deps(npm): bump @angular/cdk from 21.2.7 to 21.2.10 in /ui by @dependabot in #124
  • deps(npm): bump vitest from 4.1.4 to 4.1.6 in /ui by @dependabot in #122
  • deps(actions): bump actions/labeler from 6.0.1 to 6.1.0 by @dependabot in #116
  • deps: bump Go 1.25.10, Angular 21.2.13, CDK 21.2.11, jsdom 29.1.1, Actions by @mfahlandt in #127
  • deps(actions): bump anchore/sbom-action from 0.20.0 to 0.24.0 by @dependabot in #115
  • fix(ci): use cosign v4 --bundle format for release signing by @mfahlandt in #128

Full Changelog: v0.3.2...v0.4.0

Contributors

mfahlandt and dependabot
Assets 5
Loading