BOMHort 0.6.0

BOMHort 0.6.0 - Rebrand, Global Search & Security Hardening

This is the release where SeeBOM becomes BOMHort. Alongside the rebrand it ships a brand-new faceted global search, fixes the Kubernetes health probes, and includes a full security-patch sweep (Go, UI, and dependencies). It is the last pre-1.0 minor with breaking infrastructure changes - a one-time migration is required for existing deployments.

---

Breaking Changes - SeeBOM -> BOMHort

The project was renamed from SeeBOM to BOMHort. The name was too easily confused with CBOM (Cryptography Bill of Materials) when spoken aloud. This is a breaking infrastructure change: the Helm chart, Kubernetes namespace, ClickHouse database, container image paths, and PVC/CHI names all changed.

Resource	Old (<= v0.5.0)	New (v0.6.0)
Helm chart	seebom	bomhort
Namespace	seebom	bomhort
ClickHouse database	seebom	bomhort
ClickHouse host (CHI)	chi-seebom-clickhouse-seebom-cluster-0-0	chi-bomhort-clickhouse-bomhort-cluster-0-0
Container images	ghcr.io/seebom-labs/seebom/*	ghcr.io/seebom-labs/bomhort/*
PVC	seebom-sbom-data	bomhort-sbom-data
UI auth entrypoint	15-seebom-auth.envsh	15-bomhort-auth.envsh

Migration path (existing users)

A built-in data-migration Job ships with the chart. It copies all ClickHouse tables from the old seebom instance to the new bomhort instance using ClickHouse's remote() function, as a Helm post-upgrade hook - no manual SQL, no re-ingest required.

helm upgrade --install bomhort ./deploy/helm/bomhort \
  -n bomhort --create-namespace \
  --set dataMigration.enabled=true \
  --set dataMigration.source.host=chi-seebom-clickhouse-seebom-cluster-0-0.seebom.svc.cluster.local \
  --set dataMigration.source.database=seebom \
  --set dataMigration.source.passwordSecret.secretName=clickhouse-migration-source \
  --set dataMigration.source.passwordSecret.key=password

• Do not delete the old seebom namespace until you've verified data integrity - the Job connects to the old ClickHouse cross-namespace.
• After verification, set dataMigration.enabled=false and remove the old release.
• The migration is idempotent: it skips tables that already contain data in the target.
• Full step-by-step guide: Deployment Guide -> section 11 "Upgrading from v0.5.0 or Earlier (SeeBOM -> BOMHort)".

Verified locally against a real v0.5.0-era seebom database (28 SBOMs, 1,525 vulnerabilities, 447 license records): all tables migrated 1:1 with zero failures.

---

New Features

Global Search (faceted, cross-entity)

• New endpoint GET /api/v1/search?q=&limit= - runs 4 facets concurrently: packages, projects, vulnerabilities, and licenses (ILIKE matching across sbom_packages, sboms, vulnerabilities, license_compliance)
• Navbar typeahead: 300 ms debounce, 2-char minimum, keyboard navigation, grouped result dropdown with deep links (package -> detail, project -> SBOM, vulnerability -> CVE Impact, license -> overview)
• Full results page at /search (reads ?q=, up to 50 hits per facet)
• CVE query-param alias: the CVE Impact page now accepts both ?vuln= and ?cve=
• API surface grows to 24 endpoints

---

Fixes

• Health probes actually registered (/livez, /readyz): both paths were whitelisted in auth middleware and documented, but no handlers were ever registered on the mux - so Kubernetes liveness/readiness probes returned 404. Now GET /livez (always 200) and GET /readyz (pings ClickHouse, 503 when the DB is unreachable) are wired up, with unit tests for healthy / DB-down / liveness cases.
• Global search ILIKE wildcard escaping - user input containing %/_ is escaped so it can't broaden the match.
• Missing Helm migration 012_add_cluster_column.up.sql added to the chart's migrations/ folder. The migrations ConfigMap globs migrations/*.sql, so a fresh install/upgrade previously never created the cluster column - breaking the API/workers and the new data-migration Job.
• make kind-up now points to ./local/setup.sh (the script was moved during the rebrand; the target still called a non-existent root ./setup.sh).
• Docs endpoint count corrected to a consistent 24 across README, ARCHITECTURE_PLAN, RELEASE.md, AGENTS.md, and example values.
• Docs SEO: keep canonical/sitemap URLs on HTTPS so Google indexes the docs site (dropped the --baseURL override that poisoned links with http://).
• Removed the post-install hook from the migration Job (simpler, ArgoCD-friendly lifecycle).
• Release workflow: lowercase the repository name for GHCR pushes so the 0.6.0 release build publishes correctly (#250).
• UI Docker build: bump the UI builder Node image to v22.23.1, fixing the v0.6.0 release build (#251).

---

Security

• Go 1.25.11 -> 1.25.12 - fixes GO-2026-5856 (Encrypted Client Hello privacy leak in crypto/tls). govulncheck ./... -> 0 affecting vulnerabilities.
• UI npm overrides:
  • esbuild ^0.28.1 - fixes GHSA-g7r4-m6w7-qqqr (dev-server arbitrary file read on Windows)
  • @hono/node-server ^2.0.10 - fixes GHSA-frvp-7c67-39w9 (path traversal) and GHSA-9mqv-5hh9-4cgg (WebSocket handshake memory-leak DoS)
  • npm audit (ui + docs) -> 0 vulnerabilities

---

Maintenance

Dependency Updates

• go directive: 1.25.11 -> 1.25.12
• github.com/protobom/protobom (#187, #220)
• github.com/minio/minio-go/v7 (#205)
• github.com/ClickHouse/clickhouse-go/v2 (#204)
• Angular / UI packages (Dependabot batches)

GitHub Actions Updates

• actions/checkout 6.0.2 -> 6.0.3 -> 7.0.0 (#186, #199)
• actions/setup-node 6.4.0 -> 7.0.0 (#232)
• actions/setup-go 6.4.0 -> 6.5.0 (#210)
• docker/login-action 4.2.0 -> 4.4.0 (#224)
• docker/build-push-action 7.2.0 -> 7.3.0 (#223)
• docker/setup-buildx-action 4.1.0 -> 4.2.0 (#219)
• softprops/action-gh-release 3.0.0 -> 3.0.1 -> 3.0.2 (#200, #230)
• github/codeql-action 4.36.0 -> 4.36.2 (#189); upload-sarif 4.36.2 -> 4.37.3 (#237)
• actions/attest-build-provenance 4.1.0 -> 4.1.1 (#207)
• azure/setup-helm 5.0.0 -> 5.0.1 (#208)

---

Documentation

• New section 11 migration guide (SeeBOM -> BOMHort) in the Deployment Guide
• Global search endpoint documented in the API reference
• Mobile optimization + leaner top navigation (#203)
• Google Search Console site verification for docs.bomhort.dev
• HTTPS canonical/sitemap fix for search indexing

---

Contributors

• @jeefy
• @koksay
• @mfahlandt
• @dependabot

New Contributors

• @jeefy made their first contribution - welcome aboard! Jeffrey built the new faceted global search feature (the cross-entity /api/v1/search endpoint, the navbar typeahead, and the full results page).

---

Container Images

All images are signed with cosign (keyless) and attested with SLSA provenance. Note the new bomhort image paths.

docker pull ghcr.io/seebom-labs/bomhort/api-gateway:0.6.0
docker pull ghcr.io/seebom-labs/bomhort/parsing-worker:0.6.0
docker pull ghcr.io/seebom-labs/bomhort/ingestion-watcher:0.6.0
docker pull ghcr.io/seebom-labs/bomhort/cve-refresher:0.6.0
docker pull ghcr.io/seebom-labs/bomhort/ui:0.6.0

Verify signatures:

cosign verify --certificate-identity-regexp="https://github.com/seebom-labs/bomhort" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/seebom-labs/bomhort/api-gateway:0.6.0

Helm Chart

helm install bomhort oci://ghcr.io/seebom-labs/bomhort/charts/bomhort --version 0.6.0

SBOM

An SPDX SBOM for this release is attached as bomhort-0.6.0.spdx.json.

---

Upgrade Notes

• Breaking (existing deployments): chart/namespace/database/image paths renamed - follow the migration steps above (or Deployment Guide section 11). New installs are unaffected.
• Schema: 012_add_cluster_column.up.sql is now shipped in the chart; fresh installs get the cluster column from the start.
• Health probes: if you previously worked around the /livez//readyz 404s, you can remove those workarounds - the probes now respond correctly.
• No application config changes are required beyond the rename; all v0.5.0 feature flags (AUTH_ENABLED, ui.enabled, USE_PROTOBOM, cluster assignment, etc.) carry over unchanged.

Full Changelog: v0.5.0...v0.6.0