v0.8.0

v0.8.0 - 2026-07-19

Added

• Added a notices command that generates a release-ready THIRD_PARTY_NOTICES-style file from locked dependencies, grouping shared licence text while preserving package-specific NOTICE and COPYING content. It supports GitHub, Codeberg, and GitLab sources, falls back to canonical SPDX text when needed, caches results across runs, and writes to stdout or --output PATH; use --no-cache to bypass caching.
• Added -v as an alias for the global --verbose flag and detailed notices progress showing per-package source selection, licence-file discovery, and processing steps.

Installation

Download the self-contained archive for your platform, extract it, and place
licence_audit somewhere on your PATH. These Queso-built executables bundle
the Erlang runtime, so Erlang/OTP does not need to be installed on the target
machine.

Windows ARM64 (aarch64-windows) is not published yet because Queso requires an
explicit Windows ARM64 ERTS and there is no trustworthy pinned prebuilt OTP 28
archive for that target.

Linux x86_64 (glibc)

curl -fsSL -o licence_audit.tar.gz \
  "https://github.com/tylerbutler/licence_audit/releases/download/v0.8.0/licence_audit-v0.8.0-x86_64-linux-glibc.tar.gz"
tar -xzf licence_audit.tar.gz --strip-components=1
chmod +x licence_audit
./licence_audit --help

Windows x86_64

Invoke-WebRequest `
  -Uri "https://github.com/tylerbutler/licence_audit/releases/download/v0.8.0/licence_audit-v0.8.0-x86_64-windows.zip" `
  -OutFile licence_audit.zip
Expand-Archive licence_audit.zip -DestinationPath .
.\licence_audit.exe --help

Escript compatibility install

The release also keeps the original escript archive and bare licence_audit
escript. The escript runs on any platform with Erlang/OTP 28.x or newer.

curl -fsSL -o licence_audit-escript.tar.gz \
  "https://github.com/tylerbutler/licence_audit/releases/download/v0.8.0/licence_audit-v0.8.0.tar.gz"
tar -xzf licence_audit-escript.tar.gz --strip-components=1
chmod +x licence_audit
./licence_audit --help

With mise

If you use mise, install this release with the
github: provider:

mise use -g "github:tylerbutler/licence_audit@v0.8.0[asset_pattern=licence_audit,bin=licence_audit]"

The asset_pattern=licence_audit option selects the bare escript asset, avoiding
ambiguity with the per-arch Queso archives. For a project-local install, omit -g.
This mise path uses the escript and still needs Erlang/OTP 28.x or newer on your PATH; if you manage Erlang
with mise, install it too:

mise use -g erlang@28

Verify the download

# Checksums (run from the directory containing the artifacts)
sha256sum -c checksums.txt

# Build provenance + SBOM attestations for a native archive...
gh attestation verify licence_audit-v0.8.0-x86_64-linux-glibc.tar.gz --repo tylerbutler/licence_audit

# ...or for the bare escript binary
gh attestation verify licence_audit --repo tylerbutler/licence_audit

v0.7.0

v0.7.0 - 2026-07-18

Added

• Added self-contained release archives for Linux (glibc and musl), macOS, and Windows x86_64 alongside the existing escript artifacts.
• SBOM generation now enriches git-sourced dependencies with descriptions, licences, and repository links, and warns when package metadata is unavailable.

Fixed

• SBOM generation now preserves cached package metadata during transient Hex failures and warns when metadata is stale or unavailable.
• Network-backed commands no longer incur repeated delays when IPv6 is unavailable; they fall back to IPv4 after one failed attempt and emit a warning.

v0.6.0

v0.6.0 - 2026-06-19

Changed

• Updated tomlet to add support for TOML 1.1.

Installation

Download the archive for your platform, extract it, and place licence_audit
somewhere on your PATH. The escript runs on any platform with a compatible
Erlang/OTP runtime.

With mise

If you use mise, install this release with the
github: provider:

mise use -g "github:tylerbutler/licence_audit@v0.6.0"

For a project-local install, omit -g. The escript still needs Erlang/OTP 28.x
or newer on your PATH; if you manage Erlang with mise, install it too:

mise use -g erlang@28

Linux / macOS

curl -fsSL -o licence_audit.tar.gz \
  "https://github.com/tylerbutler/licence_audit/releases/download/v0.6.0/licence_audit-v0.6.0.tar.gz"
tar -xzf licence_audit.tar.gz --strip-components=1
chmod +x licence_audit
./licence_audit --help

Verify the download

# Checksums (run from the directory containing the artifacts)
sha256sum -c checksums.txt

# Build provenance + SBOM attestations for the archive...
gh attestation verify licence_audit-v0.6.0.tar.gz --repo tylerbutler/licence_audit

# ...or for the bare escript binary
gh attestation verify licence_audit --repo tylerbutler/licence_audit

v0.5.0

v0.5.0 - 2026-06-17

Changed

• Direct dependencies on envoy, gleam_regexp, and youid were removed in favor of standard string parsing and small Erlang FFI helpers.
• The sbom command now writes formatted JSON to output files.

Installation

Download the archive for your platform, extract it, and place licence_audit
somewhere on your PATH. The escript runs on any platform with a compatible
Erlang/OTP runtime.

With mise

If you use mise, install this release with the
github: provider:

mise use -g "github:tylerbutler/licence_audit@v0.5.0"

For a project-local install, omit -g. The escript still needs Erlang/OTP 28.x
or newer on your PATH; if you manage Erlang with mise, install it too:

mise use -g erlang@28

Linux / macOS

curl -fsSL -o licence_audit.tar.gz \
  "https://github.com/tylerbutler/licence_audit/releases/download/v0.5.0/licence_audit-v0.5.0.tar.gz"
tar -xzf licence_audit.tar.gz --strip-components=1
chmod +x licence_audit
./licence_audit --help

Verify the download

# Checksums (run from the directory containing the artifacts)
sha256sum -c checksums.txt

# Build provenance + SBOM attestations for the archive...
gh attestation verify licence_audit-v0.5.0.tar.gz --repo tylerbutler/licence_audit

# ...or for the bare escript binary
gh attestation verify licence_audit --repo tylerbutler/licence_audit

v0.4.0

v0.4.0 - 2026-06-16

Changed

• SBOM output now emits canonical (lowercased) pkg:hex and pkg:github purls, recognises the SPDX licence identifiers supported by CycloneDX 1.6 (emitting license.id only for schema-valid identifiers), adds $schema, adds a primary-component identifier when available, omits empty component versions, and de-duplicates declared licences.
• The spruce dependency now resolves to the published Hex package instead of a Git revision.

Fixed

• Prevent update from silently corrupting gleam.toml when an existing allow/deny array line carries a trailing comment containing a quote, or when a key of the same name exists in another table. The array rewrite is now scoped to the [tools.licence_audit] table and fails loudly instead of writing a bogus value.
• check --prod-only --vulns now restricts the vulnerability gate to production dependencies, so dev-only advisories no longer fail the gate or appear in output. The prod-only skipped-package summary now matches the rendered tree.
• OSV vulnerability queries now follow next_page_token pagination with a page-count guard so vulnerabilities are no longer under-reported for heavily-affected packages without risking unbounded pagination, and CVSS 4.0 plus bare CVSS 2.0 vectors are now mapped to a severity bucket instead of Unknown.
• The on-disk Hex cache no longer serves a stale publisher value indefinitely; cached enrichment entries now expire after 24 hours.
• Report output no longer emits trailing whitespace on dependency rows in the default view, and tree column widths now match the rendered indentation when non-Hex intermediate dependencies are skipped.
• The interactive update picker now restores the terminal (raw mode and cursor) on all exit paths including panics, redraws correctly when its help line or labels wrap on narrow terminals, and no longer loops silently on repeated read errors.
• CI now regenerates the checked-in SBOM and fails when dist/sbom.json has drifted from the current source and lockfile.

Installation

Download the archive for your platform, extract it, and place licence_audit
somewhere on your PATH. The escript runs on any platform with a compatible
Erlang/OTP runtime.

Linux / macOS

curl -fsSL -o licence_audit.tar.gz \
  "https://github.com/tylerbutler/licence_audit/releases/download/v0.4.0/licence_audit-v0.4.0.tar.gz"
tar -xzf licence_audit.tar.gz --strip-components=1
chmod +x licence_audit
./licence_audit --help

Verify the download

# Checksums (run from the directory containing the artifacts)
sha256sum -c checksums.txt

# Build provenance + SBOM attestations for the archive...
gh attestation verify licence_audit-v0.4.0.tar.gz --repo tylerbutler/licence_audit

# ...or for the bare escript binary
gh attestation verify licence_audit --repo tylerbutler/licence_audit

v0.3.0

v0.3.0 - 2026-06-08

Changed

• Migrate terminal styling in the colour and progress modules to the spruce terminal-UI kit (added as a git dependency); spruce wraps the same gleam_community_ansi styling, so output is unchanged. Dropped the now-transitive direct gleam_community_ansi dependency.
• Replace the glam pretty-printer with plain string building for the licence report tree and vulnerability reports (output unchanged), and drop the glam dependency.
• Render the licence report section titles, vulnerability reports, and the vulnerability check gate with spruce styling (bold/dim text and rounded boxes); styling is colour-gated so plain-text output is unaffected.
• Upgrade the tomlet dependency to 1.1.2 and replace the local TOML array-editing workarounds with tomlet's native value accessors (table_keys, as_string, set_array); generated output is unchanged.

Security

• Release attestations now also cover the bare licence_audit escript and the checksums.txt manifest (in addition to the archives), and the SBOM attestation is extended to the bare binary; install instructions document verifying the binary directly.

Installation

Download the archive for your platform, extract it, and place licence_audit
somewhere on your PATH. The escript runs on any platform with a compatible
Erlang/OTP runtime.

Linux / macOS

curl -fsSL -o licence_audit.tar.gz \
  "https://github.com/tylerbutler/licence_audit/releases/download/v0.3.0/licence_audit-v0.3.0.tar.gz"
tar -xzf licence_audit.tar.gz --strip-components=1
chmod +x licence_audit
./licence_audit --help

Verify the download

# Checksums (run from the directory containing the artifacts)
sha256sum -c checksums.txt

# Build provenance + SBOM attestations for the archive...
gh attestation verify licence_audit-v0.3.0.tar.gz --repo tylerbutler/licence_audit

# ...or for the bare escript binary
gh attestation verify licence_audit --repo tylerbutler/licence_audit

v0.2.0

v0.2.0 - 2026-06-05

Added

• sbom --vulns queries OSV.dev and embeds the results into the generated CycloneDX document as a vulnerabilities array. Each advisory becomes one entry with its id, an OSV source link, ratings (the raw CVSS vector and method when OSV reports one, otherwise the severity bucket), and an affects list referencing the affected components by bom-ref/purl — producing a single VEX-style document for downstream tooling (Dependency-Track, etc.). Requires network access, so it conflicts with --offline. The standalone vulns report is unchanged.
• Added a --colour alias for --color

Changed

• Improved licence report spacing between dependency groups and final log messages
• List the names of skipped non-Hex packages in the audit summary

Installation

Download the archive for your platform, extract it, and place licence_audit
somewhere on your PATH. The escript runs on any platform with a compatible
Erlang/OTP runtime.

Linux / macOS

curl -fsSL -o licence_audit.tar.gz \
  "https://github.com/tylerbutler/licence_audit/releases/download/v0.2.0/licence_audit-v0.2.0.tar.gz"
tar -xzf licence_audit.tar.gz --strip-components=1
chmod +x licence_audit
./licence_audit --help

Verify the download

# Checksums (run from the directory containing the archives)
sha256sum -c checksums.txt

# Build provenance + SBOM attestations
gh attestation verify licence_audit-v0.2.0.tar.gz --repo tylerbutler/licence_audit