Skip to content

v0.2.0

Choose a tag to compare

View all tags
@tylerbutler-release-bot tylerbutler-release-bot released this 05 Jun 22:16
v0.2.0
a197d13
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.2.0 - 2026-06-05

Added

  • sbom --vulns queries OSV.dev and embeds the results into the generated CycloneDX document as a vulnerabilities array. Each advisory becomes one entry with its id, an OSV source link, ratings (the raw CVSS vector and method when OSV reports one, otherwise the severity bucket), and an affects list referencing the affected components by bom-ref/purl — producing a single VEX-style document for downstream tooling (Dependency-Track, etc.). Requires network access, so it conflicts with --offline. The standalone vulns report is unchanged.
  • Added a --colour alias for --color

Changed

  • Improved licence report spacing between dependency groups and final log messages
  • List the names of skipped non-Hex packages in the audit summary

Installation

Download the archive for your platform, extract it, and place licence_audit
somewhere on your PATH. The escript runs on any platform with a compatible
Erlang/OTP runtime.

Linux / macOS

curl -fsSL -o licence_audit.tar.gz \
  "https://github.com/tylerbutler/licence_audit/releases/download/v0.2.0/licence_audit-v0.2.0.tar.gz"
tar -xzf licence_audit.tar.gz --strip-components=1
chmod +x licence_audit
./licence_audit --help

Verify the download

# Checksums (run from the directory containing the archives)
sha256sum -c checksums.txt

# Build provenance + SBOM attestations
gh attestation verify licence_audit-v0.2.0.tar.gz --repo tylerbutler/licence_audit
Assets 6
Loading