v0.3.0

v0.3.0 - 2026-06-08

Changed

• Migrate terminal styling in the colour and progress modules to the spruce terminal-UI kit (added as a git dependency); spruce wraps the same gleam_community_ansi styling, so output is unchanged. Dropped the now-transitive direct gleam_community_ansi dependency.
• Replace the glam pretty-printer with plain string building for the licence report tree and vulnerability reports (output unchanged), and drop the glam dependency.
• Render the licence report section titles, vulnerability reports, and the vulnerability check gate with spruce styling (bold/dim text and rounded boxes); styling is colour-gated so plain-text output is unaffected.
• Upgrade the tomlet dependency to 1.1.2 and replace the local TOML array-editing workarounds with tomlet's native value accessors (table_keys, as_string, set_array); generated output is unchanged.

Security

• Release attestations now also cover the bare licence_audit escript and the checksums.txt manifest (in addition to the archives), and the SBOM attestation is extended to the bare binary; install instructions document verifying the binary directly.

Installation

Download the archive for your platform, extract it, and place licence_audit
somewhere on your PATH. The escript runs on any platform with a compatible
Erlang/OTP runtime.

Linux / macOS

curl -fsSL -o licence_audit.tar.gz \
  "https://github.com/tylerbutler/licence_audit/releases/download/v0.3.0/licence_audit-v0.3.0.tar.gz"
tar -xzf licence_audit.tar.gz --strip-components=1
chmod +x licence_audit
./licence_audit --help

Verify the download

# Checksums (run from the directory containing the artifacts)
sha256sum -c checksums.txt

# Build provenance + SBOM attestations for the archive...
gh attestation verify licence_audit-v0.3.0.tar.gz --repo tylerbutler/licence_audit

# ...or for the bare escript binary
gh attestation verify licence_audit --repo tylerbutler/licence_audit