Skip to content

v0.4.0

Choose a tag to compare

View all tags
@tylerbutler-release-bot tylerbutler-release-bot released this 16 Jun 04:06
v0.4.0
2c0a6e6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.4.0 - 2026-06-16

Changed

  • SBOM output now emits canonical (lowercased) pkg:hex and pkg:github purls, recognises the SPDX licence identifiers supported by CycloneDX 1.6 (emitting license.id only for schema-valid identifiers), adds $schema, adds a primary-component identifier when available, omits empty component versions, and de-duplicates declared licences.
  • The spruce dependency now resolves to the published Hex package instead of a Git revision.

Fixed

  • Prevent update from silently corrupting gleam.toml when an existing allow/deny array line carries a trailing comment containing a quote, or when a key of the same name exists in another table. The array rewrite is now scoped to the [tools.licence_audit] table and fails loudly instead of writing a bogus value.
  • check --prod-only --vulns now restricts the vulnerability gate to production dependencies, so dev-only advisories no longer fail the gate or appear in output. The prod-only skipped-package summary now matches the rendered tree.
  • OSV vulnerability queries now follow next_page_token pagination with a page-count guard so vulnerabilities are no longer under-reported for heavily-affected packages without risking unbounded pagination, and CVSS 4.0 plus bare CVSS 2.0 vectors are now mapped to a severity bucket instead of Unknown.
  • The on-disk Hex cache no longer serves a stale publisher value indefinitely; cached enrichment entries now expire after 24 hours.
  • Report output no longer emits trailing whitespace on dependency rows in the default view, and tree column widths now match the rendered indentation when non-Hex intermediate dependencies are skipped.
  • The interactive update picker now restores the terminal (raw mode and cursor) on all exit paths including panics, redraws correctly when its help line or labels wrap on narrow terminals, and no longer loops silently on repeated read errors.
  • CI now regenerates the checked-in SBOM and fails when dist/sbom.json has drifted from the current source and lockfile.

Installation

Download the archive for your platform, extract it, and place licence_audit
somewhere on your PATH. The escript runs on any platform with a compatible
Erlang/OTP runtime.

Linux / macOS

curl -fsSL -o licence_audit.tar.gz \
  "https://github.com/tylerbutler/licence_audit/releases/download/v0.4.0/licence_audit-v0.4.0.tar.gz"
tar -xzf licence_audit.tar.gz --strip-components=1
chmod +x licence_audit
./licence_audit --help

Verify the download

# Checksums (run from the directory containing the artifacts)
sha256sum -c checksums.txt

# Build provenance + SBOM attestations for the archive...
gh attestation verify licence_audit-v0.4.0.tar.gz --repo tylerbutler/licence_audit

# ...or for the bare escript binary
gh attestation verify licence_audit --repo tylerbutler/licence_audit
Assets 8
Loading