v0.3.1

What's Changed

• build(deps): bump the github-actions group across 1 directory with 7 updates by @dependabot[bot] in #77
• build(deps-dev): bump the python-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #81
• ci: lock installed-wheel dependency checks by @dannysauer in #94
• fix: isolate release scanning from publication by @dannysauer in #105
• fix: harden untrusted input boundaries by @dannysauer in #106
• chore: add governance drift checks [skip release] by @dannysauer in #107
• fix: harden OSV and generated output boundaries by @dannysauer in #108

Full Changelog: v0.3.0...v0.3.1

v0.3.0

What's Changed

• chore: record CSAF checksum false positives by @dannysauer in #91
• feat: add native CSAF 2.0 VEX output by @dannysauer in #93

Full Changelog: v0.2.1...v0.3.0

v0.2.1

What's Changed

• docs: mark OpenVEX as released by @dannysauer in #85
• refactor: add format-neutral VEX document model [skip release] by @dannysauer in #89

Full Changelog: v0.2.0...v0.2.1

v0.2.0

What's Changed

• ci: reuse release validation workflow by @dannysauer in #80
• docs: rewrite project documentation by @dannysauer in #82
• feat: add native OpenVEX output by @dannysauer in #84

Full Changelog: v0.1.1...v0.2.0

v0.1.1

What's Changed

• ci: use app client id for release token by @dannysauer in #78
• fix: harden OSV URL and workflow input handling by @dannysauer in #79

Full Changelog: v0.1.0...v0.1.1

v0.1.0

What's Changed

• fix: handle OSV pagination and CLI PURL errors by @dannysauer in #31
• feat: generate CycloneDX VEX from SBOMs by @dannysauer in #32
• fix: require explicit public OSV opt-in by @dannysauer in #34
• docs: add agent and Python style guidance by @dannysauer in #36
• docs: address scorched-earth review findings by @dannysauer in #37
• docs: add ReadTheDocs-ready Sphinx build by @dannysauer in #39
• feat: generate VEX from local findings by @dannysauer in #41
• Define vulnerability source provider boundary by @dannysauer in #42
• fix: clarify unsupported CycloneDX XML SBOM input by @dannysauer in #44
• test: add schema-validated VEX golden fixtures by @dannysauer in #45
• docs: clarify security reporting policy by @dannysauer in #46
• docs: detail CLI contract reference by @dannysauer in #47
• ci: pin Poetry bootstrap installs by @dannysauer in #48
• ci: run scheduled repository security gates by @dannysauer in #49
• Add CycloneDX XML SBOM ingest by @dannysauer in #50
• Add installed CLI integration gate by @dannysauer in #52
• build(deps): bump the python-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #51
• build(deps): bump the github-actions group across 1 directory with 2 updates by @dependabot[bot] in #40
• docs: refresh usable workflow documentation by @dannysauer in #54
• feat: add vexy compatibility surface by @dannysauer in #55
• docs: move README badges below banner by @dannysauer in #56
• build: migrate packaging to uv and tag versions by @dannysauer in #57
• build(deps): bump the github-actions group with 2 updates by @dependabot[bot] in #58
• build(deps): bump the python-dependencies group with 3 updates by @dependabot[bot] in #59
• feat: support GitHub SBOM input by @dannysauer in #71
• docs: publish generated docs with pages by @dannysauer in #72
• docs: publish canonical documentation links by @dannysauer in #73
• docs: set canonical documentation URL by @dannysauer in #74
• ci: add automated release workflow by @dannysauer in #76

New Contributors

• @dannysauer made their first contribution in #31
• @dependabot[bot] made their first contribution in #51

Full Changelog: https://github.com/vexcalibur-dev/vexcalibur/commits/v0.1.0