All pull requests

Pull requests

• fix: preserve quoted args when deferring to tagged install script

  #5363·wagoodman opened Oct 1, 2026Contributor·

  ·

• fix: sign release checksums with a sigstore bundle

  changelog-ignore
  #5362·wagoodman opened Oct 1, 2026Contributor·

  ·

• fix: make release changelog readable

  #5346·KKamJi98 opened Sep 29, 2026·

  ·
  1

  2

• Kernel module parameters lose, fixed #5318

  #5319·rezmoss opened Sep 22, 2026Contributor·

  ·
  1

  2

• CPE generation attributes the umbrella project's product , fixed #5316

  #5317·rezmoss opened Sep 21, 2026Contributor·

  ·
  1

  1

• fix(cpegenerate): normalise PyPI dictionary keys to match cataloger normalisation

  #5314·auyua9 opened Sep 21, 2026·

  ·

• feat: record CocoaPods EXTERNAL SOURCES on the package

  #5303·az-catch opened Sep 18, 2026·

  ·
  1

• fix: preserve POSIX info paths for dpkg packages when running on Windows

  #5296·dprohaska opened Sep 15, 2026·

  ·

• fix(java): exclude pom profile dependencies that cannot be active

  #5289·kokhlo opened Sep 13, 2026·

  ·
  1

  4

• feat: add download location for go modules

  #5288·kjanat opened Sep 12, 2026·

  ·
  2

• fix(javascript): keep pnpm packages when resolution is nested

  bug
  #5287·vulragrag-star opened Sep 12, 2026·

  ·
  1

  1

• Replace anchore/go-version fork with hashicorp/go-version

  dependencies
  #5286·texasich opened Sep 12, 2026Contributor·

  ·
  1

• feat(terraform): add license detection for terraform providers

  #5263·timols opened Sep 9, 2026Contributor·

  ·
  1

• fix(terraform): generate terraform-provider-specific CPEs for terraform lock packages

  #5261·timols opened Sep 8, 2026Contributor·

  ·
  2

• Add nested archive cataloging

  #5260·kzantow opened Sep 8, 2026Contributor·

  ·
  1

  1

• fix(java): do not catalog declared dependencies of an embedded pom.xml

  #5258·Eljees opened Sep 7, 2026Contributor·

  ·

• fix(cyclonedx): preserve source name, version, and supplier on decode

  #5255·Golopmoui3 opened Sep 6, 2026·

  ·

• fix(java): inherit pom licenses on the parent package when identities match

  #5254·Golopmoui3 opened Sep 6, 2026·

  ·
  1

• directory resolver ignores --exclude for symlink targets

  #5253·goingforstudying-ctrl opened Sep 5, 2026·

  ·
  1

• Detect licenses from Maven pom.xml comments

  #5249·chrisrueger opened Sep 3, 2026·

  ·
  1

• feat(cyclonedx): output source PURL as external reference

  #5246·swadaptive opened Sep 2, 2026·

  ·
  2

• Freebsd cataloger support

  #5240·danhuang-ixia opened Aug 28, 2026·

  ·
  1

  1

• feat(composer): add dependency relationships

  #5234·Xenira opened Aug 27, 2026Contributor·

  ·
  3

• fix(cyclonedx): drop dependency edges that reference packages missing from the catalog

  #5233·pujitha24 opened Aug 27, 2026Contributor·

  ·
  1

  4

• Add fail compliance action

  #5231·zilosz opened Aug 26, 2026·

  ·
  1