What's Changed

• Adds a container image based on the deno runtime
• Fixes the virtualenv issue reported here
• Offers component evidence with confidence for some ecosystem
• Python dependency tree construction
• New --validate cli argument and validateBom export to validate the generated SBoM using jsonschema
• BREAKING: Makes jar scanning enabled by default. Previously, it required --deep explicitly. This would increase the number of components in the SBoM. Such jar-based components might lack precise group, name, or version, indicated under evidence => confidence.

Dependency Tree

Jar scanning enabled

Evidence with confidence

Full Changelog: v9.0.1...v9.1.0