Added Features
Bug Fixes
- Fix Cargo PURLs for local workspace packages [PR #5105 @3nesdeniz]
- Decode golang symbols [PR #5089 @wagoodman]
- CPE vendor field incorrectly includes publisher URL for SUSE RPM packages [Issue #5073] [PR #5081 @Eljees]
- apk-db-cataloger silently drops the entire APK catalog when one installed-DB field exceeds 64 KB [Issue #5094] [PR #5100 @cyphercodes]
Additional Changes
- package-lock.json v1: nested dependencies entries are never cataloged (flat top-level iteration only) [Issue #5101] [PR #5108 @Eljees]
- consider vendored golang packages in module attribution [PR #5093 @kzantow]
- Fix inverted bounds check dropping every Erlang string with a backslash [PR #5110 @arpitjain099]
Dependencies
14 dependency changes (14 updated). 1 vulnerability remediated.
🟢 Remediated (1)
- GHSA-hrxh-6v49-42gf (High) — google.golang.org/grpc
Updated (14 packages)
- github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp
v1.31.0→v1.32.0 - github.com/cncf/xds/go
v0.0.0-ee656c7→v0.0.0-dba9d58 - github.com/envoyproxy/go-control-plane/envoy
v1.36.0→v1.37.0 - github.com/envoyproxy/protoc-gen-validate
v1.3.0→v1.3.3 - github.com/gpustack/gguf-parser-go
v0.24.1→v0.25.0 - go.opentelemetry.io/contrib/detectors/gcp
v1.39.0→v1.43.0 - google.golang.org/genproto/googleapis/api
v0.0.0-9d38bb4→v0.0.0-afd174a - google.golang.org/genproto/googleapis/rpc
v0.0.0-6f92a3b→v0.0.0-afd174a - google.golang.org/grpc
v1.80.0→v1.82.1(🟢 remediated GHSA-hrxh-6v49-42gf) - modernc.org/cc/v4
v4.28.4→v4.29.0 - modernc.org/ccgo/v4
v4.34.4→v4.34.6 - modernc.org/gc/v3
v3.1.3→v3.1.4 - modernc.org/libc
v1.73.4→v1.74.1 - modernc.org/sqlite
v1.53.0→v1.54.0