What's Changed
- Fixes duplicate or inconsistent Debian, Alpine, and Docker Hardened Images package identities when installed package records and embedded SBOMs describe the same package.
- Fixes local policy evaluation ignoring proxy settings for registry requests, which could cause policies to report "No data" on networks that require a proxy.
- Preserves provenance and SBOM attestations for local images when an older cached SBOM lacks those attestations.
- Updates the compression dependency to version 1.18.7 to address CVE-2026-63209.
- Fixes checksum filenames for Scout Action release downloads and verifies the uploaded binaries against their checksum manifest.
Generated Debian and Alpine binary package URLs retain architecture and source-package qualifiers. Existing generated SBOM caches are refreshed automatically; no new option is required.