Changelog

All notable changes to this project are documented here. The format follows Conventional Commits and this file is generated by git-cliff from the release workflow.

1.14.0 - 2026-10-14

Features

• action: Install every version from aesir-oss/pixi-sbom (#25) (129ab52)

CI and Build

• release: Create an aesir-oss/pixi-sbom-action release on every final (#24) (6dfa588)

Deps

• Read YAML with serde-saphyr instead of serde_yaml; MSRV 1.89 (#23) (01263a5)

1.14.0-rc.1 - 2026-10-14

Features

• action: Install every version from aesir-oss/pixi-sbom (#25) (129ab52)

CI and Build

• release: Create an aesir-oss/pixi-sbom-action release on every final (#24) (6dfa588)

Deps

• Read YAML with serde-saphyr instead of serde_yaml; MSRV 1.89 (#23) (01263a5)

1.13.2 - 2026-10-14

Refactoring

• Fold the shared modules back into the crate (532099c)

CI and Build

• Stand alone as aesir-oss/pixi-sbom (6eb5513)

Deps

• Name the serde_yaml issue by its number in this repository (#22) (ef1c5a6)

1.13.2-rc.1 - 2026-10-12

Refactoring

• Fold the shared modules back into the crate (532099c)

CI and Build

• Stand alone as aesir-oss/pixi-sbom (6eb5513)

Deps

• Name the serde_yaml issue by its number in this repository (#22) (ef1c5a6)

1.13.1 - 2026-10-12

Features

• common: Create the shared crate with license normalization and terminal output (#56) (#102) (56cc692)
• common: One license verdict for pixi-sbom's gate and pixi-policy's rule (#59) (#103) (d127c88)
• policy: Licenses rules, allow, review and deny lists of SPDX licenses (#63) (#114) (0ff1eb6)
• docs: One docs site with a section per extension (#6) (#126) (b57f9a4)

Bug Fixes

• release: A release candidate's notes list its own changes (#88) (#101) (d5f7ff6)

Refactoring

• common: The lockfile facts model, separated from the SBOM model (#58) (#105) (45051ee)

Documentation

• whats-new: What 1.13.1 means: the docs' new home, and nothing else changing (#130) (b90f946)

CI and Build

• Cache Rust builds, and build the benchmarks and action binary in debug (#89) (#94) (b60d915)
• Run PR jobs only for the paths they cover, behind one CI result check (#90) (#96) (552d3b7)
• Release builds on main only, Performance on release candidates and weekly (#91) (#98) (54866b0)
• release: Rely on main's green CI instead of re-running the gate (#92) (#99) (57b5c37)
• release: Compile each platform once for its archive and wheel (#93) (#100) (452d190)
• release: Release the shared crate before the extensions that need it (#57) (#104) (010e41c)
• release: Stop publishing to crates.io, and name the shared crate pixi-ext-common (#106) (#107) (b609721)
• release: Release pixi-policy through the shared release workflows (#69) (#120) (070ffbe)

1.13.0 - 2026-10-11

Features

• scan: Find installed environments in an unpacked container filesystem (#25) (#55) (512ef25)
• lock: Read a JavaScript project's node_modules when it has no lockfile (#36) (#87) (2151eba)

Documentation

• development: Name the shared crate aesir-pixi-ext-contrib-common and publish it (#54) (5f76db7)
• examples: Two unpacked container images to scan (#31) (#86) (6970726)

CI and Build

• release: A changelog per extension, filtered by the paths it is built from (#51) (#52) (a37aa49)
• release: A pixi-ext-contrib release after each extension release, the only one marked Latest (#49) (#53) (dd437bb)

1.12.0 - 2026-10-11

Features

• action: Publish the GitHub Action from aesir-oss/pixi-sbom-action (#5) (934577b)
• prefix: Record where each component was found (#37) (69151fa)
• prefix: List native libraries bundled in wheels and binaries (#38) (89423f5)
• lock: Read npm, yarn and pnpm lockfiles beside a workspace (#39) (5304649)
• diff: Leave bundled native libraries out of the comparison (#43) (e8e20a0)
• lock: Read every ecosystem found by default, with --skip-input to leave one out (#44) (776f7f3)

Bug Fixes

• release: Attest the archive under its real name (#33) (8fb97fa)
• cli: End the output quietly when stdout is closed (#46) (7ea59b6)
• diff: A version one side does not know is not a version change (#48) (2c23578)

Refactoring

• workspace: Move pixi-sbom into crates/pixi-sbom (#1) (da332e0)

Documentation

• Point pixi-sbom's links and tool URL at aesir-oss/pixi-ext-contrib (#4) (d13a72e)
• Link changelog references to the repository that holds them (#32) (b8657ea)
• examples: Example projects for 1.12.0's inputs (#40) (dbe7ff4)

CI and Build

• release: Publish the crate with crates.io trusted publishing (#2) (ad3d2d4)
• release: Tag pixi-sbom releases pixi-sbom-vX.Y.Z (#3) (1d2f59e)

1.11.0 - 2026-10-10

Features

• identity: CRAN purls for R packages (millsks/pixi-sbom#494) (eb06bef)
• prefix: Go modules from the build info of Go binaries (millsks/pixi-sbom#495) (fd9fb46)
• prefix: Npm packages installed in the environment (millsks/pixi-sbom#496) (4e6a6fa)

Documentation

• examples: R, Go and npm example environments (millsks/pixi-sbom#500) (dff7d73)
• Edit the 1.11.0 notes in What's new (millsks/pixi-sbom#501) (e8fd572)

CI and Build

• Submit the pixi environments to the dependency graph (millsks/pixi-sbom#492) (a780903)

1.10.0 - 2026-10-10

Features

• identity: Curated CPEs for native conda packages (millsks/pixi-sbom#467) (7311c0f)
• prefix: PyPI identity of conda packages from their installed dist-info (millsks/pixi-sbom#468) (8238f49)
• prefix: The interpreter of a plain Python installation as a component (millsks/pixi-sbom#469) (17da7a1)
• prefix: Python distributions vendored inside packages (millsks/pixi-sbom#473) (a9dddc0)
• identity: Warn when scanners would miss conda packages' PyPI identity (millsks/pixi-sbom#479) (ace6cb7)
• prefix: Verify installed files against conda-meta (millsks/pixi-sbom#480) (f32ad51)
• output: GitHub dependency submission format (millsks/pixi-sbom#483) (ed39b38)
• cli: Group --help flags into sections drawn as rules (millsks/pixi-sbom#486) (e4c402d)

Bug Fixes

• prefix: Read site-packages once through conda-forge's lib/python3.1 symlink (millsks/pixi-sbom#465) (c7488fd)
• prefix: Record the environment's platform, not the host's (millsks/pixi-sbom#466) (3b54105)
• cpe: Use the conda-forge names of four table entries (millsks/pixi-sbom#472) (849b628)
• licenses: Never add a version to an unversioned license name (millsks/pixi-sbom#474) (2164d3a)
• quality: Grade other tools' documents on the same terms (millsks/pixi-sbom#475) (dfa36b2)
• prefix: No machine-local absolute paths in a document (millsks/pixi-sbom#476) (625ff92)
• identity: No scanner warning for reports and GitHub snapshots (millsks/pixi-sbom#484) (f3fa190)
• cli: Sort completion candidates alphabetically (millsks/pixi-sbom#485) (ffa25c0)
• prefix: No machine path in a local pixi:direct-url (millsks/pixi-sbom#487) (baa15b8)
• prefix: A relative --prefix keeps the project's paths portable (millsks/pixi-sbom#488) (346069d)

Documentation

• Pixi-sbom and syft side by side (millsks/pixi-sbom#477) (c9bf038)
• Edit the 1.10.0 notes in What's new (millsks/pixi-sbom#490) (69b716f)

Testing

• Compare Grype findings from pixi-sbom's SBOM against syft's (millsks/pixi-sbom#470) (b9185c9)

1.9.0 - 2026-10-10

Features

• cli: Tab completion for pixi-sbom in bash, zsh, fish, PowerShell and elvish (millsks/pixi-sbom#445) (6bb56b2)

Bug Fixes

• release: Write What's new notes before the release, not after (millsks/pixi-sbom#444) (773c1d7)
• docs: Bash completion in macOS's bash 3.2 (millsks/pixi-sbom#463) (1cbae40)

Documentation

• What's new in 1.8.2 (millsks/pixi-sbom#442) (f503582)
• Complete pixi sbom through a snippet per shell, run in real shells in CI (millsks/pixi-sbom#459) (838a6e1)
• What's new in 1.9.0, ready for the release (millsks/pixi-sbom#464) (6f93b71)

Testing

• Shell completion on Windows, in PowerShell 7 and Windows PowerShell 5.1 (millsks/pixi-sbom#461) (ffbc291)

1.8.2 - 2026-10-10

Bug Fixes

• merge: Two files of one PyPI release are not a hash conflict (millsks/pixi-sbom#427) (d1f44a5)

Documentation

• A what's-new page for every release since 1.0, and a shareable post (millsks/pixi-sbom#418) (3856c82)
• A "Try it on the examples" page (millsks/pixi-sbom#420) (2156e03)
• Recordings for the 1.8 output (quality, EPSS, VEX in) (millsks/pixi-sbom#421) (947fa5d)
• A field manual of task-based playbooks (millsks/pixi-sbom#422) (7ab02ec)
• A hands-on training lab on the examples, offline (millsks/pixi-sbom#426) (95920e3)
• presentations: Bring both decks up to 1.8.1, with the financial-sector rules (millsks/pixi-sbom#430) (dca3377)
• presentations: A public talk, "The Hole in Your SBOM", with its demo script (millsks/pixi-sbom#432) (aa3f87e)

1.8.1 - 2026-10-09

Bug Fixes

• outdated: Count every prefix.dev page down to the installed version (millsks/pixi-sbom#417) (39c89c4)

1.8.0 - 2026-10-09

Features

• scorecard: Repositories for poetry.lock and pdm.lock packages from PyPI project URLs (millsks/pixi-sbom#397) (b265001)
• from-sbom: Outdated and scorecard reports from purls alone, tested on syft (millsks/pixi-sbom#398) (0845da6)
• input: Read a fully pinned requirements.txt directly (millsks/pixi-sbom#399) (c993b58)
• diagnostics: Point an unlocked input to the command that locks it (millsks/pixi-sbom#400) (d6bb3ce)
• report: --report quality and a --min-quality gate for SBOM completeness (millsks/pixi-sbom#401) (c291664)
• vulnerabilities: --epss exploit-likelihood scores and a --fail-on-epss gate (millsks/pixi-sbom#402) (1c3a627)
• vulnerabilities: Apply a vendor's VEX with --vex-in (millsks/pixi-sbom#403) (2f3b1aa)
• input: Merge several SBOMs into one with repeated --from-sbom or --scan --merge (millsks/pixi-sbom#404) (57ee98e)
• examples: Pixi workspaces, pinned requirements files, and unpinned ones that must fail (millsks/pixi-sbom#408) (7fb9eaf)

Bug Fixes

• pypi: Git, path and URL installs are not looked up on PyPI by name (millsks/pixi-sbom#396) (f029a1d)
• requirements: Refuse an editable or path line instead of misreading the file (millsks/pixi-sbom#406) (1cb1eb3)
• requirements: Evaluate a uv-compiled file for the Python and platform it was compiled for (millsks/pixi-sbom#407) (9f3194a)
• poetry: Read a package's markers when Poetry writes one per group (millsks/pixi-sbom#409) (fd3e97b)

Documentation

• Bring the overview pages up to date with 1.8.0 (millsks/pixi-sbom#405) (fd98bc9)

1.7.0 - 2026-10-08

Features

• examples: Real projects for every non-pixi reader, written by the real tools (millsks/pixi-sbom#363) (74a5660)
• input: Read pylock.toml (PEP 751) (millsks/pixi-sbom#364) (aaa8ef0)
• input: Read uv.lock, and find it by the upward search (millsks/pixi-sbom#366) (bd098da)
• input: Read poetry.lock (lock-version 2.x) (millsks/pixi-sbom#367) (25abba3)
• input: Read pdm.lock (lock_version 4.x) (millsks/pixi-sbom#368) (5c65fff)
• input: Read conda-lock.yml (unified, version 1) (millsks/pixi-sbom#369) (2b82c59)
• input: Read explicit conda spec files (millsks/pixi-sbom#370) (371cf6d)
• manifest: Declared dependencies beside non-pixi lockfiles (millsks/pixi-sbom#371) (5978b18)
• pypi: Record Python extras as pixi:python-extras and pixi:via-extra (millsks/pixi-sbom#372) (5f4599b)
• format: Dependency groups as CycloneDX scope and SPDX dev/optional relationships (millsks/pixi-sbom#373) (632819a)
• prefix: Describe plain venvs and site-packages, not only conda environments (millsks/pixi-sbom#374) (acee39e)
• prefix: Mark user-requested packages as direct from REQUESTED (millsks/pixi-sbom#376) (9e22091)
• prefix: --infer-extras for venvs, labelled as inferred (millsks/pixi-sbom#377) (7060a59)
• discover: Find every supported lockfile kind in the upward search and --scan (millsks/pixi-sbom#378) (8e71644)
• diff: --against accepts every supported lockfile, for venv drift checks (millsks/pixi-sbom#379) (447359b)
• Pre-commit hooks for writing the SBOM and the license gate (millsks/pixi-sbom#382) (916524b)
• action: Prefix and from-sbom inputs, and a tested example for uv projects (millsks/pixi-sbom#383) (e85cfc9)

Bug Fixes

• format: Lifecycle phase from the input, not always pre-build (millsks/pixi-sbom#365) (a6a61e6)
• purl: VCS, local and editable installs no longer claim a PyPI purl (millsks/pixi-sbom#375) (b1053f0)
• test: The never-consulted cache test no longer races the stale test (millsks/pixi-sbom#387) (a3a7f9d)
• release: Attach the wheels to the release deterministically (millsks/pixi-sbom#388) (28cfefc)

Documentation

• Using pixi-sbom without pixi, and a README that says what it reads (millsks/pixi-sbom#385) (908f942)
• How to get a lockfile pixi-sbom reads, for every common setup (millsks/pixi-sbom#390) (ecbc6c2)
• The Pipenv route is for Pipenv-managed projects; a pip venv uses --prefix (millsks/pixi-sbom#391) (98bb4b8)

Testing

• Every report, enrichment and gate on every input kind (millsks/pixi-sbom#384) (83b4166)

1.6.0 - 2026-10-07

Features

• vex: Machine-readable justification for not_affected assessments (millsks/pixi-sbom#338) (e0ab8a9)
• vex: Write analysis.response, and say why the assessment dates are not (millsks/pixi-sbom#350) (aeb6b0b)
• Default --conda-index-kind to prefix; anaconda stays selectable (millsks/pixi-sbom#356) (84f9ff6)

Bug Fixes

• Let the changelog span prereleases instead of fragmenting on them (millsks/pixi-sbom#316) (7c9f50e)
• vex: Refuse --vex with --format spdx instead of writing a VEX that links nowhere (millsks/pixi-sbom#320) (adcf8e9)
• Batched prefix.dev queries never exceed --concurrency (millsks/pixi-sbom#355) (907d389)
• Show --report outdated progress while prefix.dev batches are in flight (millsks/pixi-sbom#359) (e02772c)
• Count a batched package as soon as its batch lands (millsks/pixi-sbom#360) (6a23b9f)

Documentation

• Why the two conda index kinds disagree on dates, and on the newest hours (millsks/pixi-sbom#352) (b62c0ed)

Testing

• A local HTTP server, so request behaviour is asserted rather than timed by hand (millsks/pixi-sbom#351) (86db1a8)

1.5.0 - 2026-10-04

Features

• Retry a rate limit, and stop reporting an unasked index as no upstream (millsks/pixi-sbom#304) (c3b352b)
• Add --concurrency and a concurrency configuration key (millsks/pixi-sbom#307) (c2bc82e)
• Say in --doctor how many requests and which conda index (millsks/pixi-sbom#308) (729812d)

Bug Fixes

• Count the network a run used, not the network it could have used (millsks/pixi-sbom#300) (991b517)
• Keep the machine's own configuration out of the test suite (millsks/pixi-sbom#303) (3bd9dfe)
• Stop a mistyped concurrency from hanging the run and then panicking (millsks/pixi-sbom#305) (a46c1bc)
• Stop tying requests in flight to the core count (millsks/pixi-sbom#306) (07eefcc)
• Date a batch's newer releases in parallel, not one after another (millsks/pixi-sbom#313) (4bdd2f2)
• Count a batched fetch as a fetch, not as a cache hit (millsks/pixi-sbom#314) (e8e7b75)
• ci: Release the version that was asked for, even with no new commits (millsks/pixi-sbom#315) (3134602)

Performance

• Share one HTTP agent so connections are reused (millsks/pixi-sbom#301) (c186101)
• Ask prefix.dev about ten packages per request (millsks/pixi-sbom#309) (d7fd067)

1.4.0 - 2026-10-03

Features

• Let the configuration file choose the conda index (millsks/pixi-sbom#286) (d8171ec)
• Read system and user configuration from pixi's directories (millsks/pixi-sbom#289) (fa3dcd8)

Bug Fixes

• Confirm a mirrored package's channel by its hash, not its name (millsks/pixi-sbom#281) (82df2d1)
• Match the installed build by its build string, not by scanning a page (millsks/pixi-sbom#283) (e0c1f19)
• Stop blaming credentials for an answer the probe asked for (millsks/pixi-sbom#290) (f428509)

Performance

• Resolve a mirrored channel once, not once per package (millsks/pixi-sbom#282) (c05ed68)

1.3.0 - 2026-10-02

Features

• Read the credentials pixi already keeps, for a private channel (millsks/pixi-sbom#278) (60a93c4)
• Say which credentials a request carried, and fill in the trace level (millsks/pixi-sbom#279) (c1ccaeb)

1.2.0 - 2026-10-02

Features

• --conda-index-kind, with prefix.dev as a second conda index (millsks/pixi-sbom#275) (1a79188)

Bug Fixes

• A named conda index is asked about every channel, not only anaconda.org (millsks/pixi-sbom#274) (2847ee2)
• Prefix.dev dates are the build's own, and selecting an index lifts the filter (millsks/pixi-sbom#276) (85a1059)

1.1.0 - 2026-10-01

Features

• --doctor on its own probes every upstream it knows about (millsks/pixi-sbom#262) (ae13c63)
• PIXI_SBOM_CONDAPKG_URL, with the anaconda spelling kept permanently (millsks/pixi-sbom#266) (4662b2a)
• Point every upstream at a mirror, archives included (millsks/pixi-sbom#271) (94dfe38)
• --doctor probes the archive hosts, from the lockfile when there is one (millsks/pixi-sbom#272) (af67224)

Bug Fixes

• --doctor names the conda index by its role, not by a hostname (millsks/pixi-sbom#264) (115d2b2)

Documentation

• The strict attestation check, pinning the release workflow and tag (millsks/pixi-sbom#246) (3235948)
• A 20-second terminal recording at the top of the README (millsks/pixi-sbom#249) (ee4b5c8)
• A recording per report in the docs, and make them actually offline (millsks/pixi-sbom#251) (2b56ded)
• Document the Marketplace listing now that it exists (millsks/pixi-sbom#253) (62f11db)
• The real numbers in architecture.md, and the modules it left out (millsks/pixi-sbom#255) (859c95b)
• The site footer says Apache-2.0, which is what the project is (millsks/pixi-sbom#258) (153947e)

1.0.0 - 2026-09-27

Features

• --root-name and --outdated-min, with the old spellings kept (millsks/pixi-sbom#227) (millsks/pixi-sbom#228) (d45eb61)
• Record vulnerabilities in SPDX 3.0.1 via the security profile (millsks/pixi-sbom#118) (millsks/pixi-sbom#229) (7b05001)
• action: A floating v0 tag for Marketplace users, and docs that use it (millsks/pixi-sbom#231) (238f41f)

Bug Fixes

• docs: The config keys on the stability page were in a casing the parser rejects (millsks/pixi-sbom#242) (62533ab)
• Settle the support policy and harden the tag move before 1.0 (millsks/pixi-sbom#244) (millsks/pixi-sbom#245) (a48d23e)

Documentation

• Write down what 1.0 freezes, and make the page check itself (millsks/pixi-sbom#230) (98a068d)
• The 1.0 pass over the docs, and somewhere for release copy to live (millsks/pixi-sbom#119) (millsks/pixi-sbom#241) (69db880)

Testing

• Check the stability page in both directions, not just one (millsks/pixi-sbom#232) (18ab185)

0.12.0 - 2026-09-27

Bug Fixes

• ci: Attest releases from the tag so the provenance names what was built (millsks/pixi-sbom#218) (millsks/pixi-sbom#220) (88a368a)
• --no-cache and --refresh now reach the archive caches (millsks/pixi-sbom#197) (millsks/pixi-sbom#224) (086cabf)
• ci: Dogfood the action on every platform it claims to support (millsks/pixi-sbom#225) (millsks/pixi-sbom#226) (dd6e51c)

Documentation

• A verify command that works, and stop shipping a perf dump (millsks/pixi-sbom#222) (millsks/pixi-sbom#223) (89d1613)

0.11.0 - 2026-09-27

Features

• Support every lockfile format pixi has written, and say so (millsks/pixi-sbom#206) (0ef9dd1)
• Sign build provenance for every release archive (millsks/pixi-sbom#202) (millsks/pixi-sbom#213) (ee6cfb9)

Bug Fixes

• The MSRV was never 1.85, and nothing was checking (millsks/pixi-sbom#208) (e13fe1e)
• docs: Move the site toolchain to PyPI to clear PYSEC-2026-2132 (millsks/pixi-sbom#211) (millsks/pixi-sbom#216) (68f6747)
• A purl with no version is a name, not an identity (millsks/pixi-sbom#215) (millsks/pixi-sbom#217) (05fc3c8)

Documentation

• The two presentations, and where their numbers come from (millsks/pixi-sbom#199) (e545a70)
• The published library is not an API, and now says so everywhere (millsks/pixi-sbom#210) (e9f90b4)
• A security policy, and a private way to report (millsks/pixi-sbom#203) (millsks/pixi-sbom#214) (1fb683e)

0.10.1 - 2026-09-26

Performance

• Buffer stdout, which a milestone of benchmarks never looked at (millsks/pixi-sbom#195) (d49c545)

CI and Build

• perf: The memory gate goes back to 15% (millsks/pixi-sbom#196) (2a7779e)

0.10.0 - 2026-09-26

Features

• A criterion benchmark suite, and a library to point it at (millsks/pixi-sbom#185) (04aea1a)
• One pool on rayon, sized by PIXI_SBOM_CONCURRENCY (millsks/pixi-sbom#186) (efc8f77)
• Look every document's packages up once, not once per document (millsks/pixi-sbom#187) (dcb6cb5)

Bug Fixes

• perf: Measure the child, gate on a share and an amount, and record the allocator trade (millsks/pixi-sbom#192) (0f37f8c)

Performance

• Write documents straight out, and bound the license text a document holds (millsks/pixi-sbom#188) (6f9dc2a)
• A smaller, faster binary — panic=abort and mimalloc (millsks/pixi-sbom#189) (64fe6ec)

CI and Build

• Measure performance on every platform a binary is built for (millsks/pixi-sbom#191) (c4a0f30)

0.9.5 - 2026-09-26

Features

• Log every request and the whole error chain behind a failure (millsks/pixi-sbom#164) (a6c3f31)
• Give every diagnostic a help line naming the next step (millsks/pixi-sbom#166) (4a3fc07)
• Say which input and which settings a run chose (millsks/pixi-sbom#167) (9764b1b)
• Say what a run will talk to before it talks to anything (millsks/pixi-sbom#168) (cd0a6c2)
• Say where every fact about a package came from with --explain (millsks/pixi-sbom#171) (b587acf)
• --refresh and --no-cache, and say what each cache served (millsks/pixi-sbom#170) (e25aa50)
• --doctor probes every upstream and says which one is unreachable (millsks/pixi-sbom#173) (59f15bb)
• Name every gate that fired and the one that chose the exit code (millsks/pixi-sbom#169) (ced2368)
• --version-details prints what a bug report needs (millsks/pixi-sbom#176) (e464c30)
• Record in the document when enrichment was incomplete (millsks/pixi-sbom#160) (millsks/pixi-sbom#179) (711ed3e)
• An empty vulnerability table says whether anything could be asked (millsks/pixi-sbom#174) (157c9b5)
• --timings says where the run spent its time (millsks/pixi-sbom#177) (e0f2175)
• --log-format json, for a collector rather than a person (millsks/pixi-sbom#181) (5d65d99)
• SOCKS and Windows system proxies, and a private CA bundle (millsks/pixi-sbom#183) (70ce8f3)

Bug Fixes

• Build the Pages artifact from mike's own commit (millsks/pixi-sbom#165) (6dcaadf)
• Close describe_input, which a rebase resolution dropped (millsks/pixi-sbom#172) (1466b9f)
• doctor: Count a body past the probe's read cap as an answer (millsks/pixi-sbom#178) (9fe2c02)
• One stale-cache tally, not two (millsks/pixi-sbom#180) (5d76c11)

Documentation

• List --doctor in the README options and examples (millsks/pixi-sbom#175) (34c3c36)
• What each log level says, and how to narrow it to one module (millsks/pixi-sbom#182) (e5b4f38)

0.9.0 - 2026-09-25

Features

• Render report tables with comfy-table and colour them with --color (753b37d)
• Show progress bars while the enrichment fetches run (e0b4311)
• Flag yanked PyPI releases and gate on them with --fail-on-yanked (cd1f60f)
• Report how far behind its index each package is (3b1890f)
• Report which packages cap the interpreter with --report python (millsks/pixi-sbom#135) (e46854c)
• Mark the dependencies the workspace declared itself (millsks/pixi-sbom#136) (a4da5b6)
• Name phantom, undeclared and unused dependencies with --report phantom (millsks/pixi-sbom#137) (a358b9d)
• Gate a run on what changed with --fail-on-diff (millsks/pixi-sbom#138) (28a00f9)
• Compare an installed environment with its lockfile (millsks/pixi-sbom#139) (8492623)
• Describe every workspace in a tree with --scan (millsks/pixi-sbom#140) (f9cd174)
• Read an existing document with --from-sbom (millsks/pixi-sbom#141) (2d47b0f)
• Exempt a package from the license policy with --ignore-license (millsks/pixi-sbom#142) (d98e1b2)
• Write the assessments as a standalone VEX with --vex (millsks/pixi-sbom#143) (8a019c7)
• Draw the dependency tree and group the licenses view (millsks/pixi-sbom#144) (6a428f3)
• Read the cargo auditable crate list out of installed binaries (millsks/pixi-sbom#145) (569c6de)
• Record the OpenSSF Scorecard of each package with --scorecard (millsks/pixi-sbom#146) (81c7242)

Bug Fixes

• Expire the docs repository card cache so it shows the current release (d075ffe)
• Publish the crate from a clean checkout of the release tag (d5de240)
• Keep the batch heading plain in the markdown report (c9e12a5)

Performance

• Look PyPI licenses up ten at a time (69735f3)

0.8.0 - 2026-09-21

Features

• Sign the documents with a GitHub artifact attestation from the action (370adbe)
• Support cargo binstall and publish the crate from the release workflow (900391a)

0.7.0 - 2026-09-21

Features

• Leave packages out with --exclude, --include and --exclude-kind (9a5cd54)
• Read settings from pixi-sbom.toml or [tool.pixi-sbom] before the command line (381a4ec)
• Report what changed since a previous document with --report diff --against (d81c832)
• Describe an installed environment without a lockfile with --prefix (4336163)

0.6.0 - 2026-09-21

Features

• Version the docs per release tag with a dev build from main (6f627aa)
• Look up known vulnerabilities on OSV with --vulnerabilities osv (8c08627)
• Add --report vulnerabilities in table, markdown, csv and json (9c2f910)
• Gate on vulnerabilities with --fail-on-severity and accept them with --ignore-vuln (a4c4aab)
• Flag findings in CISA's Known Exploited Vulnerabilities catalog with --kev (175b38d)
• Write vulnerabilities as SARIF and expose the vulnerability flags in the action (0262b24)

Bug Fixes

• Keep the pixi-sbom cache inside the pixi cache directory (d4b692e)

Documentation

• Note the github-pages environment tag policy releases need (7519e49)

0.5.5 - 2026-09-21

Features

• Scaffold the MkDocs documentation site (ce1a365)
• Publish the documentation site to GitHub Pages on every release (68142af)
• Link the documentation site and make the action Marketplace-ready (12c0df4)
• Version the documentation site per release with mike (094dbfc)

Documentation

• Restructure the site into installation, CLI, action, recipes and formats pages (9d88ab3)

0.5.1 - 2026-09-21

Features

• Say why a license is not an SPDX expression (0280c50)
• Read small .tar.bz2 archives whole for license details (29a13a7)

Bug Fixes

• Capture the pixi-sbom exit status in the action under bash -e (a926a1e)
• Let the action run more than once per job (1a718e5)
• Keep conda-forge's "WITH exceptions" licenses as evaluable expressions (003339a)

0.5.0 - 2026-09-21

Features

• Add a license policy gate with --allow-license, --deny-license and --require-license (1b0cf29)
• Add a GitHub Action that runs the release binary (012e98c)
• Write SPDX 3.0.1 JSON-LD with --format spdx --spec-version 3.0 (2bcfdf4)
• Attach PEP 770 embedded SBOMs from wheels with --embedded-sboms (9ac664b)

0.4.0 - 2026-09-20

Features

• Add --fetch-licenses with conda details from the package cache (23a8667)
• Add --report to print package and license tables to the terminal (8d74219)
• Read conda license details from channel archives by HTTP range (77a8597)
• Read PyPI license details from wheels by HTTP range (96099b0)

Bug Fixes

• Pin the report table width in snapshot tests (21444c3)
• Make the archive e2e test independent of line endings and drive letters (eaa67ba)
• Render local package paths as file URLs in the document (96ce0ba)
• Emit LicenseRef licenses with texts as named licenses in CycloneDX (1f20b41)

0.3.0 - 2026-09-19

Features

• Enrich conda packages with PyPI purls so scanners can match them (85ffd58)
• Look up PyPI licenses from the index with --pypi-licenses (2a0f0de)
• Write CycloneDX 1.7 with --spec-version (8b13136)

0.2.0 - 2026-09-19

Features

• Derive deterministic document ids and honor SOURCE_DATE_EPOCH (cc72a3e)
• Write the SBOM to stdout with --output - (fc1c83f)
• Add --all-platforms, symmetric with --all-environments (9dcd06e)
• Cover CISA 2026 minimum elements (07c8c5a)
• Link PyPI packages to the conda python package (fac06fd)

Bug Fixes

• Record the lockfile by name instead of its absolute path (3628bda)

0.1.0 - 2026-09-18

Features

• Scaffold pixi-sbom Rust extension with CLI and lockfile discovery (eecca4b)
• Build format-agnostic SBOM model from pixi.lock (899cbe9)
• Write CycloneDX 1.6 and SPDX 2.3 JSON documents (b35464d)
• Describe pixi-build source packages from their build source (efabe43)
• Add --all-environments to write one SBOM per environment (9aadfe2)

Bug Fixes

• ci: Replace retired macos-13 runner with macos-15-intel (5d80602)

Documentation

• Add release workflow, conda-forge recipe, and field mapping docs (f6157b4)
• Add usage, output format, architecture, and development guides (36368d4)

CI and Build

• Run the test and build matrix on the -latest runners only (a0084aa)
• Add two-stage release workflow that maintains CHANGELOG.md with git-cliff (e87c9ed)
• Collapse release into a single App-token workflow (447f08c)