chore(deps): update dependency kubernetes-sigs/bom to v0.6.0 (main) #1968
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![cilium-renovate[bot]](https://avatars.githubusercontent.com/in/339224?s=60&v=4){kind=small}
cilium-renovate
bot
requested review from
willfindlay and
a team
as code owners
cilium-renovate
bot
added
release-blocker
mtardy
requested changes
Jan 12, 2024
There was a problem hiding this comment.
please do not as long as they don't release a new patch version: kubernetes-sigs/bom#385
Signed-off-by: cilium-renovate[bot] <134692979+cilium-renovate[bot]@users.noreply.github.com>
cilium-renovate
bot
force-pushed
the
renovate/main-kubernetes-sigs-bom-0.x
branch
from
bb53694 to
22f8536
Compare
cilium-renovate
bot
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
f0ff48f9a202abfddf656056bbeeb8efe29920ab->v0.6.0Release Notes
kubernetes-sigs/bom (kubernetes-sigs/bom)
v0.6.0Compare Source
Changes by Kind
Feature
--purlto output purls instead of names--format--fieldsflag controls which fields of the sbom will be printed on the query outputbom document queryand skip the filename (#291, @puerco)bomjson parser now supports top-level elements specified with aDESCRIBESrelationship to the document.documentDescribesis, of course, still suppoirtedNOASSERTIONdetection when choosing which license to print. (#304, @puerco)bomnow supports scanning OS packages from images based on distroless.bomwould drop the last package read from the debian databasebomwill now autodetect when STDIN is open to outline an SBOM to avoid specifying it with a dash (#260, @puerco)Bug or Regression
Other (Cleanup or Flake)
registry.com/repository/image@sha256:digest(#289, @puerco)Dependencies
Added
d852ddbChanged
5ec99f8→104605a76db087→637eb222b998c6→ v0.7.7Removed
v0.5.1Compare Source
What's Changed
Full Changelog: kubernetes-sigs/bom@v0.5.0...v0.5.1
v0.5.0Compare Source
Changes by Kind
Feature
bomnow embeds the latest SPDX license list. This avoids pulling the license list from the internet, speeding up SBOM generationbommage file now has aCheckEmbeddedDataandUpdateEmbeddedDatatargets to ease the management of the embedded data. (#255, @puerco)--license-list-version(#245, @puerco)bom document outlinenow displays version numbers along package names by default. This can be turned off with--version=falseoultinesubcommand has a new---purlflag which will display purls instead of package names when outlining an SBOM (#212, @puerco)Documentation
bomnow has a logo! 🎉 (#222, @puerco)Bug or Regression
NOASSERTION. (#203, @puerco)spdx.recursiveIDSearchwhich lead to panics when generating sboms describing multiple artifacts. (#244, @puerco)Other (Cleanup or Flake)
PackageVerificationCodein the package JSON types (both in 2.2 and 2.3) has been changed and is now a pointer. This is a breaking change for anything depending on the bom types. This fixes a bug where JSON SBOMs contained an empty package verification code struct.PACKAGE-MANAGERandPACKAGE-MANAGERin the category field. Output is always SPDX 2.3 which calls forPACKAGE-MANAGERin the schema. (#221, @puerco)Uncategorized
bomwould panic when generating an SBOM of an image specified with a digest. (#225, @sbs2001)Dependencies
Added
76db087Changed
2b998c6Removed
New Contributors
Full Changelog: kubernetes-sigs/bom@v0.4.1...v0.5.0
v0.4.1Compare Source
Release Notes
Changes by Kind
Bug or Regression
--log-level=debugto see all messages (#189, @puerco)Dependencies
Added
Nothing has changed.
Changed
Removed
Nothing has changed.
v0.4.0Compare Source
Release Notes
Changes by Kind
API Change
Feature
bom document query/outline. (#170, @saschagrunert)bomSBOMs similar to what other tools are doing now (#143, @puerco)spdx&#​43;jsondocuments which means that they can be outlined and queried just as their tag-value counterparts. (#133, @puerco)bomnow generates SBOMs conformant to SPDX version 2.3 🎉Bug or Regression
Nameonly has the name as expected (#138, @puerco)FileTypein compressed tars was not categorized asARCHIVE(#156, @puerco)google/licenseclassifierv2 prereleases. (#161, @puerco)bomwould throw a fatal error if nogo.sumfile was found. Now it returns an empty dependency list and generates the SBOM from the repository correctly. (#162, @puerco)Dependencies
Added
Changed
e495a2d→ v0.1.086c51ed→ v0.6.01d687d4→ v0.1.0622c5d5→ v0.1.00976fa6→ v0.1.0bc2c85a→ v0.1.003fcf44→ v0.1.0f3a8303→5ec99f8Removed
666a987