v38.0.0

What's Changed

• fix: add setup-buildx step to enable GHA cache support by @tdruez in #2176
• Migrate VulnerableCode integration to API v3 by @tdruez in #2148
• feat: denormalize project counts to improve performances by @tdruez in #2178
• feat: UI refinements for project list and detail pages by @tdruez in #2180
• chore: upgrade service images to latest version by @tdruez in #2183
• feat: auto-fill project PURL from single input URL by @tdruez in #2185
• feat: render the compliance alert value as a colored label by @tdruez in #2186
• feat: add pipeline availability check with disabled state in UI by @tdruez in #2188
• feat: replace django-taggit with a plain Project.labels JSONField by @tdruez in #2189
• feat: move scanpipe settings to local settings.py with lazy resolutio… by @tdruez in #2187
• fix: ClamAV scan crash on codebase root directory by @tdruez in #2190
• chore: upgrade vulnerable dependencies by @tdruez in #2191
• fix: harden SSRF mitigation against redirect and URL-parser bypasses by @tdruez in #2192
• Fix spelling typos in docs, models, and pipes by @mr-raj12 in #2046
• Fix get_data_from_manifests returning wrong type on early exit by @prajakta128 in #2182
• docs: update Errors section to Messages in Web UI tutorial by @dikshaa2909 in #2066
• Fix flag_and_ignore_files_over_max_size inconsistent return value and docstring by @prajakta128 in #2184
• fix: silent overwrite when two input sources share the same filename by @tdruez in #2193
• fix: xlsx_errors column overwriting last data field in XLSX export by @tdruez in #2194

New Contributors

• @mr-raj12 made their first contribution in #2046
• @prajakta128 made their first contribution in #2182
• @dikshaa2909 made their first contribution in #2066

Full Changelog: v37.2.0...v38.0.0

v37.2.0

What's Changed

• chore: upgrade scancode-action to docker base v0.1 release by @tdruez in #2141
• feat: add "base" Docker build stage by @tdruez in #2142
• fix: fallback to license_declared when loading SPDX SBOM by @tdruez in #2144
• feat!: Switch development workflow from local venv to Docker Compose by @tdruez in #2145
• fix: relax validation for non-HTTP URLs by @tdruez in #2147
• fix: load the .env in the Docker dev compose by @tdruez in #2149
• chore: upgrade Django and cryptography to latest version by @tdruez in #2150
• fix: replace the hardcoded /var/www/html by named volume by @tdruez in #2160
• chore: bump minecode-pipelines version to 1.0.0 by @JonoYang in #2170
• chore: update minecode-pipelines version to 1.0.1 by @JonoYang in #2171
• Install Java and jadx in Dockerfile #1812 by @JonoYang in #2174
• chore: upgrade dependencies by @tdruez in #2173
• chore: bump version to v37.2.0 for release by @tdruez in #2175

Full Changelog: v37.1.0...v37.2.0

v37.1.0

What's Changed

• feat: display scio and toolkit versions in place of django version by @tdruez in #2101
• Fix missing space in scan_max_file_size help text by @rishabh23rohil in #2097
• Add tests for chunked and get_purls utilities by @rishabh23rohil in #2100
• feat: display layers information (created_by, comment) in tree view by @tdruez in #2102
• feat: enhance the global HTML structure by @tdruez in #2103
• feat: remove the need for context processor and improve base template by @tdruez in #2106
• chore: upgrade the scancode-action to latest version (pinned deps) by @tdruez in #2124
• fix: XSS and duplicate file detection in file upload UI by @tdruez in #2129
• fix: incomplete URL sanitization for Slack webhook detection by @tdruez in #2130
• chore: correct typo in pipes/clamav by @OmAnand857 in #2121
• feat: is_safe_url to mitigate SSRF in URL requests by @tdruez in #2131
• add search to resource tree by @aayushkdev in #2114
• feat: enhance tree search rendering and implementation by @tdruez in #2133
• feat!: use uv and uv.lock for reproducible builds in Docker image by @tdruez in #2134
• fix: add support for sqlite in the apitoken data migration by @tdruez in #2138
• feat!: convert Dockerfile to multi-stage build by @tdruez in #2139
• chore: bump version to v37.1.0 for release by @tdruez in #2140

New Contributors

• @rishabh23rohil made their first contribution in #2097
• @OmAnand857 made their first contribution in #2121

Full Changelog: v37.0.0...v37.1.0

v37.0.0

v37 Breaking Changes:

• Drop support for Python3.10 and Python3.11

What's Changed

• Improving d2d mapping for npm GitHub by @Aryan-SINGH-GIT in #2003
• chore: upgrade django to version 6.x by @tdruez in #2052
• fix: upgrade python in the rtd config file by @tdruez in #2053
• Match MacOS binary symbols to Go TypeScript symbols by @AyanSinhaMahapatra in #2056
• Bump android_inspector to v0.2.0 by @keshav-space in #2069
• chore: automatically closes low-quality and AI slop PRs by @tdruez in #2072
• chore: upgrade RQ, Redis, and more to their latest version by @tdruez in #2073
• fix: failing test by updating the expectation fixture by @tdruez in #2084
• chore: upgrade Django to latest version by @tdruez in #2085
• feat: remove the chown service in compose file by @tdruez in #2086
• fix: URL-encode programming language filter values in resource list by @uttam282005 in #2079
• Rename 'Grammar' optional step group to 'Antlr' by @Monal-Reddy in #2059
• feat!: replace plain-text DRF token with PBKDF2-hashed API token by @tdruez in #2087
• chore: set explicit workflow permissions and pin down actions by @tdruez in #2090
• chore: bump version to v37.0.0 for release by @tdruez in #2091

New Contributors

• @uttam282005 made their first contribution in #2079
• @Monal-Reddy made their first contribution in #2059

Full Changelog: v36.1.0...main

v36.1.0

This is a new minor release of scancode.io with:

• updated scancode-toolkit
• performance and quality improvements in package, license, copyright detection
• support for python3.14

What's Changed

• Handled the logger generated class in D2D by @chinyeungli in #1996
• Upgrade scancode-toolkit to latest v32.4.1 release by @tdruez @AyanSinhaMahapatra in #1984
• fix: exclude certain file patterns from map_deploy_to_develop (Java) by @chinyeungli in #1995
• Regen test fixtures and fix tests after scancode-toolkit upgrade by @AyanSinhaMahapatra in #1997
• fix: Sanitize ORT package IDs to handle colons in versions by @FabianRolfMatthiasNoll in #2005
• Perform basic mapping before normalizing mapping by @chinyeungli in #1999
• Update minecode pipelines with stable release v0.1.1 by @AyanSinhaMahapatra in #2013
• Fix typos in docstrings for pathmap.py by @pranavkeerti66-hue in #1985
• Store the whole vulnerability data from cdx to local models by @tdruez in #2007
• Add project vulnerability list view by @tdruez in #2018
• Improve class file mapping by @chinyeungli in #2021
• Restructure documentation index by @AyanSinhaMahapatra in #2028
• Update README.rst to improve structure by @DennisClark @AyanSinhaMahapatra in #2032
• Update scancode-toolkit with faster package scan by @AyanSinhaMahapatra in #2000

New Contributors

• @pranavkeerti66-hue made their first contribution in #1985
• @DennisClark made their first contribution in #2032

Full Changelog: v36.0.1...v36.1.0

v36.0.1

What's Changed

• Add support for authors in ORT package list generation by @FabianRolfMatthiasNoll in #1988
• Store non-supported fields in the comment SPDX field by @tdruez in #1989
• Add support for CycloneDX spec v1.7 by @tdruez in #1975
• Add authors field to the CycloneDX output by @tdruez in #1990
• Bump version for v36.0.1 release by @tdruez in #1991

New Contributors

• @FabianRolfMatthiasNoll made their first contribution in #1988

Full Changelog: v36.0.0...v36.0.1

v36.0.0

What's Changed

• Upgrade multiple dependencies to their latest version by @tdruez in #1972
• Upgrade PostgreSQL from 13 to 17 in Docker compose file by @tdruez in #1973
• Upgrade Django to latest 5.2.x version by @tdruez in #1976
• Remove the dependency on scipy #1754 by @tdruez in #1977
• Add "ort-package-list" to the formats list in run command by @tdruez in #1982
• Bump version for v36.0.0 release by @tdruez in #1983

Full Changelog: v35.5.0...v36.0.0

v35.5.0

What's Changed

• Add script for D2D with SCIO using docker container by @TG1999 in #1912
• Load the resource details in the tree browser view by @tdruez in #1919
• [CRAVEX] Generic CI/CD integration by @tdruez in #1944
• Move resource path in the URL path instead of query string by @tdruez in #1945
• Update "find_jvm_packages" to include all resources by @chinyeungli in #1921
• Refine D2D with Grammar (.g/.g4) Class Mapping #1808 by @chinyeungli in #1942
• Added "META-INF" and "module-info.class" to ignore list by @chinyeungli in #1943
• Create missing image and layer directory codebase resources by @tdruez in #1946
• Add arguments support for the reset action in REST API by @tdruez in #1948
• Use proper serializer_class for the ProjectViewSet by @tdruez in #1952
• Add management command to analyze Kubernetes cluster by @tdruez in #1950
• Only run code stemming on source files that we can handle in fingerprint_stemmed_codebase_resources by @JonoYang in #1961
• Close existing connection before job execution in worker by @rogu-beta in #1959
• Refine D2D with Xtend and Class Mapping #1906 by @chinyeungli in #1947
• Improve source mapping for .py and .pyi files by @Aryan-SINGH-GIT in #1920
• Keep webhook subscription in project reset by @tdruez in #1963
• Add --vulnerabilities option in verify-project by @tdruez in #1964
• Add a workflows to test the ORT to ScanCode.io integration by @tsteenbe in #1886
• Add new Inputs section in the documentation by @tdruez in #1965
• Add support for PyPI PURLs as Inputs by @tdruez in #1966
• Add JFrog Artifactory and Sonatype Nexus integrations documentation by @tdruez in #1970
• Bump version for v35.5.0 release by @tdruez in #1971

New Contributors

• @rogu-beta made their first contribution in #1959
• @tsteenbe made their first contribution in #1886

Full Changelog: v35.4.1...v35.5.0

v35.4.1

What's Changed

• Add utilities to create/init FederatedCode data repo by @keshav-space in #1896
• Refine d2d pipeline for scala and kotlin by @TG1999 in #1898
• Fix placeholder text for Download URLs field to use correct purl-spec… by @Aryan-SINGH-GIT in #1893
• Add a verify-project CLI management command by @tdruez in #1903
• Migrate SCA workflows verification to new verify-project management command by @tdruez in #1902
• Auto-detect pipeline from provided input #1883 by @tdruez in #1904
• [CRAVEX] SCA Integrations: cyclonedx-gomod by @tdruez in #1905
• Upgrade Django to latest v5.1.13 security release by @tdruez in #1909
• Update Java D2D Pipeline to Include Checksum Mapped Sources for Accurate Java Mapping by @chinyeungli in #1870
• Add ability to download all output results formats #1880 by @tdruez in #1910
• Add .. navigation option in table to navigate to parent resource by @aayushkdev in #1869
• Add the django-htmx app to the stack by @tdruez in #1917
• Add support for multiple inputs in the run management command by @tdruez in #1916

New Contributors

• @Aryan-SINGH-GIT made their first contribution in #1893

Full Changelog: v35.4.0...v35.4.1

v35.4.0

What's Changed

• [CRAVEX] SCA Integrations: Anchore by @tdruez in #1820
• [CRAVEX] SCA Integrations: CycloneDX cdxgen by @tdruez in #1824
• [CRAVEX] SCA Integrations: OWASP dep-scan by @tdruez in #1825
• Resolve and load dependencies from SPDX SBOMs #1145 by @tdruez in #1827
• [CRAVEX] SCA Integrations: SBOM tool by @tdruez in #1826
• [CRAVEX] SCA Integrations: OSV-Scanner by @tdruez in #1821
• Use deterministic UID/GID in Dockerfile #1555 by @tdruez in #1569
• Display the optional steps in the Pipelines autodoc #1822 by @tdruez in #1830
• Add new benchmark_purls pipeline #1804 by @tdruez in #1832
• Add left-pane file tree view and related templates by @aayushkdev in #1704
• Resources tree view enhancements by @tdruez in #1839
• [CRAVEX] SCA Integrations: Generic by @tdruez in #1841
• Improve the ORT CycloneDX support by @tdruez in #1843
• [CRAVEX] SCA Integrations: ORT (part.1) by @tdruez in #1837
• add path breadcrumbs and copy-to-clipboard button in resource_table_view by @aayushkdev in #1851
• Track the current browsing path in the browser URL by @aayushkdev in #1853
• Update federatedcode pipes by @JonoYang in #1831
• Add ORT package-list.yml output format by @tdruez in #1852
• Add support for SPDX as YAML in load_sbom pipeline by @tdruez in #1865
• SPDX 2.2 support and documentDescribes update to reference root element only by @tdruez in #1856
• Add a workflow for the ScanCode.io to ORT integration by @tdruez in #1866
• Collect purl metadata by @AyanSinhaMahapatra in #1868
• Pin click to version 8.2.1 #1885 by @JonoYang in #1887
• Avoid creating empty commits when pushing changes to FederatedCode by @keshav-space in #1888
• Bump version to v35.4.0 for release by @AyanSinhaMahapatra in #1892

Full Changelog: v35.3.0...v35.4.0