Releases: spdx/ntia-conformance-checker
Release list
v5.0.3
This patch release fixes an issue where an incorrect expectation was placed on the rootElement of an SpdxDocument during SPDX 3 validation (see PR #388 for details). -- Because of this bug fix, some existing SPDX documents may now report a different conformance status than they did previously.
It contains no new features or security updates.
Install/upgrade:
pip install -U ntia-conformance-checker- API document: https://spdx.github.io/ntia-conformance-checker/
- Report issues: https://github.com/spdx/ntia-conformance-checker/issues
What's changed
- README: Add SPDX 3 multiple SBOMs limitation notes by @bact in #391
- Aligned SpdxDocument's rootElement validation with SPDX 3 by @bact in #388
Full Changelog: v5.0.2...v5.0.3
Contributors
Assets 2
v5.0.2
This patch release improves validation for SPDX 3 Elements to prevent AttributeError when expected properties are missing. It contains no new features or security updates.
Install/upgrade:
pip install -U ntia-conformance-checker- API document: https://spdx.github.io/ntia-conformance-checker/
- Report issues: https://github.com/spdx/ntia-conformance-checker/issues
What's changed
Full Changelog: v5.0.1...v5.0.2
Contributors
Assets 2
v5.0.1
This patch release improves type annotation accuracy for developers using the NTIA Conformance Checker as a library. It contains no new features or security updates.
We've added the AI usage policy and AGENTS.md to the repository.
Install/upgrade:
pip install -U ntia-conformance-checker- API document: https://spdx.github.io/ntia-conformance-checker/
- Report issues: https://github.com/spdx/ntia-conformance-checker/issues
What's changed
- Add Windows setup instructions to CONTRIBUTING.md by @Arnav1343 in #359
- Remove pytype from CI, Makefile, and docs by @bact in #365
- Refactor get_spdx_version() by @bact in #364
- Fix type issues reported by mypy strict=true by @bact in #363
- Add AGENTS.md for AI agents + AI usage policy by @bact in #366
- Set setuptools-scm to properly manage version by @bact in #368
- Fix Sphinx version to support Python 3.10 by @bact in #369
- Update changelog for v5.0.1 by @bact in #370
- Fix CLI usage on README by @bact in #371
New contributors
- @Arnav1343 made their first contribution in #359
Full Changelog: v5.0.0...v5.0.1
Contributors
Assets 2
v5.0.0
This major release focuses on codebase modernization and API consistency to ensure more predictable behavior. Key updates include standardizing BaseChecker.get_components_without_* methods to return a list of (str, str) tuples and improving JSON serialization for BaseChecker.validation_messages to map attributes to individual fields.
To align with other list-based properties, BaseChecker.parse_error is now deprecated in favor of the plural form BaseChecker.parse_errors. The package is also now fully typed with the py.typed marker to assist static type checkers.
Following the end of security support for Python 3.9, this release officially supports Python 3.10 through 3.14. This aligns our compatibility range with spdx-tools 0.8.5.
See breaking changes in version 5.0.0 and migration information in CHANGELOG.md.
Install/upgrade:
pip install -U ntia-conformance-checker- API document: https://spdx.github.io/ntia-conformance-checker/
- Report issues: https://github.com/spdx/ntia-conformance-checker/issues
What's changed
- Add cooldown settings for Dependabot updates by @jspeed-meyers in #329
- Serialize ValidationMessage to JSON by @bact in #331
- Use type hinting generics for collections and X | Y for union by @bact in #339
- Move typecheck imports to its own block by @bact in #343
- Simplify get_components_without_* API by @bact in #341
- Add py.typed type hint marker by @bact in #346
- Refactor exception handling to remove beartype direct dependency by @bact in #345
- Move Pylint settings to pyproject.toml by @bact in #353
- test: add real-world SBOM robustness tests (Addresses #334) by @InduwaraGunasena in #352
- Update spdx-tools to 0.8.5 by @bact in #356
- Deprecate parsing_error and ntia_minimum_elements_compliant by @bact in #357
New contributors
- @InduwaraGunasena made their first contribution in #352
Full Changelog: v4.1.2...v5.0.0
Contributors
Assets 2
v4.1.2
This version is likely the last version supporting Python 3.9.
Python 3.9 reached end-of-life in October 2025, and its support will be dropped in the next major release.
See notable changes in version 4.1 in CHANGELOG.md.
What's Changed
Full Changelog: v4.1.1...v4.1.2
Contributors
Assets 2
v4.1.1
This version is likely the last version supporting Python 3.9.
Python 3.9 reached end-of-life in October 2025, and its support will be dropped in the next major release.
What's Changed
Full Changelog: v4.1.0...v4.1.1
Contributors
Assets 2
v4.1.0
Notable Changes
- This version primarily focused on improving the HTML output.
- This version is likely the last version supporting Python 3.9.
Python 3.9 reached end-of-life in October 2025, and its support will be dropped in the next major release. - See more notable changes in CHANGELOG.md.
What's Changed (All)
- Fix SPDX 3 command line example in README by @bact in #296
- Add CITATION.cff for standardised citation by @bact in #298
- Bump actions/setup-python from 5.6.0 to 6.0.0 by @dependabot[bot] in #303
- Bump pypa/gh-action-pypi-publish from 1.12.4 to 1.13.0 by @dependabot[bot] in #302
- Bump pytest from 8.4.1 to 8.4.2 by @dependabot[bot] in #301
- Update coverage version to 7.10.6 by @bact in #304
- Fix Sphinx version to 7.4.7 to compatible with Python 3.9 by @bact in #306
- Refactor output functions by @bact in #307
- Use detected SPDX version if found by @bact in #309
- Fix verbosity option bug by @bact in #308
- Write HTML output to file with --output-file option by @bact in #311
- Bump coverage from 7.10.6 to 7.10.7 by @dependabot[bot] in #312
- Update pyright version to 1.1.406 by @bact in #314
- Bump psf/black from 25.1.0 to 25.9.0 by @dependabot[bot] in #313
- Bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @dependabot[bot] in #316
- Bump beartype from 0.21.0 to 0.22.2 by @dependabot[bot] in #315
- Bump actions/upload-artifact from 4.6.2 to 5.0.0 by @dependabot[bot] in #317
- Update dependencies for Python 3.9 by @bact in #318
- Bump psf/black from 25.9.0 to 25.11.0 by @dependabot[bot] in #322
- Include missing components in the HTML output by @bact in #323
Full Changelog: v4.0.0...v4.1.0
Contributors
Assets 2
v4.0.0
Notable Changes
- SPDX 3.0 SBOM specification is now supported, utilizing spdx-python-model.
- Improved support of CISA SBOM Framing Software Component Transparency 2024 (FSCT3Checker).
- Minimum Python version requirement is now 3.9.
- The next major version of ntia-conformance-checker may adopt PEP 585 and PEP 604 which will require Python 3.10.
- See more notable changes in CHANGELOG.md.
SPDX 3 support and the improved FSCT3Checker are contributions by @bact for Google Summer of Code (GSoC) 2025. This work was made possible with the mentorship and support of @jspeed-meyers, @goneall, @JPEWdev, and @rtgdk. We would like to thank all the mentors, GSoC, the Linux Foundation, and the SPDX community for their support.
What's Changed (All)
- Bump actions/upload-artifact from 4.6.1 to 4.6.2 by @dependabot[bot] in #262
- Bump actions/setup-python from 5.4.0 to 5.5.0 by @dependabot[bot] in #263
- Bump actions/setup-python from 5.5.0 to 5.6.0 by @dependabot[bot] in #264
- Bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @dependabot[bot] in #265
- Add malware scanner to GitHub Actions by @jspeed-meyers in #266
- Bump chainguard-dev/malcontent-action from 0.3 to 0.4 by @dependabot[bot] in #267
- Minor edit to README by @jspeed-meyers in #269
- Suppress beartype errors in tests by @bact in #273
- Add type hints by @bact in #272
- Print validation context along with validation message by @bact in #274
- Print validation context only if verbose = True by @bact in #276
- Bump actions/checkout from 4.2.2 to 4.3.0 by @dependabot[bot] in #278
- Bump actions/checkout from 4.3.0 to 5.0.0 by @dependabot[bot] in #279
- Add SPDX version detector by @bact in #277
- Delete malcontent malware analysis workflow by @jspeed-meyers in #280
- Add static type check workflow by @bact in #281
- Separate SPDX 2-specific code to make room for SPDX 3 code by @bact in #282
- Test package on multiple Python versions by @bact in #283
- Add SPDX 3 JSON parse function by @bact in #284
- Update workflows by @bact in #285
- Update README and CLI description by @bact in #287
- Add missing copyrightTexts and concludedLicenses in output by @bact in #288
- Implement all SPDX 3 getters by @bact in #290
- Update Changelog for v4.0.0 by @bact in #291
- Update development docs by @bact in #292
- Update SPDX 3 test data README by @bact in #293
- Add Makefile for lint, type checks, and formatting by @bact in #294
- Update release cutting how-to by @bact in #295
Full Changelog: v3.2.0...v4.0.0
Contributors
Assets 2
v3.2.0
What's Changed
- Bump actions/upload-artifact from 4.5.0 to 4.6.0 by @dependabot in #234
- Add Sphnix workflow to publish API documentation by @bact in #237
- Add API doc to README by @bact in #238
- Pin dependencies by @bact in #239
- Give back contents write persmission to apidoc workflow by @bact in #241
- Bump pypa/gh-action-pypi-publish from 1.12.3 to 1.12.4 by @dependabot in #243
- Move deps to requirements txt by @bact in #245
- Add hashes to requirements.txt by @bact in #247
- Set permissions: contents: read at workflow top level by @bact in #246
- Ignore SBOM test data dirs when OSV scan by @bact in #250
- CI: Revert to simple pip install by @bact in #249
- Set IgnoredVulns in osv-scanner config by @bact in #252
- Add online tool in README by @bact in #253
- Put OSV-Scanner config files to the scanned file’s directory by @bact in #255
- Bump psf/black from 24.10.0 to 25.1.0 by @dependabot in #256
- Bump actions/upload-artifact from 4.6.0 to 4.6.1 by @dependabot in #258
- Bump ossf/scorecard-action from 2.4.0 to 2.4.1 by @dependabot in #257
- Ignore a false positive CVE finding by @jspeed-meyers in #259
- Update Pylint Score to 10 by @bact in #260
- Bump release version by @jspeed-meyers in #261
Full Changelog: v3.1.0...v3.2.0
Contributors
Assets 2
v3.1.0
What's Changed
- Pin GitHub Actions workflows by @jspeed-meyers in #206
- Add GitHub Actions updates to dependabot by @jspeed-meyers in #207
- Bump ossf/scorecard-action from 2.3.1 to 2.4.0 in #212
- Bump actions/checkout from 2.7.0 to 4.2.2 in #211
- Bump pypa/gh-action-pypi-publish from 1.4.2 to 1.11.0 in #210
- Bump tj-actions/bandit from 5.1 to 5.5 in #209
- Bump actions/upload-artifact from 97a0fba1372883ab732affbe8f94b823f91727db to c24449f33cd45d4826c6702db7e49f7cdb9b551d in #208
- Bump actions/upload-artifact from 3.2.1.pre.node20 to 4.4.3 in #215
- Bump actions/setup-python from 3.1.4 to 5.3.0 in #216
- Make bandit Github Action read-only by @jspeed-meyers in #217
- Update SECURITY.md supported versions by @jspeed-meyers in #213
- Make permissions read-only for black linter by @jspeed-meyers in #218
- Update CodeQL GitHub Actions by @jspeed-meyers in #219
- Bump pypa/gh-action-pypi-publish from 1.11.0 to 1.12.2 in #220
- Update permissions on pylint GitHub Action by @jspeed-meyers in #221
- Fix typo: generare -> generate in README by @bact in #225
- Bump pypa/gh-action-pypi-publish from 1.12.2 to 1.12.3 in #229
- Add FSCTv3 Common SBOM Baseline Attributes checker by @bact in #224
- Include FSCT3 information in README by @bact in #226
- Bump actions/upload-artifact from 4.4.3 to 4.5.0 in #231
- Update release version in pyproject.toml to 3.1.0 by @jspeed-meyers in #232
- Add Takashi's SBOM requirements comparison slide to README by @bact in #233
New Contributors
- @bact made their first contribution in #225. In fact, @bact rewrote and improved the entire codebase :) So thank you!!!!!
Full Changelog: v3.0.2...v3.1.0