)

The v0.13.0 migration requalified code but not prose, so twenty-one doc
comments across sixteen files still described live types as sdk.Package,
sdk.Finding, sdk.HostContext and the like — qualifiers that now resolve to
nothing, sending a reader looking for the type to a package that no longer
exists.

Two references are left exactly as they are: both say sdk.ParsePackageURL
"was the deprecated anchore-fork entry point and is gone", which is a
statement about history and true as written.

Co-authored-by: Claude Opus 5 <[email protected]>

* build(deps)!: adopt bomly-sdk v0.14

The SDK embeds the component-level assertions in model.Assertions and
folds an entry's packages into the registry itself. Every read, write and
composite literal here compiles unchanged through promotion; the one
place that restated the fold -- BuildPackageRegistry's loop over
entry.Packages -- now calls PackageRegistry.AddEntryPackages, the SDK's
one door, after the nodes have seeded their packages.

Pinned to the SDK branch head as a pseudo-version until v0.14.0 tags; the
pin is re-pointed at the tag before this merges.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* feat(git): record the commit a scan ran against

A scan of a git target knew the ref that was asked for and never the
commit it resolved to: the clone checked it out and forgot it, and a
local checkout was never asked. ExecutionTarget now carries the clone's
HEAD for a --url scan and the working tree's HEAD for a --path inside a
repository, through the SDK's NormalizeCommitSHA gate so a ref name or a
path can never be recorded as a commit. A plain directory records none,
which is not an error.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* feat(sbom): keep what an ingested document says about its packages

The SBOM detector converted a document to a graph and, with it, dropped
the advisories, VEX analysis and end-of-life records the document carried
per component: the codec read them and the graph had nowhere to put them.
sbom.ToGraphEntry returns the entry with those facts in its packages, and
the two normalizers that rebuilt the entry now carry Packages through, so
consolidation folds them into the registry and a scan of a document that
said a package was not affected can say so too.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* feat(output)!: emit the scan record

`bomly scan --format json` wrote a document defined here: three
collections, each a CLI-local projection of an SDK type with its own
tags, builders and tests, carrying nothing about the run that produced
it -- no subject, no timestamp, no tool version, no verdict. The SDK now
defines that document as scan.Record, with the envelope, under
bomly.scan.v1 (ADR-0046).

The scan command builds the record from the pipeline's consolidated
manifests, registry and findings; fills subject from the execution target
-- repository, ref, the commit it resolved to, never a local path -- run
from the invocation, and verdict from the same count the exit code uses;
and writes it through scan.Encode, so equal content produces equal bytes.
The projection types are gone: a manifest and its dependencies are
scan.Manifest and scan.Dependency, a package is model.Package as the
registry holds it with raw resolution evidence stripped, a finding is
model.Finding referencing its package by URL, and the one thing the old
projection did beyond re-shaping -- backfilling a finding's severity from
its advisory -- is FindingsWithSeverity, applied wherever findings enter
a document. The diff and explain documents adopt the same shapes. A
resolver's decision now rides the finding it settled.

The renderers derive a package's display identity from its coordinates
rather than reading it from the document. The schema generator treats
omitzero as optional. Schemas and the affected goldens are regenerated;
the smoke normalizer scrubs the run block, the section digests and the
duration, which follow content the goldens already scrub.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* fix(scan): the repository URL is recorded without its credentials

A --url carrying userinfo -- https://user:token@host/repo.git -- was
cloned with it, as it must be, and then kept verbatim on the execution
target, so the token reached every plugin's request and, once the scan
record carried a subject, the scan JSON. git.PublicURL strips the
userinfo through net/url and leaves anything that is not a URL with a
scheme as it was; the target is built with it, and the subject applies
it again for a target built elsewhere.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* fix(mcp): explain findings carry the advisory's severity

The MCP explain result stored a target's findings as the pipeline left
them, while the explain command passes them through FindingsWithSeverity,
so a vulnerability finding that stated no severity read as severity-less
over MCP and as the advisory's severity in the terminal. Both surfaces
now take the same path.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* test(output): the finding contract tests exercise the document path again

Both tests asserted on literal findings once FindingsFromScan was gone,
which no production code touched. They now take the findings through
FindingsWithSeverity, the function every document path applies, and the
rule-identity test also checks a missing severity is filled from the
advisory.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* docs: the jq example filters on parsed_severity; SBOM conversion notes agree with ingest

The vulnerability severity in scan JSON is parsed_severity now that the
packages section carries SDK packages; the example filtered on a key that
is an array of source ratings. The SBOM round-trip notes still said
end-of-life data is never read back and that an SPDX document yields one
license taken from the concluded field; both are read back now, and the
notes say so once.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* build(deps): pin the SDK head that carries the review fixes; goldens follow

The SDK gained the review round's fixes: VEX analyses stay with the
component that asserted them, the record's digests are taken over its
decoded form, scope and CPE sets are sorted, and "deb" is an alias of the
dpkg package manager. The Debian container golden records dpkg -- the
digest round trip is what found that the record it wrote could not be
read back -- and two reachability goldens pick up advisories published
since they were last generated. Still a pseudo-version: the re-pin to
v0.14.0 follows the tag.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* build(deps): pin the SDK head after its second review round

Section digests are now verified over the bytes as written, so a record
from a later minor still reads; findings, waivers and a dependency's
locations have a total order; Compare rebuilds module nodes. The conan
golden moves one location ahead of another under the new order and
nothing else changes. Still a pseudo-version: the re-pin to v0.14.0
follows the tag.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* fix(support): the generated schema types a timestamp as a string

The reflection walk saw time.Time as the struct it is and published the
scan record's run timestamps as empty objects, which every emitted record
then failed to match; a time encodes as an RFC 3339 string and the
schema and its reference now say so.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* fix(scan): a container subject names the image it scanned

A tag-pinned image has no digest to record, so the subject carried only
its kind and two tagged images' records could not be told apart. The
reference as given is a public identity, not a local path; the subject
carries it, and the digest beside it when the reference pins one.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* build(deps): pin the SDK head after its third review round; schemas and goldens follow

The SDK's subject gates its commit and names an image, a dependency's
source and a source's own remediation guidance travel with the record,
and license claims have a fixed order. The schemas gain those fields and
type timestamps as strings; the goldens reorder license claims, and the
container goldens record the image reference. Still a pseudo-version:
the re-pin to v0.14.0 follows the tag.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* docs(adr): the stability claim covers the section digests, not the whole document

Every run writes its own run ID and timestamps, so a consumer that
hashed the full document on the ADR's word saw a change every time; the
collections and their digests are what identify the content.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* fix(render): a remediation label keeps a scoped package's org

The label read Name, which for a scoped npm package is the bare name;
@tailwindcss/[email protected] printed as [email protected] where the removed
projection had it right. DisplayName is the ecosystem-aware spelling.
The diff and explain labels were already built from it.

Closes #484.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* feat(scan): a manifest carries the source document's assertions; pin the SDK head that defines them

An ingested SBOM's own claims -- identity, version, checksum, creators,
data license, format -- now ride on the manifest built from it, so the
record restates the document's provenance and not only its contents. The
SDK head also fails a verdict closed on a policy status outside the
vocabulary. The SBOM scan goldens gain the document block; the schemas
follow. Still a pseudo-version: the re-pin to v0.14.0 follows the tag.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* build(deps): pin the SDK head where packages gate and order their vulnerabilities

Advisories compare by (package, source, ID), a package's vulnerabilities
pass their recommendation gate and take a fixed order at the registry's
door, and CycloneDX copies fold by what the format publishes. No golden
moved. Still a pseudo-version: the re-pin to v0.14.0 follows the tag.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* build(deps): pin the SDK head where encoding leaves a package untouched

Package.MarshalJSON no longer reorders the holder's vulnerabilities, and a
dependency's license claims in a record take the set's order. Still a
pseudo-version: the re-pin to v0.14.0 follows the tag.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* build(deps): pin the SDK head where a node's scope set is held in one order

No golden moved. Still a pseudo-version: the re-pin to v0.14.0 follows
the tag.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* fix(scan): a public repository URL keeps only the repository identity

PublicURL cleared the userinfo and returned, so a token in a query
parameter stayed on the execution target, reached plugins, and was
published as the subject's repository URL. The query and the fragment go
too: neither names a repository, and either can carry a credential.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* build(deps): pin the SDK head where VEX timestamps are date-times and a document records its declared version

Still a pseudo-version: the re-pin to v0.14.0 follows the tag.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* build(deps): pin bomly-sdk v0.14.1

The released tag carries everything this PR adopted: the scan record,
the byte-stable graph encoding, the decode bounds, the VEX analysis, the
ingested document's assertions on its manifest, and the review-round
fixes. A pseudo-version no longer stands in for it.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* fix(engine): an imported VEX assessment survives advisory consolidation

Consolidating alias-equivalent advisories kept the richer record's
fields and knew nothing of Analysis or Recommendation, so an ingested
document's not_affected was lost to an OSV or Grype record for the same
advisory under --enrich. The merge now carries both through the SDK's
own rules: the assessment as one claim, the recommendation fill-gaps.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* build(deps): pin bomly-sdk v0.14.3

The scan schema gains dependencies[].relationship and the registry's
door folds a repeated advisory.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* feat(scan): a dependency's source and relationship travel with the record

The CLI's own projection filled neither, while the SDK's builder writes
both; a record the CLI emitted compared without them. The goldens gain
the two keys.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* test(smoke): the advisory normalizer scrubs the SDK's field names

The normalizer still scrubbed description and the scalar severity of the
removed projection, so enriched goldens pinned live advisory text under
details and the live band under parsed_severity, and an upstream edit
would have failed the network-driven jobs. It scrubs details, summary and
parsed_severity, and treats severity as the array of source ratings it
now is.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* refactor(output): name the SDK's types directly instead of aliasing them

internal/output re-exported scan.Record, scan.Manifest, scan.Dependency,
model.Package, model.Finding, scan.AuditSummary, model.PackageLicense,
model.PackageLocation, model.SourcePosition, model.Vulnerability and
scan.Metadata under the names its old projections had, which the
repository's shared-types rule forbids and which hid which module owns
the scan contract. Renderers, the MCP server, the TUI and the tests name
the owning types; no behavior changes.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* test(smoke): regenerate the Python scan goldens as scan records

The five Python cases are skipped without pip, pipenv, poetry and uv on
PATH, so every earlier regeneration passed over them and they kept the
pre-record shape the Python smoke jobs would have failed against. They
now carry the record envelope; each lists the same packages as before.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

* build(deps): pin bomly-sdk v0.14.5

A record dependency's relationship passes its vocabulary gate (v0.14.4),
and a vulnerability's free text and reference URLs pass their gates in
its codec (v0.14.5, bomly-sdk#101). No golden or schema moved.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* feat(output): every collection in a JSON document is written, as [] when empty

A user's automation iterates these documents, and a collection that was
omitted when empty -- or written as null -- broke `jq '.findings[]'` on
exactly the run that found nothing. Every collection in the scan, diff
and explain documents is now always present: the scan record through the
SDK (scan.IteratedCollections, scan.Package for packages), the diff and
explain documents through fillEmptyCollections, which writes a nil slice
held by this package's document types as []. Slice fields in those types
lose omitempty, and TestDocumentCollectionsAreAlwaysArrays fails any that
regains it or any document that encodes a null.

Recorded as a standing rule in AGENTS.md/CLAUDE.md, docs/SCHEMAS.md and
ADR-0046. SARIF keeps its own specification's shape. The 59 regenerated
goldens differ from the previous ones only by the 8,417 empty arrays now
written; no other value moved. The SDK is pinned to bomly-sdk#106's head
until it tags.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* build(deps): pin bomly-sdk v0.14.6

The released tag carries the always-present collections this PR's
documents use (scan.IteratedCollections, scan.Package) and the review
fixes made on bomly-sdk#106. No golden or schema moved.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

---------

Co-authored-by: Claude Fable 5.1 <[email protected]>

…ry (#478)

Bumps the pip group with 1 update in the /.github directory: [anyio](https://github.com/agronholm/anyio).


Updates `anyio` from 4.14.1 to 4.14.2
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](agronholm/anyio@4.14.1...4.14.2)

---
updated-dependencies:
- dependency-name: anyio
  dependency-version: 4.14.2
  dependency-type: indirect
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

#482)

Bumps the github-actions-patch group with 1 update: [actions/setup-java](https://github.com/actions/setup-java).


Updates `actions/setup-java` from 6.0.0 to 6.0.1
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@dd06d9c...de7274f)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps the github-actions-minor group with 4 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action), [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) and [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv).


Updates `github/codeql-action/init` from 4.37.7 to 4.38.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@ff2f1c6...1c5b675)

Updates `github/codeql-action/analyze` from 4.37.7 to 4.38.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@ff2f1c6...1c5b675)

Updates `github/codeql-action/upload-sarif` from 4.37.7 to 4.38.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@ff2f1c6...1c5b675)

Updates `astral-sh/setup-uv` from 10.0.1 to 10.1.0
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@20cfd1b...bec219d)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.38.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-minor
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.38.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-minor
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.38.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-minor
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…479)

Bumps [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) from 1.44.0 to 1.45.0.
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0)

---
updated-dependencies:
- dependency-name: go.opentelemetry.io/otel/sdk
  dependency-version: 1.45.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps the gomod-minor group with 1 update in the / directory: [github.com/mark3labs/mcp-go](https://github.com/mark3labs/mcp-go).


Updates `github.com/mark3labs/mcp-go` from 1.0.0 to 1.1.1
- [Release notes](https://github.com/mark3labs/mcp-go/releases)
- [Commits](mark3labs/mcp-go@v1.0.0...v1.1.1)

---
updated-dependencies:
- dependency-name: github.com/mark3labs/mcp-go
  dependency-version: 1.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps the pip group with 3 updates in the /.github directory: [dulwich](https://github.com/dulwich/dulwich), [urllib3](https://github.com/urllib3/urllib3) and [virtualenv](https://github.com/pypa/virtualenv).


Updates `dulwich` from 1.2.6 to 1.2.9
- [Release notes](https://github.com/dulwich/dulwich/releases)
- [Changelog](https://github.com/jelmer/dulwich/blob/main/NEWS)
- [Commits](jelmer/dulwich@dulwich-1.2.6...dulwich-1.2.9)

Updates `urllib3` from 2.7.0 to 2.8.0
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.7.0...2.8.0)

Updates `virtualenv` from 21.5.1 to 21.7.13
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@21.5.1...21.7.13)

---
updated-dependencies:
- dependency-name: dulwich
  dependency-version: 1.2.9
  dependency-type: indirect
  dependency-group: pip
- dependency-name: urllib3
  dependency-version: 2.8.0
  dependency-type: indirect
  dependency-group: pip
- dependency-name: virtualenv
  dependency-version: 21.7.13
  dependency-type: indirect
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>