v0.2.7

What's Changed

• ci(release): use client-id for the tap-token GitHub App by @mstykow in #1285
• fix(output): make CycloneDX, SPDX, and Debian pass schema contracts by @mstykow in #1289

Full Changelog: v0.2.6...v0.2.7

v0.2.6

What's Changed

• ci(release): attest build provenance for the container image by @mstykow in #1263
• ci(release): auto-bump the Homebrew tap on stable releases by @mstykow in #1264
• docs(readme): make the container quick-start runnable, fix image-tag wording by @mstykow in #1265
• feat(scan): exclude the --license-policy file from its own detection by @mstykow in #1266
• fix(copyright): drop code/prose false-positive copyrights and strip wrapper tags by @mstykow in #1267
• fix(copyright): recover multi-author "by" chains and texinfo comment authors by @mstykow in #1268
• docs(benchmarks): record coreutils, sqlite, and ImageMagick verification targets by @mstykow in #1269
• fix(copyright): trim prose bleed in copyright, holder, and author extraction by @mstykow in #1270
• docs(benchmarks): record musl copyright/holder/author verification target by @mstykow in #1271
• fix(copyright): keep the SIL OFL "Project Authors (url)" holder in copyrights by @mstykow in #1272
• docs(benchmarks): add FiraCode row, reword musl row to end-state differences by @mstykow in #1273
• fix(copyright): strip parenthesized "(see the CONTRIBUTORS file)" reference by @mstykow in #1274
• docs(benchmarks): record syncthing MPL-2.0 verification target by @mstykow in #1275
• fix(finder): skip SSH remotes and URL authorities in email detection by @mstykow in #1276
• fix(copyright): split coordinated second by clauses into separate authors by @mstykow in #1277
• chore(deps): bump spin 0.9.8 -> 0.9.9 to clear yanked advisory by @mstykow in #1279
• fix(copyright): reduce holder/copyright false positives (article prose + Unicode data) by @mstykow in #1278
• docs(benchmarks): record CC-BY, Unicode-3.0, and AGPL verification targets by @mstykow in #1280
• fix(copyright): recover Javadoc @author names and drop bare XML tags by @mstykow in #1281
• docs(benchmarks): record Zlib, MPL-2.0, and EPL/Apache-dual targets by @mstykow in #1282
• fix(copyright): handle Javadoc @author with a trailing homepage anchor by @mstykow in #1283
• fix(triage): split Models inference token from the org GITHUB_TOKEN by @mstykow in #1284

Full Changelog: v0.2.5...v0.2.6

v0.2.5

What's Changed

• ci(release): don't block the GitHub Release on crate/image publishing by @mstykow in #1253
• fix(license): make match from_file the repo-relative scan path by @mstykow in #1254
• test(scanner): verify CRLF files report correct detection line spans by @mstykow in #1256
• feat(license): extend --fail-on gate to package/dependency declared licenses by @mstykow in #1255
• feat(serve): fetch repositories in-process with gix (no external git) by @mstykow in #1258
• docs: fix stale references found in a docs-wide audit by @mstykow in #1261
• docs(serve): align repository-ingest docs with in-process gix by @mstykow in #1260

Full Changelog: v0.2.4...v0.2.5

v0.2.4

What's Changed

• fix(release): ship static musl linux binaries with mimalloc by @mstykow in #1249
• fix(output): emit POSIX resource paths on Windows + add cross-platform smoke test by @mstykow in #1250
• docs: add GitHub Action usage to README by @mstykow in #1251
• feat(license): compliance severity, --fail-on gate, and SARIF output by @mstykow in #1252

Full Changelog: v0.2.3...v0.2.4

v0.2.3

What's Changed

• chore(deps): update actions/checkout action to v7 by @renovate[bot] in #1236
• feat(vscode-extension): parse VSIX manifest metadata by @leemeo3 in #1237
• perf(license): re-land referenced-filename tokenization memoization + VSIX benchmark (#1238) by @mstykow in #1239
• fix(license): don't apply prose-context pruning to minified long lines by @mstykow in #1240
• ci: attest build provenance for release binaries by @mstykow in #1241
• feat(output): brand the HTML report with the Provenant mark by @mstykow in #1243
• feat(output): refine the HTML report mark to match the org logo by @mstykow in #1244
• perf(scanner): bound content-detection text to 10 MB (#1245) by @mstykow in #1247
• fix(deps): update rust crate bit-set to 0.11.0 by @renovate[bot] in #1246
• chore: move repository to the getprovenant organization by @mstykow in #1248

Full Changelog: v0.2.2...v0.2.3

v0.2.2

What's Changed

• feat(cli): show per-phase timing breakdown only under --verbose by @mstykow in #1225
• docs: add Provenant-vs-ScanCode race demo to README by @mstykow in #1224
• fix(cli): make license-index startup messaging honest and quiet by @mstykow in #1226
• perf(cli): speed up license-dataset export ~65x and add logging to all subcommands by @mstykow in #1227
• fix(deps): bump crossbeam-epoch to 0.9.20 for RUSTSEC-2026-0204 by @mstykow in #1229
• docs: re-record README demo and add reusable recording scripts by @mstykow in #1228
• perf(xtask): scope golden-tests feature to the two bins that need it by @mstykow in #1231
• fix(license): correct MPL and EPL version mislabels in detection rules by @mstykow in #1230
• fix(copyright): strip trailing "Website: " bleed from authors by @mstykow in #1232
• feat(ci): add weekly ScanCode -> Provenant issue triage by @mstykow in #1234

Full Changelog: v0.2.1...v0.2.2

v0.2.1

What's Changed

• chore(deps): update rust crate anyhow to v1.0.103 [security] by @renovate[bot] in #1193
• fix(post-processing): prefer LICENSE over NOTICE when co-hosted legal files disagree by @mstykow in #1194
• feat(parsers): normalize npm slash-separated dual-license declared strings by @mstykow in #1195
• fix(deps): remove direct ttf-parser dependency by @mstykow in #1201
• fix(deps): update rust crate os_info to 3.15.0 by @renovate[bot] in #1200
• fix(deps): update rust crate log to 0.4.33 by @renovate[bot] in #1199
• chore(deps): update rust workspace dependencies by @renovate[bot] in #1198
• chore(deps): update dependency prettier to v3.9.0 by @renovate[bot] in #1197
• chore(deps): update dependency lefthook to v2.1.9 by @renovate[bot] in #1196
• fix(copyright): compose obfuscated emails so multi-holder notices chain past them by @mstykow in #1203
• fix(post-processing): prefer LICENSE over NOTICE when co-hosted legal files disagree by @mstykow in #1202
• docs(benchmarks): record prometheus, redis, and bevy comparison runs by @mstykow in #1204
• fix(copyright): drop SSPL "copyright, or other" prose false positive by @mstykow in #1205
• fix(copyright): collapse padding inside angle-bracketed obfuscated emails by @mstykow in #1206
• docs(benchmarks): record kirigami, go-ethereum, and arrow comparison runs by @mstykow in #1207
• fix(deps): update rust crate pdf_oxide to 0.3.69 by @renovate[bot] in #1211
• chore(deps): ignore blocked quick-xml advisories, drop stale entry by @mstykow in #1212
• chore(deps): update dependency prettier to v3.9.4 by @renovate[bot] in #1210
• feat(assembly): attach Ivy properties dependencies by @leemeo3 in #1208
• fix(deps): update rust crate quick-xml to 0.41.0 [security] by @renovate[bot] in #1209
• chore(renovate): pin dependency versions to fix artifact update failures by @mstykow in #1214
• chore(deps): update actions/checkout action to v7 by @renovate[bot] in #1216
• feat(output): render custom templates with MiniJinja and a ScanCode-compatible context by @mstykow in #1219
• chore(deps): update dependency rust to v1.96.0 by @renovate[bot] in #1215
• feat(assembly): attach Clojure deps.edn dependencies by @leemeo3 in #1218
• feat(clojure): resolve dynamic defproject identity, ~def deps, discards, and deps.edn classifiers by @mstykow in #1221
• fix(copyright): detect open-ended year ranges ending in "now" by @mstykow in #1222
• fix(license): canonicalize LicenseRef-scancode SPDX keys to mirror license keys by @mstykow in #1223

Full Changelog: v0.2.0...v0.2.1

v0.2.0

What's Changed

• fix(assembly): emit one package per conda-meta installed record by @mstykow in #1156
• fix(font): decode name records individually to stop run-on URL false positives by @mstykow in #1158
• fix(assembly): split distinct-GAV Maven .pom siblings into separate packages by @mstykow in #1159
• fix(assembly): subsume Diffusers pipeline-component config.json into the pipeline package by @mstykow in #1157
• fix(copyright): drop false positives from subword-tokenizer data files by @mstykow in #1155
• refactor(assembly): make multi-package directory assembly registry-based by @mstykow in #1161
• refactor(assembly): register per-datasource merge-skip rules by @mstykow in #1162
• verify: meson, pipenv, rules_python, cli, CLIP benchmark targets + drive-by fixes by @mstykow in #1163
• fix(assembly): promote Meson project() manifests to top-level packages by @mstykow in #1164
• fix(assembly): promote vcpkg ports and manifests to top-level packages by @mstykow in #1165
• fix(assembly): promote Leiningen project.clj to top-level packages by @mstykow in #1166
• fix(assembly): promote Arch .SRCINFO/.PKGINFO packages to top-level packages by @mstykow in #1168
• fix(assembly): promote sbt build.sbt projects to top-level packages by @mstykow in #1167
• fix(assembly): keep distinct NuGet projects/nuspecs as separate packages by @mstykow in #1170
• fix(assembly): keep distinct BitBake recipes as separate packages by @mstykow in #1169
• fix(assembly): promote multi-package opam roots and name .opam files by filename by @mstykow in #1171
• refactor(assembly): require a justified reason for every UNASSEMBLED datasource by @mstykow in #1172
• fix(assembly): keep distinct wheels in a wheelhouse as separate packages by @mstykow in #1173
• fix(assembly): keep distinct Ruby gemspecs in one directory as separate packages by @mstykow in #1174
• feat(parsers): add static Elixir mix.exs project manifest parser by @mstykow in #1179
• fix(assembly): hoist purl-less records' dependencies and refresh affected benchmark rows by @mstykow in #1180
• feat(parsers): emit npm overrides and yarn resolutions as pinned deps by @mstykow in #1181
• feat(parsers): record PEP 621 license-file reference from pyproject by @mstykow in #1183
• fix(license): stop clue and low-coverage partial matches leaking into detected license expression by @mstykow in #1182
• feat(post-processing): adopt package declared license from co-hosted and origin-manifest license files by @mstykow in #1184
• fix(post-processing): promote co-hosted legal license in key form with SPDX field by @mstykow in #1187
• docs(benchmarks): record terraform, superset, and godot verification rows by @mstykow in #1188
• fix(parsers): resolve yarn.lock npm: alias keys to aliased package identity by @mstykow in #1189
• fix(post-processing): mirror reference-following SPDX fields on key structure by @mstykow in #1190
• docs(adr): reject file-level package_data license stamping (ADR 0010) by @mstykow in #1191
• fix(scanner): hold key form in FileInfo.detected_license_expression by @mstykow in #1192

Full Changelog: v0.1.15...v0.2.0

v0.1.15

What's Changed

• fix(license-index): build automata off the rayon pool to avoid scan deadlock by @mstykow in #1123
• feat(vcpkg): pin deps from overrides and parse standalone configuration by @mstykow in #1124
• docs(benchmarks): re-measure ten more M1 targets on M5 (batch 2) by @mstykow in #1125
• fix(parsers): recover SPDX core from R DESCRIPTION license idioms by @mstykow in #1126
• feat(parsers): map bare informal declared license names via a curated alias config by @mstykow in #1128
• fix(parsers): bail to honest null on unresolved R license alternatives by @mstykow in #1129
• docs(benchmarks): re-measure ten more M1 targets on M5 (batch 3) by @mstykow in #1130
• docs(benchmarks): re-measure ten more M1 targets on M5 (batch 4) by @mstykow in #1131
• docs(benchmarks): re-measure ten more M1 targets on M5 (batch 5) by @mstykow in #1132
• fix(license): stop pruning license refs on headers with a 'no' substring word by @mstykow in #1133
• docs(benchmarks): re-measure 19 more M1 targets on M5 (batch 6) by @mstykow in #1134
• fix(license-detection): compare referenced filenames on tokens, not raw substring by @mstykow in #1135
• fix(bazel): collapse internal BUILD targets to one component per build directory by @mstykow in #1136
• fix(assembly): propagate declared license across collapsed Bazel/Buck build targets by @mstykow in #1137
• docs(benchmarks): migrate artifact rows to M5 with a reproducible fetch manifest by @mstykow in #1138
• docs(benchmarks): migrate 9 medium + 3 large repo targets to M5 by @mstykow in #1139
• feat(vcpkg): parse classic CONTROL metadata by @leemeo3 in #1140
• fix(vcpkg): bound CONTROL feature dependency paragraphs by @mstykow in #1141
• docs(benchmarks): refresh large-repo rows on M5 + Starlark/OCI parser robustness fixes by @mstykow in #1143
• fix(android): handle text manifests, malformed APKs, and legacy METADATA gracefully by @mstykow in #1148
• fix(output): exclude benign binary-content skips from scan_errors by @mstykow in #1149
• feat(xtask): single-source the benchmark --processes worker count by @mstykow in #1147
• docs(benchmarks): refresh chromium row (0 scan errors after #1148/#1149) by @mstykow in #1150
• feat(ivy): parse dependencies.properties coordinates by @leemeo3 in #1142
• feat(gradle): normalize declared licenses via shared name/url resolver by @mstykow in #1151
• feat(helm): read declared license from artifacthub.io/license annotation by @mstykow in #1153
• feat(assembly): adopt co-hosted LICENSE as package declared license (ADR 0010) by @mstykow in #1152

Full Changelog: v0.1.14...v0.1.15

v0.1.14

What's Changed

• fix(copyright): suppress Creative Commons license-text false positives by @mstykow in #1102
• verify: refresh ten benchmark targets; fix Maven reactor collapse and author junk by @mstykow in #1101
• fix(copyright): stop binary files from emitting junk copyrights and holders by @mstykow in #1103
• docs(testdata): document fixture provenance and attribution policy by @mstykow in #1104
• verify: refresh ten benchmark targets on M5 Pro (sweep 8) by @mstykow in #1105
• feat(compare-outputs): add cross-file field-value frequency rollup by @mstykow in #1106
• fix(copyright): drop source-code FPs and bracketed email author contacts by @mstykow in #1107
• fix(cargo): stop workspace inheritance leaking literal "workspace" by @mstykow in #1108
• perf(license): bound sequence matching on oversized query runs by @mstykow in #1109
• fix(copyright): suppress copyright/holder/author false positives from license-text regions by @mstykow in #1110
• fix(compare): share field-value frequency rollup with compare subcommand by @mstykow in #1111
• docs(benchmarks): refresh uv, npm/cli, DefectDojo after license perf fix (#1109) by @mstykow in #1112
• docs(benchmarks): refresh DataScience and bazel outliers after license perf fix by @mstykow in #1113
• perf(license): window query-run matchables instead of scanning whole query by @mstykow in #1114
• perf(copyright): gate split-email normalization with a cheap adjacency prefilter by @mstykow in #1116
• docs(benchmarks): refresh rows understated by license/copyright perf fixes (#1114, #1116) by @mstykow in #1115
• docs(benchmarks): make non-repository benchmark targets user-reproducible by @mstykow in #1117
• docs(benchmarks): re-measure ten M1 targets on M5 for a hardware-consistent chart by @mstykow in #1118
• docs(benchmarks): re-measure artifact rows on M5 with reproducible pins by @mstykow in #1119
• feat(vcpkg): parse registry lock metadata by @leemeo3 in #1120
• fix(copyright): unwrap XML/C# copyright wrappers and detect HTML © entities by @mstykow in #1122

New Contributors

• @leemeo3 made their first contribution in #1120

Full Changelog: v0.1.13...v0.1.14