chore(release): prepare v1.3.1

CHANGELOG.md

@@ -7,6 +7,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [v1.3.1] - 2026-06-22
+
+### Added
+
+- Server delivery SBOM: scan a server's layers separately (OS rootfs and application) and combine them with `--merge`, which merges several CycloneDX SBOMs into one; the web UI accepts a rootfs directory as input. (#161)
+
+### Changed
+
+- GHCR package names are unified under the `bomlens` brand; `sbom-generator` and `sbom-scanner` remain aliases of the same digest. (#156)
+- The Android image pull defaults to the published `bomlens` name. (#157, #158)
+- Documentation is restructured by intent with English as the canonical language, sidebar labels shortened, and the landing pages use the web UI demo gif. (#154, #155, #160)
+
+### Fixed
+
+- Source scans no longer leak `src@latest` as the root component name, which became a non-unique Black Duck codelocation and blocked unrelated imports. The caller's project name is now passed to cdxgen and stamped into the root component, and the pipeline fails closed if stamping does not take. (#166)
+- `--merge` preserves each input's dependency graph so the merged BOM stays CycloneDX-conformant. (#164)
+- Follow-ups from the v1.3.0 verification pass (V13-1/2/3). (#159)
+- Corrected the first-scan link in the Korean server-delivery guide and modeled static linking as a blind spot rather than a separate layer. (#162, #163)
+
 ## [v1.3.0] - 2026-06-14
 
 ### Added

electron/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sbom-generator-desktop",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "private": true,
   "type": "module",
   "description": "Double-click desktop app that wraps the BomLens web UI (runs the scanner in Docker).",