v0.14.0

v0.14.0 — Runtime-scope filtering, EOL flagging, iOS scanning

A feature release. The headline change alters scan results on purpose —
read the upgrade notes below. The full machine-readable changelog lives in
CHANGELOG.md.

Highlights

Scan results now describe what actually ships — runtime-scope filtering (default ON)

Source scans drop non-deployable dependencies from the SBOM before persist,
signing, and vulnerability matching: Maven test / provided nodes and npm
devDependencies. CVE counts and license obligations now describe the
artifact you deploy, not your build environment. The scan summary shows how
many components were excluded.

:::caution Component and CVE counts drop on the first re-scan
The first re-scan of an affected Maven/npm project after upgrading will report
fewer components and CVEs than before — that is the feature working, not
data loss. To restore the previous full-graph behaviour set
SCAN_SCOPE_FILTER_ENABLED=false (or the per-ecosystem
SCAN_SCOPE_FILTER_MAVEN_ENABLED / SCAN_SCOPE_FILTER_NODE_ENABLED).
SBOMs uploaded via the ingest API are never filtered — an uploaded SBOM is
the supplier's declared truth.
:::

End-of-life (EOL) component flagging

Components matching a curated endoflife.date product whitelist (Spring Boot,
Express, Django, Rails, Angular, Vue, Next.js, Symfony, Laravel, Spring
Framework) are stamped with their lifecycle verdict. The Components tab gains
an EOL badge and an "EOL only" filter, the drawer an End-of-life row, and the
project Overview an EOL count. Verdicts come from a snapshot vendored with the
release — zero network at scan time, air-gap safe. A weekly beat re-stamps the
catalog, and admin/health gains an endoflife.date snapshot panel (dataset age,
flagged totals, next fire).

iOS trees scan from committed lockfiles

A Podfile used to crash the whole source scan. Pods — components and the
dependency graph, subspecs included — are now reconstructed offline from the
committed Podfile.lock, and repos with a committed Package.resolved route
to the Swift environment without re-resolving.

No failed write stays silent — error-UX closeout

A global mutation error handler now toasts any write failure that a screen
does not surface itself (RFC 7807 detail, locale-aware fallback), and the
crash-screen ErrorBoundary is translated (EN/KO) and announced to screen
readers via role="alert".

Audit trail for external side effects

Two previously invisible actions now leave audit rows with full request
context: posting/updating a gate PR comment (sca_pr_comment.posted /
.updated) and uploading a source archive (source_archive.uploaded).

Fixes

• Real OSS uploads no longer trip the zip-bomb guard. The per-member
  compression-ratio ceiling now applies only to members above a 10 MiB
  uncompressed floor (SOURCE_ARCHIVE_RATIO_GUARD_MIN_BYTES), so tiny sparse
  fixtures (Juice Shop's 940x test PDFs) pass while 42.zip-class bombs are
  still rejected instantly.
• Quickstart matches reality again. The documented seed command now uses
  seed_demo --demo-only, so the project list shows exactly the 5 projects
  the guide promises.
• KO translations backfilled for the v0.11.0–v0.13.1 release notes.

Security

• Worker Go toolchain bumped to 1.25.12 — clears Go stdlib
  CVE-2026-39822 (HIGH) on the bundled Go binaries and govulncheck.

Upgrade notes

• Expect lower counts on the first re-scan of Maven/npm projects (see the
  caution above) — communicate this to teams before upgrading shared portals.
• Migrations auto-apply at container startup (AUTO_MIGRATE, the
  default): 0038_component_eol and 0039_eol_sync_state are forward-only.
• EOL flagging is on by default but fully offline (EOL_ENABLED=false
  disables; EOL_SNAPSHOT_PATH mounts a fresher snapshot; live refresh stays
  off unless EOL_REFRESH_ENABLED=true).

Pull the 0.14.0 images (or helm upgrade to the 0.14.0 image tag).

v0.13.1

v0.13.1 — install / deploy L1 repair + security patch

A patch release: no new features, no schema changes. It fixes fresh
role-separated (L1) installs and deployments that could fail to come up, and
picks up a security bump. The full machine-readable changelog lives in
CHANGELOG.md.

Highlights

Fresh L1 (role-separated) installs and deployments now boot

Several confirmed bugs prevented a from-scratch role-separated stack — the
posture install.sh provisions — from coming up. They only affected L1 stacks
(operators who set POSTGRES_APP_PASSWORD); legacy single-role deployments were
unaffected, which is why they went unnoticed until the release gate booted the
production compose file from scratch.

• trustedoss_app role was never created. scripts/postgres-init.sh
  interpolated the role name / password inside a dollar-quoted DO $$ … $$
  block, where psql performs no variable substitution — the literal :'app_user'
  reached the server and aborted the init script, so every L1 backend then failed
  password auth as trustedoss_app. Role creation now uses
  SELECT format(…) … \gexec with WHERE NOT EXISTS (SQL-quoted, idempotent).
• AUTO_MIGRATE never reached the container. install.sh writes
  AUTO_MIGRATE=false on L1 stacks (migrations run once as the owner role), but
  the compose file never referenced ${AUTO_MIGRATE}, so the backend entrypoint
  defaulted back to true and attempted DDL as the unprivileged app role. The
  value is now plumbed through.
• Owner-password consistency + staged boot. The install secret block is now
  idempotent (POSTGRES_PASSWORD is the single source of truth for the owner
  password, never rotated on re-run), and boot is staged
  (postgres+redis+backend → wait /health → owner-role alembic upgrade head →
  wait /health/ready → full fleet) so the worker's
  depends_on backend: service_healthy no longer deadlocks under
  AUTO_MIGRATE=false.
• Dev backend image now auto-migrates. The dev image (Dockerfile) had a
  CMD but no ENTRYPOINT, so it skipped docker-entrypoint.sh and never ran
  its migration — leaving /health/ready at 503 and the backend permanently
  unhealthy. It now carries the entrypoint like the production image.

Security

• python-multipart 0.0.30 → 0.0.31 — picks up the fix for
  CVE-2026-53540. Ships in the backend image.

Upgrade notes

• No action required, no migrations. This is a fixes-only patch; the schema
  is unchanged from v0.13.0.
• Fresh L1 installs should use v0.13.1. A from-scratch role-separated install
  at v0.13.0 could fail to provision trustedoss_app or deadlock on boot — both
  are fixed here. Existing, already-running v0.13.0 stacks are unaffected.
• Pull the 0.13.1 images (or helm upgrade to the 0.13.1 image tag).

v0.13.0

v0.13.0 — parity release

A broad feature release: everything here is additive — existing scans,
projects, and configurations are unchanged, and the one new external-egress
capability (SCANOSS) is off by default. The full machine-readable changelog
lives in CHANGELOG.md.

Highlights

See how packages relate — dependency graph view

The Components tab gains a Table / Graph toggle. The graph view renders
the scan's resolved dependency graph (every parent → child edge) as an
interactive node-link diagram, each node coloured by its highest-severity
finding, with search highlight and a click-to-detail panel — so you can see
how a package is pulled in, not just that it is present. Large graphs fall
back to a tree or a banner so the view stays usable at scale.

Find anything, anywhere — global search (⌘K)

The command palette (⌘K / Ctrl+K) now searches components and CVEs
across every project you can access, alongside projects and pages. Results are
team-scoped server-side — another team's data never appears — and deep-link
straight to the relevant project tab.

Excel vulnerability reports

The project vulnerability report can now be downloaded as an Excel (.xlsx)
workbook (Overview / Components / Vulnerabilities sheets) in addition to PDF, from
the Reports tab. Cell values are neutralised against spreadsheet formula
injection. This fulfils the long-standing "Excel / PDF reports" commitment.

Better license coverage

• The classification catalog grew from 32 to 52 licenses, and a free-text
  license name with no SPDX id is now normalised to its canonical id — so fewer
  components land as unknown.
• The generated NOTICE file now embeds the full SPDX text of every license it
  credits, plus per-component copyright.
• Two advisory AI license review flags (behavioral-use / non-commercial) flag
  restrictions that standard compliance tooling misses.

Vulnerability triage — KEV + AI SBOM conformance

• Findings whose CVE is in the CISA KEV catalog carry a KEV badge and a
  remediation due-date, and a new Priority sort (KEV → severity → EPSS) is the
  default. An admin KEV feed panel shows sync health.
• SBOM ingest accepts CycloneDX 1.7 (ML-BOM) and appends the G7 "SBOM for
  AI" 51 minimum-element conformance checks (advisory) for model components.

Vendored-OSS identification (SCANOSS) — opt-in, off by default

An optional scan stage fingerprints the source tree and matches copied-in
("vendored") open source against the SCANOSS knowledge base — closing the gap for
C / C++ / embedded trees with no package manifest. It is disabled unless an
operator sets SCANOSS_ENABLED=true: a self-hosted portal must not send file
fingerprints to an external API without consent. Point SCANOSS_API_URL at a
self-hosted instance to keep fingerprints inside your network.

Upgrade notes

Additive release — no migration action required beyond the standard
alembic upgrade head the images run on boot. The new capabilities are opt-in:
SCANOSS stays off until SCANOSS_ENABLED=true, and the dependency-graph node cap
(DEPENDENCY_GRAPH_MAX_NODES) and search rate budget (SEARCH_RATE_LIMIT) have
safe defaults. See Environment variables for the
new keys.

v0.12.0

v0.12.0 — SBOM ingest + on-prem dynamic scanning

A feature release with two themes. Both are additive and opt-in — existing
scans and configurations are unchanged. The full machine-readable changelog lives
in CHANGELOG.md.

Highlights

Received-SBOM ingest with conformance scoring (Model 3)

Hand TRUSCA an SBOM your own tooling already produced instead of having it clone
and build your source. POST /v1/projects/{id}/sbom-ingest accepts a
CycloneDX-JSON or SPDX (JSON / Tag-Value) document, queues an sbom-kind
scan that persists the components, matches CVEs with Trivy, and classifies
declared licenses — no source clone or build.

Every uploaded SBOM is scored for quality on its original bytes and gets a
pass / warn / fail verdict (mandatory checks: timestamp, tool info, a
top-level component, 100% name+version, PURL coverage ≥ 90%, no pkg:generic
placeholders, a dependency graph; license + hash coverage are warn-only). The
verdict is advisory — a fail is recorded and surfaced but never blocks
matching. It is exposed at
GET /v1/projects/{id}/scans/{scan_id}/conformance and rendered as a badge +
per-check table on the scan detail page.

On-prem dynamic per-environment scanning

The SBOM-generation stage is now pluggable. With SCAN_EXECUTOR=local_docker
(opt-in, on-prem single-tenant), the worker launches a per-environment cdxgen
sidecar for a toolchain it does not carry, runs build-prep + cdxgen there,
and collects the SBOM — the rest of the pipeline (sign / scancode / Trivy /
persist) is unchanged.

The first target is Android: the worker has no Android SDK, so the Android
Gradle Plugin cannot resolve dependencies (0 components); routing Android to the
SDK sidecar resolves the full graph. Verification showed node / go / rust / ruby
/ java / python / php / dotnet already resolve identically in the all-in-one
worker, so Android is the one genuine gap and the only default-routed
environment — the routed set is configurable via SCAN_LOCAL_DOCKER_ENVS.

The Docker socket is a host-escape surface, so the executor ships hardened
defaults (workspace-only volume mounting, dropped capabilities,
no-new-privileges, resource bounds, a curated env allow-list, refusal of
unpinned :latest images, and an isolated egress network) and went through a
security review. See the
Dynamic scan executor
admin guide before enabling it. New CDXGEN_SPEC_VERSION / CDXGEN_FETCH_LICENSE toggles
tune the SBOM spec version and component-license resolution.

Upgrade notes

• Additive, no action required. New endpoints, the new sbom scan kind, and
  all new environment variables default to the previous behaviour.
• Migrations auto-apply at container startup (AUTO_MIGRATE, the default):
  0032_scan_kind_sbom and 0033_sbom_conformance are forward-only.
• Dynamic scanning is off by default (SCAN_EXECUTOR=inprocess). Enabling
  local_docker is on-prem single-tenant only and requires the opt-in setup in
  the admin guide. The worker image now bundles the Docker CLI for that path; it
  is unused under the default executor.

Pull the 0.12.0 images (or helm upgrade to chart 0.12.0).

v0.11.1 — Theme rollback + new logo

v0.11.1 — Theme rollback + new logo

A UI / branding patch release. There are no backend or API changes — only
the frontend image, documentation, and Helm chart metadata change versus
0.11.0. The full machine-readable changelog lives in
CHANGELOG.md.

Highlights

Theme rolled back to the W11 light theme

The W13 "Google AI Studio" re-skin from 0.11.0 (white canvas, blue primary,
pill buttons) is rolled back to the W11 Vercel + Linear look — off-white
canvas, warm near-black primary, square corners, blue Low badge. The TRUSCA
brand and rename are unaffected.

New logo + complete favicon set

The mark is now a dark-slate tile with a teal check accent and an ink
"TRUSCA" wordmark; the full lockup adds the "TrustedOSS SCA" tagline on the
login gateway. A complete favicon set ships alongside the SVG: favicon.ico
(16 / 32 / 48) and an apple-touch-icon.png for the iOS home screen.

Fixes

• The Helm chart icon: URL pointed at a non-existent path; it now resolves
  to the published mark raster.

Upgrade notes

UI-only change. Pull the 0.11.1 images (or helm upgrade to chart
0.11.1); no migration or configuration changes are required.

v0.11.0 — TRUSCA (renamed) + public read-only demo

v0.11.0 — TRUSCA (renamed) + read-only demo

The first post-GA feature release. The full machine-readable changelog lives
in CHANGELOG.md;
this page is the human-readable summary.

Highlights

Renamed — TrustedOSS Portal is now TRUSCA

The product is now TRUSCA — the SCA tool of the TrustedOSS initiative. The
GitHub repository, container images, and documentation path moved to the new
name:

• Images: ghcr.io/trustedoss/trusca-backend, trusca-backend-worker,
  trusca-frontend (the trusca- prefix starts at this release).
• Docs: https://trustedoss.github.io/trusca/.
• Internal identifiers (DB roles, Celery task names, server paths) intentionally
  keep their previous names — no migration is required to upgrade.

Public read-only demo

A self-contained, read-only demo can be deployed to a single Hetzner server,
with seeded projects, scans, and findings so evaluators can explore the UI
without writing data. Read-only mode is surfaced in the UI and enforced server
side.

UI craft pass + hardening

A typography / motion / empty-state polish pass (W11–W12) and a hardening sweep
from an external verification campaign landed in this release.

Upgrade notes

• Container images are published under the new trusca-* names. The production
  docker-compose.yml and Helm chart already reference them; pin IMAGE_TAG
  to the release you are running.
• Releases <= 0.10.0 remain under the old image names and are unaffected.

v0.10.0 — first public release

v0.10.0 — First public release

The first public release of TrustedOSS Portal — a self-hosted, Apache-2.0
SCA portal that unifies vulnerability tracking, license compliance, SBOM
generation, and CI/CD integration in one UI.

The full machine-readable changelog lives in
CHANGELOG.md.
This page is the human-readable summary.

Highlights

Scanning

• Source scans — cdxgen produces a CycloneDX SBOM across 30+ language
  ecosystems; Trivy matches components against its unified DB
  (NVD + OSV + GitHub Advisory + EPSS + KEV).
• Container scans — Trivy scans OS packages of a container image you name.
• Automatic CVE re-detection — a weekly Trivy DB refresh + a Celery beat
  re-match every project's most-recent SBOM, so new CVEs land without a manual
  re-scan.
• Air-gapped support — TRIVY_DB_REPOSITORY swaps the upstream OCI
  registry for an internal mirror.

Compliance

• License classification — allowed / conditional / forbidden tiers,
  scored against a fixed classification catalog.
• Obligations + auto NOTICE — text, markdown, and HTML output.
• Component approval workflow — Pending → Under Review → Approved /
  Rejected.
• VEX — export and consumption (OpenVEX + CycloneDX VEX), 7-state triage.
• SBOM export — CycloneDX (JSON / XML) and SPDX (JSON / Tag-Value),
  byte-stable.

CI/CD

• GitHub Actions composite action + GitLab CI template + a worked
  Jenkinsfile example.
• Build gate — Critical CVE or forbidden license fails the build (exit 1).
• Webhooks — GitHub & GitLab push / PR events auto-trigger scans with
  inline PR / MR comments.
• EPSS prioritization — column, sort, filter, and a policy-gate threshold
  (GATE_EPSS_THRESHOLD).

Operations

• Multi-tenant teams + RBAC — super_admin / team_admin / developer.
• Append-only audit log — every write recorded with diff + actor, with
  SQL-level immutability via a plpgsql trigger.
• Notifications — Email (SMTP), Slack, Microsoft Teams webhooks.
• Admin UI — user / team management, Trivy DB monitoring + refresh, scan
  queue, disk dashboard, audit-log search and CSV export.
• Backups — daily Celery-beat auto-backup with 7-day retention plus
  manual backup / restore from the Admin UI.
• Read-only demo mode — DEMO_READ_ONLY=true for public demos.

Experience

• EN + KO i18n from day one — every UI string and every documentation
  page is bilingual.
• Modern enterprise design system — light theme, WCAG AA, compact 40 px
  tables, drawer + page navigation dual surfaces.
• Portfolio Dashboard on / — KPI cards, severity and license
  distribution, recent scans.
• ⌘K command palette — keyboard-first navigation across projects, vulns,
  components, and admin areas.
• URL-persistent filters — every facet (severity, license category,
  search, status, page) lives in the URL so reload / share / back-button
  restores the view.

Distribution

• Docker Compose — dev and prod overlays; the prod overlay includes
  Traefik with Let's Encrypt.
• Helm chart (charts/trustedoss) — bundled-or-external PostgreSQL and
  Redis, Ingress with cert-manager TLS, schema-migration Job.
• OpenAPI reference — rendered at /reference/api on this docs site.
• Schema-gated readiness probe — /health/ready returns 503 until the
  Alembic schema is at HEAD.

What is not in this release

The comparison page lists every documented gap. Two
that matter most for adoption decisions:

• Automated remediation pull requests. The portal surfaces per-finding
  fixed_version and dependency-graph depth, but does not yet open upgrade
  PRs. Suggested upgrades and PR opening land in a future release.
• Reachability analysis. Findings are listed in full rather than ranked
  by whether vulnerable code is reachable — planned, best-effort.

See the roadmap
for the full forward plan.

Install

• Quickstart (5 min) — local evaluation with the dev compose stack.
• Install with Docker Compose — production install on a Linux host.
• Install on Kubernetes with Helm — production install via the Helm chart.

See also

• CHANGELOG.md — the machine-readable changelog.
• ROADMAP.md — what is planned next.
• Comparison — how TrustedOSS Portal compares to commercial SCA, Dependency-Track, and SW360.