v4.1.5

⚙️ Changes

• Bump component detection to 6.2.1 by @sebasgomez238 (#1359)
• Fix CG alert - .NET SDK by @ZhengHong-Tan (#1334)
• Remove GH packages release step from pipeline by @sfoslund (#1333)
• Fix release pipeline internal feed release by @sfoslund (#1325)

v4.1.4

⚙️ Changes

• Fix release pipeline internal feed release by @sfoslund (#1325)
• Fix release pipeline internal feed logic by @sfoslund (#1324)
• Major version bump for Component Detection by @jlperkins (#1323)
• Fix validation errors for SBOM tool release by @pragnya17 (#1282)
• Bump Microsoft.Build, Microsoft.Build.Framework, and Microsoft.Build.Utilities.Core by @dependabot[bot] (#1276)
• Revert "Update pipeline to use shared service connection" by @pragnya17 (#1275)
• Bump System.Threading.Channels from 9.0.8 to 9.0.10 by @dependabot[bot] (#1273)
• Update pipeline to use shared service connection by @pragnya17 (#1262)

v4.1.3

⚙️ Changes

• Fix validation errors for SBOM tool release by @pragnya17 (#1282)
• Bump Microsoft.Build, Microsoft.Build.Framework, and Microsoft.Build.Utilities.Core by @dependabot[bot] (#1276)
• Revert "Update pipeline to use shared service connection" by @pragnya17 (#1275)
• Bump System.Threading.Channels from 9.0.8 to 9.0.10 by @dependabot[bot] (#1273)
• Update pipeline to use shared service connection by @pragnya17 (#1262)
• Bump Microsoft.ComponentDetection.Contracts from 5.2.19 to 5.2.27 by @dependabot[bot] (#1204)
• Update readme to reflect new contribution policy by @alisonlomaka (#1235)
• Bump NuGet.Configuration from 6.13.2 to 6.14.0 by @dependabot[bot] (#1178)
• Bump NuGet.Frameworks from 6.13.2 to 6.14.0 by @dependabot[bot] (#1179)
• Bump System.Linq.Async from 6.0.1 to 6.0.3 by @dependabot[bot] (#1184)
• Bump Scrutor from 6.0.1 to 6.1.0 by @dependabot[bot] (#1181)
• Bump Newtonsoft.Json from 13.0.3 to 13.0.4 by @dependabot[bot] (#1226)
• Bump actions/setup-dotnet from 4.3.1 to 5.0.0 by @dependabot[bot] (#1202)
• Bump System.Text.Json from 9.0.2 to 9.0.9 by @dependabot[bot] (#1218)
• Bump actions/github-script from 7.0.1 to 8.0.0 by @dependabot[bot] (#1207)
• Bump github/codeql-action from 3.29.11 to 3.30.3 by @dependabot[bot] (#1219)
• Convert SBOM tool release pipeline from classic to governed by @pragnya17 (#1212)
• Bump Microsoft.VisualStudio.Threading.Analyzers from 17.12.19 to 17.14.15 by @dependabot[bot] (#1176)
• Bump System.Threading.Channels from 9.0.2 to 9.0.8 by @dependabot[bot] (#1186)
• Bump System.Threading.Tasks.Extensions from 4.6.1 to 4.6.3 by @dependabot[bot] (#1187)
• Bump github/codeql-action from 3.29.3 to 3.29.11 by @dependabot[bot] (#1164)
• Bump actions/checkout from 4 to 5 by @dependabot[bot] (#1156)

v4.1.2

• Add COSE paths to SbomConfig by @JoseRenan (#1152)
• Exit with appropriate exit code when providing version by @GDWR (#1161)

v4.1.1

⚙️ Changes

• Temporarily make NI policy permissive by @pragnya17 (#1157)
• Scope FileHasher awaiting to just aggregation by @DaveTryon (#1160)
• Add telemetry to record depends on relationships by @pragnya17 (#1153)
• Exclude samples folder from externaldocreferences by @DaveTryon (#1146)

v4.1.0

⚙️ Changes

• Fix externalRefs parser bug by @jlperkins (#1147)
• Add aggregation docs by @DaveTryon (#1145)
• Bump github/codeql-action from 3.29.0 to 3.29.3 by @dependabot[bot] (#1144)
• Ignore SHA1 codeQL warnings by @sfoslund (#1143)
• Refactor constructor for Generator class by @DaveTryon (#1142)
• Add E2E tests for aggregation, fix race condition by @DaveTryon (#1141)
• Include package relationships when aggregating by @DaveTryon (#1139)
• Ignore SHA1 codeQL warnings by @sfoslund (#1138)
• Restore writing of root dependencies by @DaveTryon (#1137)
• Include empty files and relationships arrays in aggregated SBOMs by @sfoslund (#1136)
• Convert info message about invalid aggregation input to warn by @sfoslund (#1135)
• Capture more package fields in MergeableContent by @DaveTryon (#1134)
• Add correct relationships to MergeableContent by @DaveTryon (#1133)
• Fix SBOM aggregation signing bug by @sfoslund (#1132)
• Add a simple class to wrap the SbomConsolidationWorkflow by @DaveTryon (#1130)
• Add aggregation telemetry by @DaveTryon (#1128)
• Add telemetry file path option to aggregate verb by @sfoslund (#1129)
• Rename Consolidation to Aggregation by @DaveTryon (#1127)
• Generated a consolidated SBOM by @DaveTryon (#1126)
• Do not require outputPath in consolidate config file by @sfoslund (#1124)
• Ignore SPDX 3.0 SBOMs in consolidation by @sfoslund (#1123)
• Running validation workflow in consolidate by @sfoslund (#1118)
• Follow try standard by @DaveTryon (#1121)
• remove pointless returns xml docs by @SimonCropp (#1112)
• Pass set of validated SBOMs to consolidation by @DaveTryon (#1119)
• Add plumbing to collect packages from SPDX 2.2 files by @DaveTryon (#1117)
• Adding validate plumbing to consolidate verb by @sfoslund (#1115)
• remove broken param docs by @SimonCropp (#1111)
• remove redundant interpolation by @SimonCropp (#1113)
• Add simple unit tests for SbomConsolidationWorkflow by @DaveTryon (#1114)
• Add SPDXFormatDetector for SPDX version detection by @sfoslund (#1108)
• JSON encode env var values before config file insertion by @sfoslund (#1109)
• Add config file for Consolidate action by @DaveTryon (#1110)
• SBOM content diff checker between SPDX 2.2 and SPDX 3.0 by @pragnya17 (#1011)
• Bump Microsoft.Build.Locator to 1.7.8, 1.9.1 by @dependabot[bot] (#1102)
• Expand env vars included in input config files by @sfoslund (#1105)
• Complete the stubbed plumbing for Consolidate action by @DaveTryon (#1106)
• Add skeleton for consolidation action by @DaveTryon (#1104)
• Fix for package dependency bug by @pragnya17 (#1101)
• build(deps): bump stefanzweifel/git-auto-commit-action from 5.2.0 to 6.0.1 by @dependabot[bot] (#1099)
• build(deps): bump github/codeql-action from 3.28.18 to 3.29.0 by @dependabot[bot] (#1100)
• Create GitHub-targeted artifacts by @DaveTryon (#1091)
• Add IsPackable to target condition by @bording (#1075)
• Properly account for the number of files validated in ValidationResult by @joshuamay-ms (#1095)
• remove build badge by @SimonCropp (#1085)
• remove redundant FileHashesDictionarySingleton by @SimonCropp (#1084)
• remove unused Program fields by @SimonCropp (#1086)
• remove some dead variables by @SimonCropp (#1087)
• disable this prefix convention by @SimonCropp (#1088)
• dont use ConcurrentDictionary when single threaded by @SimonCropp (#1083)
• use Assert.ThrowsException by @SimonCropp (#1081)
• explicitly reference Serilog by @SimonCropp (#1063)
• default to matching on correct case in GetEnvironmentVariable by @SimonCropp (#1069)
• remove sourcelink by @SimonCropp (#1062)
• use String.Concat over string.Join(string.Empty, by @SimonCropp (#1073)
• use faster char based APIs by @SimonCropp (#1072)
• remove redundant GetTypeInfo by @SimonCropp (#1071)
• remove redundant dictionary lookups by @SimonCropp (#1047)
• avoid manifestFolderPath calculation when filePath is null by @SimonCropp (#1066)
• move strong naming config into dir props by @SimonCropp (#1061)
• use collection expressions by @SimonCropp (#1064)
• suppress CS1591 for test projects by @SimonCropp (#1058)
• leverage JsonSerializer.SerializeToDocument by @SimonCropp (#1060)
• remove string.ToString calls by @SimonCropp (#1059)
• ignore Rider + ReSharper temp by @SimonCropp (#1046)
• remove redundant empty constructors by @SimonCropp (#1049)
• Updates license compliance info matrix by @felickz (#1032)
• build(deps): bump github/codeql-action from 3.28.13 to 3.28.17 by @dependabot[bot] (#1035)
• build(deps): bump stefanzweifel/git-auto-commit-action from 5.1.0 to 5.2.0 by @dependabot[bot] (#1021)
• remove some un-used variables by @SimonCropp (#1045)
• Ensure that SBOM creation time is represented in Gregorian calendar format by @alisonlomaka (#1052)

v4.0.3

⚙️ Changes

• Bump component-detection from 5.2.13 to 5.2.19 by @DaveTryon (#1051)
• Add migration guide to V4 API by @DaveTryon (#1028)
• Add documentation for SPDX 3.0 by @pragnya17 (#1027)

v4.0.2

API BREAKING CHANGES

• Please see #1028 for details

New features

• This release enables SPDX 3.0 support in generation and validation (not yet in redaction). Specify the -mi:SPDX3.0 parameter on the command line to enable the new functionality. Please see #1027 for more details.

⚙️ Changes

• Tidy interfaces just a bit by @DaveTryon (#1044)
• Generate only supported manifests, get target configs, and use SourcesProviders as the source of truth by @pragnya17 (#1043)
• Avoid Exception if an unsupported format is requested by @DaveTryon (#1034)
• Teach ManifestValidator about extensions by @DaveTryon (#1033)
• Rename NTIA to NTIAMin - no functional changes by @DaveTryon (#1031)
• Rename "Compliance" to "Conformance" by @DaveTryon (#1030)
• Add ability to pass additional telemetry data back from ISignValidator.Validate by @DaveTryon (#1026)
• Fix SPDX 3.0 relationship generation by @pragnya17 (#1015)
• Fix casing of ValidatedSbomFactory.CreateValidatedSBOM by @DaveTryon (#1023)
• Bug fix for supplier and suppliedBy for root package in SPDX 3.0 by @pragnya17 (#1019)
• NoAssertion bug for SBOM file and package generation by @pragnya17 (#1016)
• Package DependOnId bug fix by @pragnya17 (#1017)
• Add null check for SPDX 3.0 external identifiers by @pragnya17 (#1020)
• Update spdx22 external doc ref extension by @pragnya17 (#1018)
• Add AdditionalComponentDetectorArgs to RuntimeConfiguration by @MichielOda (#996)
• Add SPDX 3.0 extensions to convert to internal SBOM components by @pragnya17 (#1012)
• External Map generation bug by @pragnya17 (#1014)
• Introduce new telemetry method to record signature validation results by @ZhengHong-Tan (#1002)
• Write E2E tests for validation success and failure (SPDX 2.2 and 3.0) by @pragnya17 (#1005)
• Refactor SPDX 3.0 extension methods by @pragnya17 (#1001)
• Move spdx extensions to common utils and refactor SPDX 2.2 by @pragnya17 (#998)
• Validate compliance standard for SPDX 3.0 by @pragnya17 (#992)
• Fix SPDX 3.0 manifest missing files bug by @pragnya17 (#997)
• Add DotNet Component Adapter by @grvillic (#994)
• Don't run auto-comment workflow on PR's from forks by @DaveTryon (#1000)
• build(deps): bump github/codeql-action from 3.28.11 to 3.28.13 by @dependabot[bot] (#990)
• Delay E2E tests until other test projects have built by @DaveTryon (#985)
• Remove suppression of IDE0040 by @DaveTryon (#984)
• Address new warnings from .NET 9 by @DaveTryon (#982)
• Fix problems running E2E tests locally by @DaveTryon (#957)
• Refactor GenerationResult to restore the original behavior of writing JSON arrays for SPDX 2.2 by @pragnya17 (#975)
• Throw validation error if customer attempts to redact SPDX 3.0 SBOM by @pragnya17 (#977)
• build(deps): bump System.Threading.Tasks.Extensions from 4.6.0 to 4.6.1 by @dependabot[bot] (#978)
• build(deps): bump Microsoft.Testing.Extensions.TrxReport from 1.6.2 to 1.6.3 by @dependabot[bot] (#980)
• build(deps): bump actions/setup-dotnet from 4.3.0 to 4.3.1 by @dependabot[bot] (#976)
• Manifest info name should be case insensitive by @pragnya17 (#973)
• Validate manifest info with attributes by @pragnya17 (#961)
• build(deps): bump github/codeql-action from 3.28.10 to 3.28.11 by @dependabot[bot] (#966)
• Parsing SPDX 3.0 packages and validating with NTIA by @pragnya17 (#963)
• Generate singular SBOM based on manifestInfo parameter by @pragnya17 (#959)
• build(deps): bump Microsoft.Testing.Extensions.TrxReport from 1.5.3 to 1.6.2 by @dependabot[bot] (#937)
• build(deps): bump Microsoft.NETFramework.ReferenceAssemblies, NuGet.Configuration and NuGet.Frameworks by @dependabot[bot] (#960)
• API BREAKING CHANGE: Remove back-compat interface shims by @DaveTryon (#952)
• Reenable CodeQL for SDL compliance by @DaveTryon (#951)
• Normalize "SBOM" to "Sbom" through most of the code base by @DaveTryon (#950)
• API changes to support SPDX 3.0 by @pragnya17 (#924)
• Clean apt cache in Dockerfile to reduce image size by @DaveTryon (#939)
• build(deps): bump github/codeql-action from 3.28.8 to 3.28.10 by @dependabot[bot] (#945)
• Bump System.Text.Json from 9.0.0 to 9.0.2 by @DaveTryon (#940)
• build(deps): bump System.Threading.Channels by @dependabot[bot] (#929)
• Pin Microsoft.IO.Redist in net472 tests by @DaveTryon (#921)

v3.1.0

⚙️ Changes

• Add interface pin, split IConfiguration to be non-breaking by @DaveTryon (#919)
• Update metadata contract to be backcompatible with SPDX 2.2 parser by @pragnya17 (#918)
• Remove unnecessary parser errors which disallow syft SBOMs by @sfoslund (#917)
• Disable CodeQL until they fix the osx-arm64 problem by @DaveTryon (#916)
• build(deps): bump github/codeql-action from 3.28.3 to 3.28.8 by @dependabot[bot] (#914)
• Specify correct image for running on osx-arm64 by @DaveTryon (#913)
• Update MSTest to metapackage and MTP by @Youssef1313 (#881)
• build(deps): bump actions/setup-dotnet from 4.2.0 to 4.3.0 by @dependabot[bot] (#911)
• Target E2E tests with net472 only on Windows by @DaveTryon (#910)
• Bump GitHub Actions versions in sample code by @rufer7 (#908)
• build(deps): bump MSTest.TestAdapter from 3.7.2 to 3.7.3 by @dependabot[bot] (#905)
• build(deps): bump MSTest.TestFramework from 3.7.2 to 3.7.3 by @dependabot[bot] (#906)
• Enable MSTest analyzers by @Youssef1313 (#898)
• Address a targeted set of analyzer warnings by @DaveTryon (#901)
• Revert extra dependency that we added in #758 by @DaveTryon (#902)
• Update CLI arg help text by @sfoslund (#899)
• Bump component-detection from 5.1.6 to 5.2.1 by @DaveTryon (#894)
• Remove FluentAssertions from tests by @DaveTryon (#896)
• build(deps): bump release-drafter/release-drafter from 6.0.0 to 6.1.0 by @dependabot[bot] (#883)
• build(deps): bump Scrutor from 5.1.0 to 6.0.1 by @dependabot[bot] (#872)
• build(deps): bump github/codeql-action from 3.28.0 to 3.28.3 by @dependabot[bot] (#892)
• build(deps): bump coverlet.collector from 6.0.3 to 6.0.4 by @dependabot[bot] (#882)
• build(deps): bump stefanzweifel/git-auto-commit-action from 5.0.1 to 5.1.0 by @dependabot[bot] (#861)
• build(deps): bump System.Threading.Channels from 9.0.0 to 9.0.1 by @dependabot[bot] (#871)
• Bump MSTest.Test* from 3.7.0 to 3.7.2 by @DaveTryon (#891)
• Add a workflow to comment on API changes by @DaveTryon (#885)
• Switch DataTestMethod to DataTestMethod (part 2) by @DaveTryon (#880)
• Switch DataTestMethod to TestMethod by @Youssef1313 (#849)
• Add skipBuildTagsForGitHubPullRequests setting to PR pipeline by @sfoslund (#879)
• Reenable SBOM targets e2e test by @sfoslund (#876)
• Remove GH action PR build by @sfoslund (#875)
• Add ADO PR build by @sfoslund (#874)
• Spdx 3.0 Parser for SBOM files by @pragnya17 (#860)
• Revert bump to Microsoft.Extensions.DependencyModel (Revert part of #847) by @DaveTryon (#851)
• Pin ubuntu runner to 22.04 by @DaveTryon (#856)
• build(deps): bump Microsoft.Extensions.DependencyModel from 8.0.2 to 9.0.0 by @dependabot[bot] (#847)
• Decouple test packages from release bits by @DaveTryon (#850)
• build(deps): bump coverlet.collector from 6.0.2 to 6.0.3 by @dependabot[bot] (#846)
• Revert "build(deps): bump Microsoft.Extensions.DependencyModel" by @DaveTryon (#845)
• build(deps): bump FluentAssertions from 6.12.2 to 7.0.0 by @dependabot[bot] (#818)
• build(deps): bump Microsoft.Extensions.DependencyModel from 8.0.2 to 9.0.0 by @dependabot[bot] (#784)
• build(deps): bump github/codeql-action from 3.27.9 to 3.28.0 by @dependabot[bot] (#840)
• build(deps): bump Scrutor from 5.0.2 to 5.1.0 by @dependabot[bot] (#842)
• build(deps): bump actions/setup-dotnet from 4.1.0 to 4.2.0 by @dependabot[bot] (#843)
• build(deps): bump github/codeql-action from 3.27.6 to 3.27.9 by @dependabot[bot] (#832)
• build(deps): bump codecov/codecov-action from 5.0.7 to 5.1.2 by @dependabot[bot] (#838)
• Defining and generating spdx 3.0 json elements by @pragnya17 (#830)
• Add running unit tests to CI pipeline by @sfoslund (#835)
• Made the Timeout in LicenseInformationService configurable via CLI argument (#584) by @kidcline1 (#773)
• build(deps): bump github/codeql-action from 3.27.5 to 3.27.6 by @dependabot[bot] (#825)
• build(deps): bump NuGet.Configuration from 6.11.1 to 6.12.1 by @dependabot[bot] (#817)
• build(deps): bump MSTest.TestAdapter from 3.6.3 to 3.6.4 by @dependabot[bot] (#823)
• build(deps): bump MSTest.TestFramework from 3.6.3 to 3.6.4 by @dependabot[bot] (#824)
• Use the fully qualified name for the Zip and Unzip tasks by @bstadick (#803)
• Add missing linefeed from API sample by @DaveTryon (#819)
• build(deps): bump System.Threading.Channels from 6.0.0 to 8.0.0 by @dependabot[bot] (#635)
• build(deps): bump codecov/codecov-action from 5.0.2 to 5.0.7 by @dependabot[bot] (#810)
• build(deps): bump github/codeql-action from 3.27.4 to 3.27.5 by @dependabot[bot] (#809)
• build(deps): bump Scrutor from 5.0.1 to 5.0.2 by @dependabot[bot] (#779)
• build(deps): bump NuGet.Frameworks from 6.11.1 to 6.12.1 by @dependabot[bot] (#785)
• build(deps): bump Microsoft.VisualStudio.Threading.Analyzers from 17.11.20 to 17.12.19 by @dependabot[bot] (#790)
• Unbreak build pipeline after most recent drop of Analyzers by @DaveTryon (#813)
• build(deps): bump Microsoft.NET.Test.Sdk and Newtonsoft.Json by @dependabot[bot] (#808)
• build(deps): bump System.Threading.Tasks.Extensions from 4.5.4 to 4.6.0 by @dependabot[bot] (#792)
• build(deps): bump MSTest.TestFramework from 3.6.2 to 3.6.3 by @dependabot[bot] (#793)
• build(deps): bump FluentAssertions from 6.12.1 to 6.12.2 by @dependabot[bot] (#781)
• build(deps): bump MSTest.TestAdapter from 3.6.2 to 3.6.3 by @dependabot[bot] (#794)
• Bump System.Net.Http version by @sfoslund (#806)
• build(deps): bump github/codeql-action from 3.27.0 to 3.27.4 by @dependabot[bot] (#799)
• build(deps): bump Microsoft.IO.Redist from 6.0.1 to 6.1.0 by @dependabot[bot] (#787)
• build(deps): bump codecov/codecov-action from 4.6.0 to 5.0.2 by @dependabot[bot] (#805)
• Address CG issue in Microsoft.IO.Redist by @DaveTryon (#757)
• build(deps): bump Serilog.Sinks.Async from 2.0.0 to 2.1.0 by @dependabot[bot] (#777)
• Scrub dotnet 6 references by @DaveTryon (#775)
• Expand osx coverage in PR builds by @DaveTryon (#774)
• build(deps): bump MSTest.TestFramework from 3.6.1 to 3.6.2 by @dependabot[bot] (#772)
• build(deps): bump MSTest.TestAdapter from 3.6.1 to 3.6.2 by @dependabot[bot] (#771)
• build(deps): bump Microsoft.Build from 17.10.4 to 17.11.4 by @dependabot[bot] (#764)
• typo: ThrowArguement -> ThrowArgument; fix SPDX URL anchor by @bact (#769)
• Add language tag to code blocks and correct indented code block by @bact (#770)
• Update EsrpCodeSigning task to version 5 by @jlperkins (#761)
• Update SPDX spec links to current by @bact (#765)
• Fix several typos in Markdown files and in a comment by @bact (#766)
• build(deps): bump System.Reactive from 5.0.0 to 6.0.1 by @dependabot[bot] (#588)
• build(deps): bump dotnet/runtime-deps from 6.0.8-bullseye-slim-amd64 to 7.0.20-bullseye-slim-amd64 by @dependabot[bot] (#589)
• build(deps): bump actions/setup-dotnet from 4.0.1 to 4.1.0 by @dependabot[bot] (#763)
• build(deps): bump System.Threading.Tasks.Dataflow from 4.11.1 to 8.0.1 by @dependabot[bot] (#611)
• build(deps): bump Serilog.Extensions.Hosting from 7.0.0 to 8.0.0 by @dependabot[bot] (#657)
• build(deps): bump Scrutor from 4.2.2 to 5.0.1 by @dependabot[bot] (#727)
• build(deps): bump actions/checkout from 4.2.1 to 4.2.2 by @dependabot[bot] (#760)
• build(deps): bump github/codeql-action from 3.26.13 to 3.27.0 by @dependabot[bot] (#759)
• Bump Microsoft.Extensions.Caching.Memory for CVE by @DaveTryon (#758)

v3.0.1

⚙️ Changes

• Add support for osx-arm64 by @DaveTryon (#756)