# What changed in @cyclonedx/cdxgen

> 303 changes in @cyclonedx/cdxgen 12 to 13 from its official release notes, upgrade guides and advisories: 32 breaking, 35 security, 79 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/@cyclonedx/cdxgen/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @cyclonedx/cdxgen 13

### Breaking changes

- Requires --verify-existing-with or --allow-unverified-history before adding a signers entry. (12.8.6, 13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0), [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.8.6)
- Exits with status 4 whenever a key is given and verification fails. (12.8.6, 13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0), [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.8.6)
- Requires --public-key or --secret-key and a root signature; verification rejects invalid UTF-8, duplicate member names, and numbers not exactly representable as doubles. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Generated .NET purls no longer use @latest. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- A project's settings.xml no longer overrides configured mirrors and credentials. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- cdx-verify requires this repeatable option or --secret-key, rather than falling back to a working-directory public.key. (12.8.6, 13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0), [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.8.6)
- Fails when the sandbox refuses a trace run instead of writing an empty BOM. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Lets cdx-sign verify existing history before adding a signers entry. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Verification is stricter against BOM content not signed by the trusted key, including missing root signatures and ambiguous JSON values. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- The cbom command rejects `-t os` instead of attempting source crypto analysis against an OS inventory. (13.1.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.1.0)
- Distro qualifiers are aligned with purl namespaces, and Azure Linux and CBL-Mariner are canonicalised to azure-linux. (13.1.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.1.0)
- The npm package was renamed from @cyclonedx/cdxgen. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- The generation floor is now CycloneDX 1.6, 1.7 is the default, and 2.0 is accepted as a target; CLI generation of 1.4 and 1.5 is no longer supported. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- Container images moved from the ghcr.io/cyclonedx namespace to ghcr.io/cdxgen. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- The minimum supported Node.js version is now 24. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- Writes the BOM document to stdout instead of silently creating a file named -. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- Invalid purls are omitted, PyPI names are normalized, and several purl forms were repaired; downstream consumers should normalize purl strings before lookup during the transition. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- PyPI names containing dots or underscores are normalized to hyphens per PEP 503, changing both purl and bom-ref. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- The Flux data-flow engine drops sanitised and benign flows, lowering reachable counts and increasing purl coverage; existing assertions may need re-baselining. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- stdout carries only the payload; diagnostics move to stderr. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)

### Security

- Allows a BOM without a root signature only when every component, service, and annotation is signed. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- pnpm BOMs no longer expose the absolute install path. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Fails when any entry or any provided key does not verify. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Keys response-cache entries on credentials so one user's response is not served to another. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Adds audit rules for mutable git refs, registry modules without exact versions, and sources with embedded credentials. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Prevents credentials in module sources from reaching the BOM. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Crafted container image tar references can no longer access host files through layer, config or WorkingDir paths. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- flake.nix inputs are capped or rewritten to run in linear time, reducing parsing abuse. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- When dependency installation is disabled, project-local build wrappers and rush or pipenv installers are no longer executed. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- Files with prototype-polluting keys now produce a warning instead of crashing. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- pnpm lock entries named __proto__ are prevented from reaching the SBOM. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- Docker-config registry credentials are forwarded to a token realm only when it is on the registry's own host. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- requirements.txt inputs are capped or rewritten to run in linear time, reducing parsing abuse. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- Arguments passed to shell commands are quoted for the platform shell so paths with spaces or shell characters remain single tokens. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- tracebom runs traced commands through safer-exec with an egress proxy, sandbox dry-run mode and policy flags, and reports unavailable tracing or command failures. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- PyTorch pickle checkpoints are flagged because loading them executes code. (13.2.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.2.0)
- ML-DSA, ML-KEM, and all twelve SLH-DSA parameter sets use verified OIDs; unresolvable families are skipped rather than assigned fabricated OIDs. (13.2.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.2.0)
- SLH-DSA now requires its hash family, preventing crashes on spellings such as SLH-DSA-192f. (13.2.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.2.0)
- Plugin skills preview actions with a dry run and do not install dependencies on the user's behalf. (13.1.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.1.0)
- These files are detected and hashed but never executed; repairs are taken from the lockfile instead. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- packageExtensions in a project's package.json are applied declaratively and disclosed on the BOM without executing project code. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)

### New APIs and options

- Allows cdx-sign to add a signers entry without verifying existing history. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Angular app.config.ts files are now analyzed. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- astgen adds template analysis for Ember, Angular, Alpine, and Astro. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Reads CMake presets to find build trees. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Mill 1.x projects are inventoried. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- scala-cli projects are inventoried. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- cdx-verify requires this option or --public-key. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Supports Windows tracing in a Microsoft eXecution Container and records loaded DLLs through ETW with valid purls. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Now include tracebom. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Full CMake and compilation database support depends on atom 4; atom 3.1.1 parses sources without a database as before. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- Atom runs have their own configurable time limit. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- CAXA_PREFETCH is documented as a configuration point for standalone-binary prefetching. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- The standalone binary extraction directory is a reusable cache, with CAXA_TEMP_DIR documented for configuring it. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- A path to a CMake cache can be supplied so cdxgen can resolve C and C++ dependencies from the build. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- Specify a JSON compilation database explicitly for cdxgen or evinse; it is passed to atom only when the installed atom supports it. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- The new caxa mode builds an SBOM from the extracted app, including npm integrity hashes, present native tools and vendored packages. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- A new project type inventories installed agentic coding assistants, recording versions and structural counts without configuration values and redacting home paths. (13.2.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.2.0)
- Dosai package reachability verdicts are propagated with their kind, confidence, and reasons. (13.2.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.2.0)
- Kotlin analysis records data-flow slices, trace completeness, workspace-root reachability, and kosi diagnostics, including degraded status when kosi does not trust its counts. (13.2.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.2.0)
- Set a target triple to resolve the Cargo dependency graph for that specific target. (13.2.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.2.0)
- Set this environment variable to 1 to opt out of kosi analysis. (13.2.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.2.0)
- Use this flag to opt out of kosi analysis. (13.2.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.2.0)
- Configure the registry-aware default user agent with this environment variable. (13.2.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.2.0)
- Override the user agent for the crates registry. (13.2.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.2.0)
- Elm is supported as a project type, including elm.json and legacy 0.18 lockfiles, with offline enrichment from ELM_HOME and optional registry queries. (13.2.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.2.0)
- evinse can analyze Kotlin sources natively with kosi, producing source locations, callstacks, cryptographic assets, and SaaSBOM services instead of using the generic JavaScript path. (13.2.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.2.0)
- Kotlin analysis surfaces JNI seams, loadLibrary binding sites, and cinterop .def files as security signals on the components they attach to. (13.2.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.2.0)
- The JavaScript analyzer provides first-class Svelte and SvelteKit support, recovering source evidence from .svelte imports and attributing SvelteKit virtual modules to @sveltejs/kit. (13.2.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.2.0)
- cdxgen ships as a Claude Code plugin for SBOM, container and host scans, CBOM, AI-BOM and MCP inventory, auditing, signing, validation, evidence enrichment, and Dependency-Track publishing. (13.1.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.1.0)
- SaaSBOM routes include handler path and query parameters, request body type, and response type across gin, chi, echo, and net/http. (13.1.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.1.0)
- Scans can report SBOM completeness, build-environment limitations, and ranked remediations to improve fidelity. (13.1.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.1.0)
- The introspect profile provides SBOM completeness reporting and ranked remediation guidance. (13.1.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.1.0)
- CycloneDX 1.7 cryptographic assets support the algorithmFamily field. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- Zig is a first-class project type; build.zig.zon is read and the full transitive graph is resolved. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- A cache subcommand is available for the bounded fetch cache. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- Sets the fetch cache TTL. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- The BOM discloses applied npm packageExtensions. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- The BOM discloses a hash for applied npm packageExtensions. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- Setting this environment variable to stdout restores the v12 stream layout during migration. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- CycloneDX 1.7 citations are supported at the document root. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- Controls color output. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- CycloneDX 1.7 cryptographic assets support the ellipticCurve field. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- Gleam is a first-class project type and its project and manifest files are read to map packages to pkg:hex. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- Selects the log format, including NDJSON on stderr. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- Traffic Light Protocol classification is supported under document distribution constraints, with value redaction for CLEAR, GREEN, and AMBER. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- Bazel projects using bzlmod are parsed from MODULE.bazel and MODULE.bazel.lock, with resolved dependencies mapped to their real ecosystem purls. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- Mojo is a first-class project type; Mojo-native packages are separated from conda and PyPI packages pulled in through pixi.lock. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- Disables the bounded fetch cache. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- Disables progress output. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- A quiet flag is available. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- Retrieves and merges a supplier SBOM over the TEA conformance endpoint. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- Publishes the generated BOM as a TEA Artifact; the experimental publisher uses exit status 3 on failure so the locally written BOM is not lost. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- Verbose levels are now countable. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)

### Performance

- Walks the source tree once instead of ten times. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Skips packages no public registry can describe and remembers answers for the whole scan. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Cargo, Go, NuGet, RubyGems, pub, jsr, and Elm enrichment reads local caches first and fills only missing data. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Builds are fully supported and faster; deep sbt scans reuse the Coursier cache. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Large standalone-binary companions become lazy members, extracted and verified on first use, reducing cold-start writes and memory use. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- Crate metadata is read from the local Cargo registry before querying crates.io, reducing delays on large lockfiles. (13.2.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.2.0)
- Call graph construction is leaner and roughly ten times faster. (13.1.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.1.0)
- The cdxrs Rust binary backs fetch, while JavaScript paths remain primary and Rust paths are an optional optimization. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- Startup and small-project scans are roughly 45 percent faster, peak memory is down, and large scans are significantly faster with the new Rust backend. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)

### Behavior and default changes

- Astro configuration files are now analyzed. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Separates first-party and vendored code from third-party libraries. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Attributes evidence through resolved includes. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Records the compiler and its hardening flags in the formulation. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Deep sbt scans reuse the Coursier cache. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Uses metadata from the scanned project rather than the current working directory. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Produces Scala occurrences with exact lines, call stacks, crypto asset OIDs, and inbound and outbound endpoints without requiring atom. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Produces Scala occurrences with exact lines, call stacks, crypto asset OIDs, and inbound and outbound endpoints without requiring atom. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Checks local Maven, Gradle, and Coursier caches first, reducing Maven Central requests and avoiding them when build tools use a repository manager. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Pauses a rate-limiting host, honors Retry-After, and advises which mirror setting to use; build tools stop retrying into a rate limit. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Captures TLS details and egress hosts from a normal prompt. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Fills metadata for poetry, uv, pylock, Pipfile.lock, and requirements entries. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- backs off from hosts that rate limit. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Builds evidence from compiler facts for Scala 2.13 and Scala 3 through 3.10, improving precision and accuracy. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Default scans now pick up Terraform automatically. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Scans Terraform modules whether or not terraform init or tofu init has run, and builds a dependency graph from the root through modules to providers. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Reads module licenses from downloaded packages, with optional OpenTofu registry and GitHub lookup. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- cdxgen resolves C and C++ dependencies from build trees, including CMake requirements and fetched or pinned dependencies, rather than stopping at manifests. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- A JSON compilation database is automatically sought in the scan root, usual build directories, and next to --cmake-cache. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- The Ruby collector no longer runs for every multi-type scan, avoiding unnecessary bundle install for non-Ruby projects. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- In container mode, trivy runs only as a rootfs scan. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- Windows container image scans can use WSL Containers automatically when wslc is installed, without requiring Docker Desktop. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- Build dependencies and proc-macros move out of the component list into the formulation section, with their bom-refs kept resolvable. (13.2.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.2.0)
- Dynamically linked native libraries are marked external under CycloneDX 1.7. (13.2.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.2.0)
- Maven Central requests are gated behind a per-host rate policy to address its aggregate limits and escalating bans. (13.2.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.2.0)
- Detection now reads additional client configurations, MCP Registry server.json manifests, MCPB and DXT bundles, and signals from the MCP 2026-07-28 protocol draft. (13.2.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.2.0)
- Inventory now recognizes GGUF, safetensors, ONNX, and PyTorch pickle checkpoints. (13.2.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.2.0)
- Crates declaring links produce separate native C library components, so advisories can be associated with the native library rather than its Rust binding. (13.2.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.2.0)
- BOM submission now uses a multipart form POST. (13.1.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.1.0)
- Taint analysis carries field-qualified values across by-value aggregate copies and higher-order calls. (13.1.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.1.0)
- Analysis resolves routes, inventories services and AI usage, seeds taint sources, and maps trust zones, including MCP tooling. (13.1.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.1.0)
- Framework signals are derived from PyPI classifiers, and the frameworks list has grown. (13.1.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.1.0)
- Rust analysis evaluates cfg attributes. (13.1.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.1.0)
- Rust analysis now analyses dependencies. (13.1.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.1.0)
- Rust analysis types method receivers. (13.1.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.1.0)
- Rust analysis resolves real modules and imports rather than guessing. (13.1.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.1.0)
- Unordered collections are sorted at finalization for deterministic output, and annotation timestamps derive from the annotated document so repeated renders agree. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- C/C++ BOMs now resolve CMakeCache.txt and git submodules, attach cache versions, collapse repeated CMake requirements, and emit relative purl subpaths for absolute includes and versionless lockfile roots. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- A strict purl implementation enforcing the purl-spec ABNF and per-type policies replaces packageurl-js. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- Container and OS scan BOMs are kept as CI artifacts even when a scan fails. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- Embedded Python SBOMs under this directory are expanded so their declared components appear as dependencies of the distribution. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- Native atom binaries remove the JDK requirement on five platform targets; the three jar-kind triples still need Java 23. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- Path-style alias values are resolved instead of being built into purls. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)

### Tooling

- New Python 3.15 images are available. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Swift images now include sourcekitten, so Linux evidence collection does not require an extra install. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- Go 1.27 projects are supported end to end. (13.1.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.1.0)

### Fixes and other changes

- Evidence is version-aware, lists each call site once, and no longer credits framework calls to coverlet. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Resolves repo-relative paths correctly and reports failures. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Gradle builds using the configuration cache work again. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Gradle builds using isolated projects work again. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Attributes dependencies in multi-project Gradle reports to the correct subproject. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Resolves repo-relative paths correctly and reports failures. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Packages with the legacy licenses field now get a license. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Resolves Maven reactors once. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- MSBuild property versions now resolve. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Direct dependencies point to what was actually installed. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Multi-project solutions use the version from each project's own restore output. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- A failed PyPI lookup can no longer rename a package. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Resolves repo-relative paths correctly and reports failures. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Writes a CBOM that validates against CycloneDX 1.6 and 1.7. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Keeps every traced crypto asset instead of only the last one. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Keeps uv workspace members in every scan. (13.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.4.0)
- Validator exceptions now surface in cdx-validate reports. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- The .NET root is merged instead of duplicated, synthesized arborist edges are not marked as manifest sources, and protobuf round-trips no longer yield empty dependsOn. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- dosai now respects the exclusion option. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- JavaScript workspace members are now linked into the dependency tree. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- Ruby gem metadata now describes the gem being built, with version and descriptive fields carried over from its gemspec and version.rb. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- The cleaned npm version is recorded as a purl qualifier while reserved characters in purls are escaped exactly once. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- A NuGet scan falls back when the service index is unreachable. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- A gem's required Ruby version is represented as one Ruby platform component with an intersected version range. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- Gemspec fields including email, singular license, unquoted homepage URLs and interpolated metadata URIs are now parsed. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- evinse evidence is restored for the Swift Build backend by attributing calls through compiler-resolved references. (13.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.3.0)
- Bare owner/repo-shaped paths are no longer misclassified as Hugging Face repositories, avoiding an empty AI-only BOM. (13.2.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.2.0)
- A NuGet component's version and purl now stay in agreement. (13.2.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.2.0)
- The TOML parser change enables parsing PEP 735 dependency groups in pyproject.toml files. (13.2.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.2.0)
- The default user agent no longer gets blocked at crates.io's CDN edge, fixing 403s some users saw. (13.2.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.2.0)
- Rust dependency kinds and platform gates are resolved per edge, so this option filters dependencies correctly; observed optional dependencies are promoted to required. (13.2.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.2.0)
- Resolved Rust features are recorded per component. (13.2.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.2.0)
- Crypto algorithm assets resolve OIDs from the shared table; algorithms that cannot be named by the table are skipped instead of emitted invalid. (13.2.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.2.0)
- Audit rules remain evaluable when a property is absent. (13.1.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.1.0)
- Call graph construction falls back to CHA and records a diagnostic instead of aborting the report when underlying analysis panics. (13.1.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.1.0)
- Handler analysis follows import aliases and renamed context parameters, and resolves group-root registrations to their group prefix. (13.1.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.1.0)
- JVM projects can be resolved when their wrapper is broken or they target an unsupported JDK, avoiding shallow BOMs. (13.1.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.1.0)
- Poetry dependency keys are normalised. (13.1.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.1.0)
- Dependency-Track project tags are sent as a comma separated list so they do not land as a single value. (13.1.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.1.0)
- An unparseable workspace pyproject.toml no longer terminates the scan. (13.1.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.1.0)
- First-party modules are no longer misattributed to distributions. (13.1.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.1.0)
- Parsing emits parent dependency edges and repairs missing root edges. (13.1.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.1.0)
- Route templates resolve to concrete URLs, including versioned segments. (13.1.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.1.0)
- Rust analysis recovers from macros. (13.1.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.1.0)
- The cbom command alias now handles -t os. (13.0.1) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.1)
- Cleans the detected parent component. (13.0.1) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.1)
- Fixes canonicalisation of OS package URLs. (13.0.1) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.1)
- Fixes the TUI, which was broken with the new UX. (13.0.1) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.1)
- .NET Central Package Management projects governed by this file now resolve correctly. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)
- Nix flake inputs use pkg:generic with a vcs_url qualifier and proposedType marker instead of the unrecognised pkg:nix type. (13.0.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v13.0.0)

## @cyclonedx/cdxgen 12

### Breaking changes

- Allows adding a signers entry without verifying existing signatures when explicitly selected. (12.8.6) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.8.6)
- Requires a root signature unless --allow-nested-only is used. (12.8.6) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.8.6)
- Refuses BOMs that are not valid UTF-8, repeat a member name, or contain a number a double cannot represent exactly. (12.8.6) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.8.6)
- Verification now binds each signature's algorithm, keyId and publicKey, and requires the algorithm to match the key type, fixing a signature forgery vulnerability. Signatures created with 12.8.4 or earlier must be re-signed. (12.8.5) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.8.5)
- HMAC signatures now require the `--secret-key` option. (12.8.5) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.8.5)
- When signing is configured but fails, cdxgen exits with an error instead of writing or uploading an unsigned BOM. (12.8.5) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.8.5)
- The distro_name value can contain only the distro codename. (12.8.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.8.0)
- Includes more Python build packages in generated results. (12.7.1) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.7.1)
- Filters @types/* npm packages out of runtime scope and requiredOnly BOMs so they appear as dev-only. (12.5.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.5.0)
- Exclude arguments are now passed to atom. (12.4.4) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.4.4)
- Chrome and IDE extension discovery is limited to explicit extension project types. (12.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.4.0)
- Secret-bearing metadata is redacted from BOMs. (12.3.3) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.3)

### Security

- Accepts a BOM without a root signature only when every component, service and annotation carries a signature that verifies. (12.8.6) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.8.6)
- Fails when any signature entry or any given key does not verify. (12.8.6) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.8.6)
- Hardens JSF signature verification so the library function cannot report success for BOM content the trusted key never signed. (12.8.6) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.8.6)
- @cyclonedx/cdxgen: Maven project scanning may allow shell command injection through repository-controlled module paths (12.4.3) — [security advisory](https://github.com/advisories/GHSA-5VWR-QCHF-Q4PF)
- Hardens handling of Maven shell metacharacters to address a security issue. (12.4.3) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.4.3)
- HBOM secure mode enforces allowlist preflight checks for commands and paths. (12.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.4.0)
- @cyclonedx/cdxgen: Docker registry auth substring match forwards credentials to a different registry (12.3.3) — [security advisory](https://github.com/advisories/GHSA-QHH4-458H-XWH2)
- Dependency-Track submissions enforce host matching to harden security. (12.3.3) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.3)
- Registry authentication now enforces host matching to prevent credential leaks. (12.3.3) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.3)
- Sensitive BOM properties are validated against CycloneDX 1.7 TLP requirements. (12.3.2) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.2)
- Cargo predictive audit can predict supply-chain attacks against dependencies, with expanded coverage for cache inventory and workspace-aware prioritization. (12.3.1) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.1)
- Adds a command to analyse one BOM or a directory of BOMs for upstream supply-chain risks, with severity-based gating for CI and review workflows. (12.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.0)
- Adds extraction of Chrome extension security properties. (12.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.0)
- Adds GTFOBins-backed container risk analysis and BOM audit rules. (12.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.0)

### New APIs and options

- Adds support for the pnpm CJS alias. (12.8.3) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.8.3)
- Adds detection of AI-generated code and authorship provenance. (12.7.1) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.7.1)
- Adds a license enhancer. (12.7.1) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.7.1)
- Adds components for PDM files. (12.7.1) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.7.1)
- Adds components for pnpm workspaces. (12.7.1) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.7.1)
- Adds a checker for policy violations. (12.7.1) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.7.1)
- Adds native SBOM attachment support for containers. (12.7.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.7.0)
- Adds support for the no-ignore argument. (12.7.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.7.0)
- Adds tracebom support for CBOM generation. (12.6.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.6.0)
- Adds a TUI mode powered by cdxui, available with the --tui argument. (12.6.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.6.0)
- The new ai type generates AI/ML-BOMs. (12.5.1) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.5.1)
- Adds golem integration for Go analysis, including call graphs, data-flow extraction, supply-chain evidence, and cryptographic-asset component generation. (12.5.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.5.0)
- A component type filter was added; the notes do not specify how to use it. (12.4.4) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.4.4)
- A caxa v3 batch workflow is available. (12.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.4.0)
- HBOM adds a dry and diagnostics mode. (12.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.4.0)
- Predictive audit allowlist filtering is available. (12.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.4.0)
- C/C++ BOM generation now supports collider.lock files. (12.3.3) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.3)
- Remote and offline OBOM generation now supports staged rootfs inputs. (12.3.3) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.3)
- A dedicated mcp project type is available. (12.3.1) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.1)
- cdxgen can now identify the MCP configurations and skills used in your project. (12.3.1) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.1)
- Adds ATT&CK-aware audit and workflow analysis to cdx-audit. (12.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.0)
- Adds a command to convert CycloneDX 1.6/1.7 BOMs to SPDX. (12.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.0)
- Adds dedicated BOM audit rules for Chrome extensions. (12.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.0)
- Adds direct Chrome extension path scanning using the chrome-extension target. (12.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.0)
- Adds support for PEP 751 pylock.toml files. (12.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.0)
- Adds SPDX output support in server mode, including SPDX format support for `/sbom`. (12.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.0)

### Behavior and default changes

- Adds compatibility with custom license specs. (12.8.3) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.8.3)
- Bun support is improved. (12.8.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.8.0)
- Strips the Scala version suffix for sbt. (12.7.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.7.0)
- For JavaScript and Python projects, AI-BOMs now include exact occurrence evidence. (12.5.1) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.5.1)
- evinse is now supported for Rust projects; pass --profile research to generate an SBOM with rich occurrence and call-stack evidence. (12.5.1) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.5.1)
- Template and icon class heuristics now cover material-symbols, primeicons, bootstrap-icons, and fontawesome. (12.5.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.5.0)
- JavaScript handling was improved; the notes do not specify the details. (12.4.4) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.4.4)
- CBOM behavior has been improved. (12.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.4.0)
- Dry-run mode now traces symlinks, spawn I/O, and archive extraction. (12.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.4.0)
- HBOM adds support for SEA binaries. (12.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.4.0)
- Package visibility has been improved. (12.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.4.0)
- Protobuf BOM support is added to cdx-convert, cdx-validate, cdx-verify, and hbom. (12.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.4.0)
- The field is now populated for externally identified components. (12.3.3) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.3)
- Mixed npm source scans now ignore vendored Composer and jar artifacts. (12.3.3) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.3)
- MCP inventory now covers OpenCode, Nanocoder, LangGraph, and CrewAI. (12.3.1) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.1)
- The secure-mode user experience for environment warnings has been improved. (12.3.1) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.1)
- Improves Windows LOLBAS / ATT&CK triage context. (12.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.0)
- Expands runtime rules for OBOM analysis. (12.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.0)

### Tooling

- Changes CLI option parsing to handle defaults better. (12.7.1) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.7.1)
- Detects CLI scripts using npx and pnpm dlx wrappers and hydrates npm package metadata from disk in deep mode. (12.5.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.5.0)
- The dry-run user experience for activity output has been improved. (12.3.1) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.1)

### Fixes and other changes

- Fixes an EACCES permission error when scanning /root. (12.8.4) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.8.4)
- Adds support for .NET Central Package Management. (12.8.3) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.8.3)
- Improves RubyGems parsing. (12.8.3) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.8.3)
- Fixes buggy sbt tree parsing. (12.8.3) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.8.3)
- Decompresses gzip, deflate, and br responses in undici httpClient. (12.8.1) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.8.1)
- Memoizes jar distribution lookups and discovers projects via sbt to fix hangs when processing sbt projects. (12.8.1) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.8.1)
- Deno support is added. (12.8.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.8.0)
- The OS distro namespace is canonicalized. (12.8.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.8.0)
- Using --exclude-type mcp no longer over-excludes MCP SDK packages. (12.8.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.8.0)
- Fixes native SBOM pulling for registries that do not provide the referrers API. (12.7.1) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.7.1)
- Fixes parsing of packages.config files. (12.7.1) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.7.1)
- Fixes parsing of Yarn aliases so they can be handled correctly. (12.7.1) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.7.1)
- Improves ASAR detection by sniffing headers. (12.7.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.7.0)
- Fixes a crash when scanning an empty go.mod file. (12.7.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.7.0)
- Fixes incorrect SBOM output when Gradle dependencies are unresolved. (12.7.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.7.0)
- Attempts to find hashes and licenses for Gradle dependencies. (12.7.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.7.0)
- Initial support for CBOM is now available for Rust projects, powered by rusi. (12.5.1) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.5.1)
- Improves required-scope detection for CSS, template, and CLI-based package usage, and parses .css, .scss, and .less style references. (12.5.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.5.0)
- Hardens Pixi parsing to better handle missing base paths and malformed TOML in workspace lock files. (12.5.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.5.0)
- Vue.js scope detection parses vite.config.* to reduce false negatives. (12.5.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.5.0)
- Vue.js scope detection parses vue.config.* to reduce false negatives. (12.5.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.5.0)
- Java Maven handling was improved; the notes do not specify the details. (12.4.4) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.4.4)
- Handles object-form GitHub Actions runs-on values. (12.4.2) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.4.2)
- Fixes profiling of standalone binary dependencies. (12.4.1) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.4.1)
- OBOM improvements include actionable output and Windows tuning. (12.4.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.4.0)
- BOM audit rules now cover disabled setup caches with remote npm or PyPI sources. (12.3.3) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.3)
- Fixed path selection for staged all-layers inputs. (12.3.3) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.3)
- Correctly classifies npm package-lock devOptional dependencies. (12.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.0)
- Improves Maven group and name detection from JAR manifests. (12.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.0)
- Handles Podfile.lock checks in CocoaPods scans without false missing-lock failures. (12.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.0)
- Adds purl source resolution for GitHub, Bitbucket, Maven, and Composer. (12.3.0) — [release notes](https://github.com/cdxgen/cdxgen/releases/tag/v12.3.0)