Release Notes

v1.0.0

August 11, 2026

Enhancements

  • Add sbomasm plugin for assembling CycloneDX SBOMs (!1)

  • Add fetch_vex plugin to download a project’s VEX file from Dependency-Track (!3)

  • Add sbomqs plugin as an SBOM quality gate (!5)

  • fetch_vex now takes the project version directly via CLI instead of spin configuration (!6)

Chores

  • Extend the primary SBOM instead of merging into a new root, and drop enrichment (!4)

  • Update default sbomasm 2.0.3 -> 2.0.8 (!7)

  • Drop sbomasm.use and change sbomasm.install_dir (!8)

  • Add SonarQube analysis (!9)

  • Update CI includes and stale references after move to pod/components (!11)

v1.0.0-rc1

May 18, 2026

Enhancements

  • Add sbomasm plugin for assembling and enriching CycloneDX SBOMs (!1)