All pull requests

Pull requests

• Find NuGet packages in framework-dependent Windows single-file apps

  #5465·wleeaf opened Oct 23, 2026·4 tasks done·

  ·
  1

  1

• chore(deps): bump github.com/bmatcuk/doublestar/v4 from 4.10.2 to 4.10.3

  dependencies
  #5460·dependabot[bot] opened Oct 23, 2026Bot·

  ·

• feat(oci): import attested SBOMs from container registries

  dependencies
  #5453·Aur3ns opened Oct 21, 2026·13 of 14 tasks·

  ·

• feat: give unknown hash-based licenses more descriptive names

  #5448·ardentperf opened Oct 20, 2026·4 tasks done·

  ·

• fix: parse the last line of files with no trailing newline

  #5446·spicysharkco opened Oct 19, 2026·3 of 4 tasks·

  ·

• feat(spdx): fill package locations when decoding SPDX documents

  #5445·basitalisandhu opened Oct 18, 2026·4 tasks done·

  ·
  1

• Report the packages a package depends on in github-json

  #5444·arpitjain099 opened Oct 18, 2026Contributor·

  ·

• fix(cpe): build apple app bundle CPEs from a curated bundle-id mapping, not the display name

  #5443·choksi2212 opened Oct 18, 2026·

  ·
  1

  1

• fix: accept hyphenated and multi-label email domains in SPDX originator/supplier parsing

  #5442·choksi2212 opened Oct 18, 2026·4 tasks done·

  ·
  1

  3

• fix(golang): emit a stdlib package per Go toolchain in universal Mach-O binaries

  #5440·pujitha24 opened Oct 17, 2026Contributor·4 tasks done·

  ·
  1

• feat(template): expose parsed CPE attributes

  #5438·jdotc1 opened Oct 17, 2026·

  ·
  1

• fix(cyclonedx): preserve Alpine upstream URL references

  #5437·jdotc1 opened Oct 17, 2026·

  ·

• feat: detect macOS release from SystemVersion.plist

  #5431·jmountifield opened Oct 16, 2026·4 tasks done·

  ·
  1

• feat(executable): capture GNU ELF build IDs

  #5426·adityasaky opened Oct 14, 2026·9 tasks·

  ·
  1

• fix: don't write location annotations in place when merging

  #5425·sverrirsig opened Oct 14, 2026Contributor·4 tasks done·

  ·
  1

• fix: extract Python wheel file sources as zip archives

  #5423·loganrosen opened Oct 13, 2026·4 tasks done·

  ·

• Fix truncated pre-release versions in Go binaries' ldflags

  #5422·LemonCondor opened Oct 13, 2026·3 tasks done·

  ·

• fix(source): exclude nested paths under excluded dirs reached via symlink

  #5419·JasonMetal opened Oct 13, 2026Contributor·

  ·
  1

• Fix Tomcat embedded EL CPEs without Maven metadata

  #5413·bisswanger opened Oct 12, 2026·4 of 9 tasks·

  ·
  1

• Fix Chrome for Testing version detection

  #5408·SashaMIT opened Oct 11, 2026·5 of 10 tasks·

  ·
  1

  1

• fix(binary): detect elastic-agent 7.17.x, 8.2.x-8.10.x, 8.17.10 and 8.19.10+

  #5407·unknownhackerworld opened Oct 11, 2026·4 tasks done·

  ·
  1

  1

• feat(java): add option to exclude Maven dependency scopes from pom.xml

  #5406·bhaskargurram-ai opened Oct 11, 2026·4 tasks done·

  ·
  1

• perf: skip symbol table and build info loads for binaries that cannot match

  #5405·bhaskargurram-ai opened Oct 11, 2026·4 tasks done·

  ·

• Fix unbounded memory use decoding AI model metadata from CycloneDX

  #5404·moneytool opened Oct 10, 2026·4 tasks done·

  ·
  1

  2

• fix(alpine): support unbounded line lengths in parseApkDB

  #5403·Guurdeep opened Oct 9, 2026·4 of 9 tasks·

  ·
  1