0.7.0

Improvements:

• Add full support for Go Toolchains
  • Cachi2 will use GOTOOLCHAIN=auto during the prefetch and any downloaded toolchains will be supplied in the output module cache
  • Cachi2 will no longer override GOTOOLCHAIN=local in the user build environment
• pip: report components with downloaded wheels in the SBOM
• pip: allow yanked sdists to be downloaded

Bug fixes:

N/A

0.6.0

Improvements:

• The merge_syft_sbom.py script packaged in the Cachi2 container supports the v1.5 style of metadata.tools
  • At least for the Syft SBOM. It still assumes that the Cachi2-generated SBOM is v1.4

Bug fixes:

n/a

0.5.0

Improvements:

• Add preliminary support for Go 1.21
  • preliminary support in this case means that cachi2 explicitly always sets GOTOOLCHAIN=local to force Go always use the bundled toolchain that came with the SDK
  • for projects building with Go < 1.21 a 1.20 toolchain will be downloaded to avoid the new 1.21 behaviour of bumping older go.mod files and thus tainting the input repository

Bug fixes:

n/a

0.4.0

Improvements:

• add support for Yarn

• document NPM support

• SBOM enhancements:

  • add cdx:npm:package:bundled, cdx:npm:package:development NPM CycloneDX properties
  • report missing hashes for pip packages
  • report missing hashes for Go modules

• pip: allow users to request wheel dependencies

• bump the container image to Fedora 38 to get Go 1.20

Bug fixes:
n/a

0.3.0

This is a 0.x release, the interface and behavior are not mature and may change between minor versions.

Full Changelog: 0.2.0...0.3.0

Bug Fixes

• Allow relative path for helper commands

Features

• Cachi2 NPM support
• Pip: Don't fail when we can't determine the project name and version

Incompatible changes

• N/A

0.2.0

This is a 0.x release, the interface and behavior are not mature and may change between minor versions.

Full Changelog: 0.1.0...0.2.0

Bug Fixes

N/A

Features

• Produced SBOMs now will have Cachi2's name in the metadata
• Added a utility script that allows merging the contents of Cachi2 and Syft SBOMs

Incompatible changes

N/A

0.1.0

Cachi2's first release! 🎉

This is a 0.x release, the interface and behavior are not mature and may change between minor versions.

Full Changelog: 0.0.0...0.1.0

Bug Fixes

N/A

Features

• Support for pip and gomod. See our README for details.

Incompatible changes

N/A