Skip to main content

v0.14.0 — Runtime-scope filtering, EOL flagging, iOS scanning

A feature release. The headline change alters scan results on purpose — read the upgrade notes below. The full machine-readable changelog lives in CHANGELOG.md.

Highlights​

Scan results now describe what actually ships — runtime-scope filtering (default ON)​

Source scans drop non-deployable dependencies from the SBOM before persist, signing, and vulnerability matching: Maven test / provided nodes and npm devDependencies. CVE counts and license obligations now describe the artifact you deploy, not your build environment. The scan summary shows how many components were excluded.

Component and CVE counts drop on the first re-scan

The first re-scan of an affected Maven/npm project after upgrading will report fewer components and CVEs than before — that is the feature working, not data loss. To restore the previous full-graph behaviour set SCAN_SCOPE_FILTER_ENABLED=false (or the per-ecosystem SCAN_SCOPE_FILTER_MAVEN_ENABLED / SCAN_SCOPE_FILTER_NODE_ENABLED). SBOMs uploaded via the ingest API are never filtered — an uploaded SBOM is the supplier's declared truth.

End-of-life (EOL) component flagging​

Components matching a curated endoflife.date product whitelist (Spring Boot, Express, Django, Rails, Angular, Vue, Next.js, Symfony, Laravel, Spring Framework) are stamped with their lifecycle verdict. The Components tab gains an EOL badge and an "EOL only" filter, the drawer an End-of-life row, and the project Overview an EOL count. Verdicts come from a snapshot vendored with the release — zero network at scan time, air-gap safe. A weekly beat re-stamps the catalog, and admin/health gains an endoflife.date snapshot panel (dataset age, flagged totals, next fire).

iOS trees scan from committed lockfiles​

A Podfile used to crash the whole source scan. Pods — components and the dependency graph, subspecs included — are now reconstructed offline from the committed Podfile.lock, and repos with a committed Package.resolved route to the Swift environment without re-resolving.

No failed write stays silent — error-UX closeout​

A global mutation error handler now toasts any write failure that a screen does not surface itself (RFC 7807 detail, locale-aware fallback), and the crash-screen ErrorBoundary is translated (EN/KO) and announced to screen readers via role="alert".

Audit trail for external side effects​

Two previously invisible actions now leave audit rows with full request context: posting/updating a gate PR comment (sca_pr_comment.posted / .updated) and uploading a source archive (source_archive.uploaded).

Fixes​

  • Real OSS uploads no longer trip the zip-bomb guard. The per-member compression-ratio ceiling now applies only to members above a 10 MiB uncompressed floor (SOURCE_ARCHIVE_RATIO_GUARD_MIN_BYTES), so tiny sparse fixtures (Juice Shop's 940x test PDFs) pass while 42.zip-class bombs are still rejected instantly.
  • Quickstart matches reality again. The documented seed command now uses seed_demo --demo-only, so the project list shows exactly the 5 projects the guide promises.
  • KO translations backfilled for the v0.11.0–v0.13.1 release notes.

Security​

  • Worker Go toolchain bumped to 1.25.12 — clears Go stdlib CVE-2026-39822 (HIGH) on the bundled Go binaries and govulncheck.

Upgrade notes​

  • Expect lower counts on the first re-scan of Maven/npm projects (see the caution above) — communicate this to teams before upgrading shared portals.
  • Migrations auto-apply at container startup (AUTO_MIGRATE, the default): 0038_component_eol and 0039_eol_sync_state are forward-only.
  • EOL flagging is on by default but fully offline (EOL_ENABLED=false disables; EOL_SNAPSHOT_PATH mounts a fresher snapshot; live refresh stays off unless EOL_REFRESH_ENABLED=true).

Pull the 0.14.0 images (or helm upgrade to the 0.14.0 image tag).