What's new

A factual record of recent, shipped product improvements. Everything listed is in the current release, covered by tests, and documented — nothing here is a preview. Dates are engineering-verification dates.

August 2026#

Terminal output wraps to your terminal, including the pre-run disclosure#

• The block that says what a run is about to do is now readable. Before quickstart writes anything it discloses the scan root, the output directory, the config it will create and the fact that the run is offline. That block was printed unwrapped at up to 243 characters — the most safety-relevant text in the product was the least readable text in it, wrapping three times on a standard terminal. quickstart, analyze, audit and review now lay their output out to the width of the terminal they are printed on.
• One rule, one place. sbomflow help <command> already honoured COLUMNS; the run did not, and a third surface wrapped to a fixed width it could not see past. All of them now derive the same width, clamped so a very narrow terminal does not produce one word per line and a very wide one does not produce full-width prose.
• Nothing was shortened or dropped to make the text narrower. Wrapping changes where lines break and nothing else: no warning, refusal, disclosure sentence, provenance line or count lost a word, and a test asserts that by re-joining the wrapped output and comparing it character for character against the text it started from.
• Redirected output is unchanged. With no terminal to ask — piping to a file, or in CI — the layout is exactly what it has always been. Generated files (cli-reference.md, the man page, the shell completions) pin their own width and never follow COLUMNS, so they still regenerate identically everywhere.

The compatibility matrix now publishes the trigger and the result, not just the lane#

• Each row says which events actually run it. Five CI lanes are skipped on a push to main, so a green run there is evidence about two Ubuntu interpreter lanes and nothing else. The compatibility matrix previously said the lanes ran "on every push and pull request"; that was wrong for four of the six published combinations, and each row now states its own trigger. A drift test derives the trigger from the workflow file, so the page cannot quietly round it up again.
• The native-Windows lane is reported as what it is: red. It runs on every pull request and every nightly and has never passed — 159 lane runs, zero. The page used to say the lane stopped before finishing and that most of the suite had never been observed running on Windows. That was not true: the suite completes and reports about 99 failing checks out of ~10,100, and that measured result is now quoted verbatim. Tested-and-red is a worse status than we had published for ourselves, and it is the accurate one. The recommendation is unchanged: run SBOMFlow on Windows through WSL.
• Two claims are withdrawn rather than reworded. macOS-on-Intel is named as unverified instead of "expected to work", and the filesystem-support page no longer says CI execution is unavailable — the Ubuntu and macOS lanes run and have completed green. Where a platform is unverified, the page now names it.

Every release now records what intelligence shipped in it (experimental)#

• ai-evidence.json is written on every analyze and audit run and listed in START-HERE.md. It inventories the AI model artifacts in your release tree against the same release identity as the rest of the pack, with each artifact's path, size, SHA-256 and — the part that matters — how strongly it was identified: a documented magic number (GGUF, TFLite), a documented structural invariant (SafeTensors; ONNX, which defines no file magic at all), or the filename alone, which is recorded as such so you can see when a claim rests on a name an attacker controls.
• Nothing is loaded, deserialised, or executed. The formats most widely used to ship weights are designed to reconstruct arbitrary objects, so "load it and read the metadata" is code execution with extra steps. Those formats are recognised and refused: recorded and hashed so their presence is visible evidence, deliberately never opened. Signatures are checked as well as extensions, so a pickle wearing a .onnx name is caught by its bytes and the disagreement is raised rather than swallowed.
• A truncated inventory says so. The tree walk is bounded on entry count and directory depth and does not follow symlinks out of the scan root; if a budget stops or prunes it, the inventory is reported as partial and names the budget that fired. One over-deep directory never erases the inventory of its siblings.
• An empty result is stated honestly. A product with no AI in it gets a record saying the scan looked and recognised nothing — which is never the same claim as "this product contains no AI". Unrecognised formats, models fetched at runtime, and models behind an external service are outside what any filesystem walk can see.
• Honest scope: this is an inventory for a human, with no score, no verdict, and no safety or conformity claim. It assesses no model's behaviour or quality, observes nothing at runtime, and the declared-manifest and agent authority models are not yet wired to a command — see capabilities for the per-row status and known limitations for the edges.

CRA Article 14 drafts now show the clock, on the right anchors#

• Each stage draft carries a deadline window block evaluated as plain elapsed time against instants you record. Four windows are shown because Article 14 defines four — started by three different events. Neither final-report window runs from awareness, so each stays unknown by name until you record its own anchor rather than being measured from some other timestamp. "We could not work it out" and "there is still time" are different states with different words.
• It shows the clock and the fields; it never decides that anything is reportable, and SBOMFlow still never files, transmits, signs, or submits anything, and contacts no authority or reporting platform.

July 2026#

The filesystem & concurrency contract is now published — and tested#

• Filesystem & concurrency support states exactly which filesystem and cross-process guarantees SBOMFlow makes, where each is verified, and what is explicitly out of contract (network mounts, cloud-synced directories, FAT/exFAT media) or pending external validation (native Windows). Every tested row is pinned to an executable check in the offline suite — killed writers, SIGKILLed lock holders, injected fsync failures, real case-insensitive-volume behaviour — so the page states what is proven, not what is hoped. Process crash, OS crash, and power loss are three explicitly distinct claims: the first is tested, the last is deliberately never made.

Operator recovery playbooks, tested end-to-end#

• Recovery playbooks documents one diagnose → recover path per operational failure — interrupted decision transactions, corrupt journals, audit-chain mismatches, expired waivers, stale advisory snapshots, schema migrations, evidence gaps, and unmet approval quorums. Every tested playbook is exercised end-to-end by the offline suite: the failure state is really created, the documented commands are really run, and the documented recovery is really verified, so the page cannot drift from the product.

Advisory matching you can trust across ecosystems#

• Maven coordinates now match across separator conventions. Real-world advisory data names Maven packages group:artifact; component identities recorded from build files use group/artifact. These are now matched consistently (with guards so different coordinates can never be bridged), closing a silent false-negative class for Maven and Gradle projects. No action needed — re-running an audit picks this up.
• Business-scale advisory validation. The synthetic manufacturer laboratory now drives a full ~4,900-component estate through offline advisory matching with positive and negative controls — including a known-exploited entry that must surface first in the issue queue and a fixed-before-shipped advisory that must not match. See testing & trust.
• Remaining limitation: Maven-native version-range ordering is not yet implemented; such ranges surface as unknown for human verification instead of deciding silently. See known limitations.

Large monorepo inputs now parse#

• Recognized structured inputs (lockfiles, manifests, SBOM files) parse up to 50 MB — previously anything over the general 5 MB text-scan limit was skipped. A measured example: a 22.4 MB package-lock.json with ~50,000 components scans in about 11 seconds using roughly 760 MB peak memory (Apple Silicon; results vary with hardware and input shape).
• Nothing over a cap disappears silently. Inputs beyond the applicable limit are still hashed and produce a documented resource_limit_exceeded warning with a concrete remedy (split the input, or supply a generated SBOM via --import-sbom).

Evidence that travels between machines#

• Operator-supplied evidence paths are now recorded relative to the scan root whenever the file sits under it (support policies, provenance, imported SBOMs, test results). Runs of the same tree from different checkout locations now produce byte-identical evidence packs, SBOMs, and release records — and internal reviewer bundles no longer embed local usernames. Out-of-tree paths are recorded as given, and external sharing packs were already redacted. No action needed; the first re-run rewrites the recorded forms.

Hardened scanning boundaries#

• Symlink scan boundary — a symlink that resolves outside the scan root is refused with a symlink_outside_root warning, so a planted link can never pull foreign files into evidence. Limitation: links resolving inside the root are followed by design.
• Bounded untrusted input — container-image members, deep YAML nesting, and oversized structures hit explicit budgets and surface resource_limit_exceeded warnings instead of unbounded reads.
• Safer reports — CSV exports neutralize spreadsheet-formula injection; HTML reports escape scanned content; CLI interruptions (Ctrl-C, closed pipes) exit with conventional codes instead of tracebacks. See exit codes.

More honest component identity#

• Cargo inline-table dependencies now yield the declared version — a dependency written as a table with features can no longer leak its raw text into your SBOM, and version-less git/path dependencies are never invented.
• Container references parse name, tag, and digest precisely: a digest-pinned image keeps its immutable digest as identity (no fabricated latest), registry ports are never read as tags, and digests survive into emitted purls as qualifiers.
• A component-identity guard now backstops every parser: structurally invalid names or versions become warnings instead of inventory. Legitimate epochs, vendor suffixes, prereleases, ranges, and descriptive names pass through untouched. Limitation: this is defense-in-depth against structural garbage, not proof a parser's semantics are correct — parser tests do that.

Fewer silent gaps#

• Build outputs inside build/ directories — Yocto image manifests, license.manifest, and generated SBOMs are now scanned where real build systems put them, instead of being skipped with the build tree.
• Recognized-but-unparsed formats warn — Gradle/NuGet/uv/Swift/ESP-IDF/ vcpkg/Maven/Conan manifests, OCI image indexes, device-tree overlays, and unpinned Python requirements now produce stable, actionable warnings instead of disappearing into the artifact list. Every warning code is documented (the page is generated from the catalog).
• CycloneDX naming conventions (bom.json, .cdx.json, .cdx.xml) are recognized as existing-SBOM evidence alongside SPDX.

Deeper verification behind the release#

• The offline suite grew to 1,300 tests, including new determinism, boundary, injection, and identity regressions.
• A ten-archetype synthetic manufacturer corpus now stress-tests the full workflow, with an acceptance contract and a per-fact semantic evaluation that fail on silent omissions, false merges, false positives, or overclaims. Limitation: synthetic testing is not real-customer validation — see Testing and trust.

Earlier in 2026#

• Release history and drift — every run emits a release record; comparing releases yields component, dependency, finding, evidence, gate, and support-period drift, with issue lifecycle states (new, persistent, resolved, regressed).
• Reviewer workflow and approvals — a review queue with tamper-evident, hash-chained decisions; multi-role approvals with separation of duties, expiry, and revocation; time-boxed waivers that keep waived items visible.
• CRA-oriented evidence — versioned Annex I coverage mapping, Annex VII technical-documentation packs with validator-enforced UNSIGNED DRAFT declarations, and Article 14 draft workspaces that are never filed or transmitted.
• Exploitation context — CISA KEV, FIRST EPSS, conservative reachability, and suggested SSVC priorities as reviewable inputs; VEX-aware gating that a reviewer decision — and only a reviewer decision — can suppress.
• Evidence bundles and sharing — deterministic reviewer bundles with byte-reproducible ZIPs, and redacted sharing packs for importers and distributors.
• Stable operator contract — documented exit codes, cataloged error codes with fixes and docs links, and doctor/init/validate-config/quickstart for first-run setup.

For the complete capability list, see Capabilities.