# Changelog

## Baseline

- First survey — no prior run to compare against. CAI 74.

## Lenses

- Code Health 81
- Architecture 100
- Maturity 74
- Readiness 68
- Security 81

## Changes since last survey

- 300 commits — 226 feature/other, 74 fixes

## By area

- (root) — 76 commits
- pkg/fanal — 37 commits
- pkg/iac — 37 commits
- .github/workflows — 32 commits
- pkg/dependency — 23 commits
- docs/guide — 19 commits
- pkg/detector — 12 commits
- helm/trivy — 11 commits
- integration/testdata — 9 commits
- pkg/vex — 6 commits
- pkg/rpc — 4 commits
- pkg/sbom — 4 commits
- docs/getting-started — 3 commits
- pkg/x — 3 commits
- .github/CODEOWNERS — 2 commits
- magefiles/config_schema.go — 2 commits
- pkg/flag — 2 commits
- pkg/licensing — 2 commits
- pkg/module — 2 commits
- pkg/plugin — 2 commits

## Notable commits

- fix: chore(deps): Bump `go-ini` and fix the import path. (#10489)
- fix: chore(deps): bump to alpine:3.23.3 and go-1.25.6 to fix CVEs (#10107)
- fix: chore(deps): upgrade vm scan dependency for bug fix (#10575)
- fix: fix(cloudformation): propagate AWS::EC2::Instance MetadataOptions (#10731)
- fix: fix(conda): avoid panic on an all-operator dependency line (#10955)
- fix: fix(cyclonedx): include CVSS v4 vulnerability ratings (#10313)
- fix: fix(docker): fix non-det scan results for images with embedded SBOM (#9866)
- fix: fix(dotnet): identify deps.json root project from dependency graph (#10954)
- fix: fix(flag): validate template file extension (#10296)
- fix: fix(go): use ldflags version for all pseudo-versions    (#10037)
- fix: fix(image): correctly reconstruct RUN instructions built without BuildKit (#10714)
- fix: fix(image): deterministic OS package deduplication for images with embedded SBOMs (#10777)
- fix: fix(image): lookup origin layer for custom resources in merged layers (#10788)
- fix: fix(image): race condition in image artifact inspection (#9966)
- fix: fix(java): Disable overwriting exclusions (#10088)
- fix: fix(java): add hash of GAV+root pom file path for pkgID for packages from pom.xml files (#9880)
- fix: fix(java): correctly inherit properties from parent fields for pom.xml files (#9111)
- fix: fix(java): correctly propagate repositories from upper POMs to dependencies (#10077)
- fix: fix(java): set per-file digest for nested JARs (#10855)
- fix: fix(java): surface 429 from a remote Maven repository as a fatal error when scanning pom.xml files (#10693)
- …and 280 more