v1.5 — ecosystem integrations (license, dual-source vulns, CycloneDX, Dependabot context)#26

Merged

SeanLF merged 12 commits into

mainfrom

feat/v1.5-ecosystem-integrations

May 23, 2026

Commits on May 23, 2026

feat: surface gem license from RubyGems API

SeanLF
and
claude
committed
feat: merge ruby-advisory-db advisories when bundler-audit is installed

SeanLF
and
claude
committed
feat: detect Dependabot/Renovate context in PR-diff and report output

SeanLF
and
claude
committed
feat: emit CycloneDX 1.6 SBOM with --cyclonedx (1.7 opt-in)

SeanLF
and
claude
committed
chore: 1.5.0 — ecosystem integrations + dependency-review-action recipe

SeanLF
and
claude
committed
fix: emit one CycloneDX license entry per SPDX id

SeanLF
and
claude
committed
feat: tolerate Dependabot/Renovate commit-message prefix config when extracting bumps

SeanLF
and
claude
committed
feat: warn when mutually-exclusive output flags are combined

SeanLF
and
claude
committed
docs: note prefix-tolerant bump extraction and output-flag warnings in 1.5.0

SeanLF
and
claude
committed
feat: detect bot PRs from the event payload author, not just GITHUB_ACTOR

SeanLF
and
claude
committed
docs: drop the GitHub dependency-submission claim for CycloneDX

SeanLF
and
claude
committed
ci: fetch ruby-advisory-db in the PR-diff workflow to exercise dual-source

SeanLF
and
claude
committed