release: v0.54.0 [main]

[aqua-bot]

🤖 I have created a release beep boop

0.54.0 (2024-07-30)

Features

• add log.FilePath() function for logger (#7080) (1f5f348)
• add openSUSE tumbleweed detection and scanning (#6965) (17b5dbf)
• cli: rename --vuln-type flag to --pkg-types flag (#7104) (7cbdb0a)
• mariner: Add support for Azure Linux (#7186) (5cbc452)
• misconf: enabled China configuration for ACRs (#7156) (d1ec89d)
• nodejs: add license parser to pnpm analyser (#7036) (03ac93d)
• sbom: add image labels into SPDX and CycloneDX reports (#7257) (4a2f492)
• sbom: add vulnerability support for SPDX formats (#7213) (efb1f69)
• share build-in rules (#7207) (bff317c)
• vex: retrieve VEX attestations from OCI registries (#7249) (c2fd2e0)
• vex: VEX Repository support (#7206) (88ba460)
• vuln: add --pkg-relationships (#7237) (5c37361)

Bug Fixes

• Add dependencyManagement exclusions to the child exclusions (#6969) (dc68a66)
• add missing platform and type to spec (#7149) (c8a7abd)
• cli: error on missing config file (#7154) (7fa5e7d)
• close file when failed to open gzip (#7164) (2a577a7)
• dotnet: don't include non-runtime libraries into report for *.deps.json files (#7039) (5bc662b)
• dotnet: show nuget package dir not found log only when checking nuget packages (#7194) (d76feba)
• ignore nodes when listing permission is not allowed (#7107) (25f8143)
• java: avoid panic if deps from pom in it dir are not found (#7245) (4e54a7e)
• java: use go-mvn-version to remove Package duplicates (#7088) (a7a304d)
• misconf: do not evaluate TF when a load error occurs (#7109) (f27c236)
• nodejs: detect direct dependencies when using latest version for files yarn.lock + package.json (#7110) (54bb8bd)
• report: hide empty table when all secrets/license/misconfigs are ignored (#7171) (c3036de)
• secret: skip regular strings contain secret patterns (#7182) (174b1e3)
• secret: trim excessively long lines (#7192) (92b13be)
• secret: update length of hugging-face-access-token (#7216) (8c87194)
• server: pass license categories to options (#7203) (9d52018)

Performance Improvements

• debian: use bytes.Index in emptyLineSplit to cut allocation (#7065) (acbec05)

---

This PR was generated with Release Please. See documentation.

[DmitriyLewen]

@knqyf263 it should be v0.54.0, no?

[knqyf263]

Release Please automatically determines the next version based on the commit prefixes. When feat commits are added to the main branch, it will be changed to v0.54.0. It currently has a performance change only.

[DmitriyLewen]

thank you for explaining, otherwise I was starting to worry 😄

[knqyf263]

It's v0.54.0 now, although #7080 should have been refactor as it doesn't affect users.

[DmitriyLewen]

Yeah. It was my mistake.
Interesting - if i change description of #7080 now, will please release change description of this PR next time we push to the main branch or not?

[knqyf263]

Release Please sees a commit message. You need to amend the commit message in the main branch and force-push it.

[DmitriyLewen]

oh...
force-push, especially for main branch, is a dangerous command.
I better double check type when i create a PR...

[knqyf263]

force-push, especially for main branch, is a dangerous command.

Actually, our branch protection doesn't allow it. It means you cannot change the type once you merge a PR.

[DmitriyLewen]

Yeah. I understood you. Thank you for the clarification!

[knqyf263]

@simar7 will be leading this release.
#6809 (comment)

[DmitriyLewen]

@aquasecurity/trivy I created #7248
You can write your own work.

[knqyf263]

I've written release notes.