release: v0.8.0 — supply-chain hardening#19

Merged

Metbcy merged 10 commits into

mainfrom

Apr 29, 2026

Commits on Apr 29, 2026

feat(clock): time crate adoption + clock module honors SOURCE_DATE_EPOCH

Metbcy
and
Copilot
committed
feat(clock): honor SOURCE_DATE_EPOCH in production timestamp emission

Metbcy
and
Copilot
committed
feat(enrich/osv): thread CVE aliases through VulnRef

Metbcy
and
Copilot
committed
feat(cli): --debug-calibration-format jsonl alternative

Metbcy
and
Copilot
committed
feat(sarif): partialFingerprints + Code Scanning upload + --output-file

Metbcy
and
Copilot
committed
feat(enrich): EPSS + CISA KEV scoring with --fail-on thresholds

Metbcy
and
Copilot
committed
feat(baseline): optional expires + reason fields with stderr warnings

Metbcy
and
Copilot
committed
feat(license): allow/deny policy with fail-closed compound-expression handling

Metbcy
and
Copilot
committed
chore(release): prepare v0.8.0

Metbcy
and
Copilot
committed
fix(deps): bump time to 0.3.47 to clear RUSTSEC-2026-0009

Metbcy
and
Copilot
committed