AI-BOM v3.1.0 — JSON Flag, CycloneDX Summary, Docker Docs

What's New

Features

• --json / -j CLI flag — shorthand for --format json for easy piping to jq (#6)
• CycloneDX scan summary — metadata.properties now includes total_components, severity counts, and scan_duration_seconds (#8)
• Docker usage in README — run ai-bom via ghcr.io/trusera/ai-bom container (#9)

Bug Fixes

• CI/CD policy gate — scoped to src/ to avoid false positives from demo/test API keys
• CodeQL action — upgraded from v3 to v4 (v3 deprecated Dec 2026)

Already Implemented (closed)

• Anthropic Claude API key detection (sk-ant-*) — was already in v3.0.0 (#5)
• Google Gemini & Cohere model detection — was already in v3.0.0 (#7)

Full Changelog: v3.0.0...v3.1.0