Pre-Release (Alpha) candidate for v6-series (v6.0.0a1)

.github/workflows/CD-PyPi.yml

@@ -11,8 +11,8 @@ on:
 permissions: {}
 
 env:
-  # Define Python versions at the top level -- Expected format: X.Y (e.g., 3.13)
-  PYTHON_DEFAULT: "${{ vars.PYTHON_DEFAULT || '3.13' }}"
+  # Define Python versions at the top level -- Expected format: X.Y (e.g., 3.14)
+  PYTHON_DEFAULT: "${{ vars.PYTHON_DEFAULT || '3.14' }}"
 
 jobs:
   pypi-publish:
@@ -40,13 +40,13 @@ jobs:
       build_status: ${{ steps.build.outcome }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - id: build-python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: "${{ env.PYTHON_DEFAULT || 3.13 }}"
+          python-version: "${{ env.PYTHON_DEFAULT || 3.14 }}"
       - id: output_python
         name: "bootstrap Python"
         shell: bash
@@ -60,7 +60,7 @@ jobs:
       - name: Setup build tools
         id: build_deps
         shell: bash
-        run: pip install --no-input --user "pip>=26.0" "setuptools>=82.0" "wheel>=0.45" "build>=1.2.1"
+        run: pip install --no-input --user "pip>=26.0.1" "setuptools>=83.0" "wheel>=0.47" "build>=1.2.1"
       - name: Pre-Clean
         id: clean
         shell: bash
@@ -77,9 +77,9 @@ jobs:
         run: |
           shasum -a 512 dist/* > build.checksums.txt
       - name: "Attest Build with Checksums"
-        id: multicast-build-chksum-attest
+        id: piplicenses-build-chksum-attest
         if: ${{ !cancelled() && (github.repository == 'raimon49/pip-licenses') && startsWith(github.ref, 'refs/tags/') }}
-        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
         with:
           subject-checksums: build.checksums.txt
           github-token: ${{ github.token }}

.github/workflows/python-package.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Set up Python
@@ -41,7 +41,7 @@ jobs:
         python-version: ['3.9', '3.10', '3.11', '3.12', '3.13', '3.14']
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Set up Python ${{ matrix.python-version }}
@@ -56,7 +56,7 @@ jobs:
         run: |
           pytest -v --cov --cov-report=xml
       - name: Update coverage artifact
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: coverage-${{ matrix.python-version }}
           path: coverage.xml
@@ -70,15 +70,15 @@ jobs:
     if: ${{ github.actor != 'dependabot[bot]' && github.event.sender.login != 'dependabot[bot]' }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Download all coverage artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: coverage-*
       - name: Upload code coverage to Codecov
-        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           name: codecov-umbrella

CHANGELOG.md

@@ -1,5 +1,20 @@
 ## CHANGELOG
 
+### pre-6.0.0 (ALPHA WIP)
+
+(SUBJECT TO CHANGE IN NEXT RELEASE)
+
+* Fixed priority logic regression from v5.5.x that lead to non-determinant ordering of multiple-source results, (WIP GHI #309), and possibly resolving? (GHI #330 - needs new testing)
+* Fixed multiple regressions in tests due to recent version bumps, closing GHI #337 & GHI #338
+* Updated various portions of the README document (WIP), closing GHI #328
+* Improved handling of multiple license files in a single package (WIP GHI #71)
+* Implemented new flags (WIP GHI #242)
+* Fixed multiple false positives including:
+  * [CVE-2026-4539 reDoS](https://github.com/advisories/GHSA-5239-wwwm-4pmq)
+  * [CVE-2026-44432 Leak](https://github.com/advisories/GHSA-mf9v-mfxr-j63j)
+  * [CVE-2026-44431](https://github.com/advisories/GHSA-qccp-gfcp-xxvc)
+* Updated testing in CI to resolve python3.9 coverage regresions
+
 ### 5.5.5
 
 * Updated cc lines and officially made note of change in maintainers

Dockerfile

@@ -1,5 +1,5 @@
-FROM python:3.11-slim-bullseye
-LABEL maintainer="raimon <raimon49@hotmail.com>"
+FROM python:3.14-slim-trixie
+LABEL maintainer="reactive-firewall <reactive-firewall@users.noreply.github.com>"
 
 ARG APPDIR=/opt/piplicenses
 

Makefile

@@ -135,6 +135,8 @@ endif
 # file path to extra developer requirements generated by pip-compile
 DEV_DEPENDS:='dev-requirements'
 
+.SUFFIXES: .py .pyc .pyi
+
 .DEFAULT_GOAL:= help
 .PHONY: help, setup, local-install, local-uninstall, update-depends, lint, test, deploy, test-deploy, build, clean, full-clean, un-setup