v0.18

✨ Features

• feat(variants): support selecting multiple variants in scope selector by @ValentinBoudevin in #423
• feat(search): add only:<term> operator to filter by every affected package by @ValentinBoudevin in #429
• feat(vuln-modal): recap current assessment status per variant by @ValentinBoudevin in #428
• Feature: Add variant filtering by @ValentinBoudevin in #424
• Support yocto-vex input by @reh-sfl in #363
• ENISA EUVD support by @reh-sfl in #412
• Feature(VulnModal) add Packages logic in the assessment recap by @ValentinBoudevin in #433
• feat(export): import custom report templates from the Export tab by @ValentinBoudevin in #444
• Transfer tab: move assessments between variants by @reh-sfl in #440
• feat(grype): add GRYPE_MEMLIMIT to cap grype RAM consumption by @reh-sfl in #439
• Add local database for NVD by @reh-sfl in #435

🛠 Improvements

• Typing improvements by @reh-sfl in #409
• Fix: Reduce post-assessment loading time from twenty sec to less than a second by @ValentinBoudevin in #421
• Fix: Reduce time to load Scan tab by @ValentinBoudevin in #422
• Enforce variant_id by @WilsonZiweiWang in #436
• frontend: Renamed VulnModal labels for clarity by @ValentinBoudevin in #442
• review: Sort exported vulnerabilities by timestamp by @ValentinBoudevin in #438

🐛 Bug Fixes

• fix: published-date filter when dates exist by @ValentinBoudevin in #420
• fix(review): persist "Apply to variants" changes when editing an assessment by @ValentinBoudevin in #427
• fix(table): stop filtered rows blinking by @ValentinBoudevin in #432
• fix: exclude old packages assessments from vuln status by @ValentinBoudevin in #441
• bugfix test: Exclude templates from the tests by @ValentinBoudevin in #447
• fix(cli): accept both bare and -- prefix for all commands by @reh-sfl in #437
• fix: frontend display the full list of status by @ValentinBoudevin in #448

Full Changelog: v0.17.1...v0.18

v0.17.1

🐛 Bug Fixes

• Fix: Export feature is slow, doesn't respect project barrier, and were polluted based on vuln description by @ValentinBoudevin in #414
• fix: Remove Deprecated code to force YML update by @ValentinBoudevin in #413
• Fix the import-custom-assessments feature by @ValentinBoudevin in #410

Full Changelog: v0.17...v0.17.1

v0.17

✨ Features

• Export scope SBOM/VEX to a project or variant (#389)
• Always show vulnerability action bar (#387)
• Support sbom-cve-check scans (#385)
• Support CPE referenceType as full URI in SPDX parsing (#362)

---

🛠 Improvements

• GHSA refresh (#373)
• Refactor controllers dictionary to cache object (#384)
• Unify columns for updated_at and fetched_at (#386)
• Scan history redesign (#388)
• Settings tab UI modification and variants copy (#392)
• Type annotations across helpers, models, extensions, and base (#372, #382, #401)
• Improve backend test coverage (#404)

---

🐛 Bug Fixes

• Pass ControllersCache to post_treatment (#390)
• Scan Grype scope exported SBOM to variant (#391)
• Restyle action buttons and reposition edit panels (#398)
• Prevent selecting incompatible variant/package pairs in assessments (#400)
• Key package enrichment by UUID and scope variants (#394)
• Count each vulnerability once per status in metrics (#396)
• Report variants and packages in assessment success message (#395)
• Drop OpenEmbedded supplier from packages (#399)
• Poll refresh progress only while a refresh is running (#393)
• Attribute source from exact per-document provenance (#397)
• Exclude kernel modules from scanner inputs (#402)
• Scan progress lost on webpage refresh (#403)

Full Changelog: v0.16.2...v0.17

v0.16.2

🐛 Bug Fixes

• fix: replace asserts in code to gracefully exit by @ValentinBoudevin in #377
• fix: modal navigation in sync with table order by @ValentinBoudevin in #375
• fix: Custom Time Estimates appear correctly in Review by @ValentinBoudevin in #379
• fix: refresh CVSS gauges after saving custom score by @ValentinBoudevin in #374
• fix: rank top vulnerabilities by severity label by @ValentinBoudevin in #378

Full Changelog: v0.16.1...v0.16.2

0.16.1

🐛 Bug Fixes

• fix: Fix nvd-refresh request by @ValentinBoudevin in #366
• fix: UI remove black background loading Review tab by @ValentinBoudevin in #364
• fix: skip EPSS on CVEs already filled on web start by @ValentinBoudevin in #365
• fix: CVSS scope (scanner or custom) by @ValentinBoudevin in #368
• fix: scope affected-pkg list to the latest SBOM by @ValentinBoudevin in #367

📦 Release

• Bump v0.16.1 by @WilsonZiweiWang in #369
• Release v0.16.1 by @WilsonZiweiWang in #370

Full Changelog: v0.16...v0.16.1

v0.16

✨ Features

• Add EPSS refresh by @WilsonZiweiWang in #343
• Settings: Add field for NVD API key by @rawaha-e in #340
• Link CVSS and time estimate to a variant by @rawaha-e in #346
• Bulk EPSS + NVD refresh by @WilsonZiweiWang in #347
• Add new fields to settings page by @reh-sfl in #354
• Summarize vulnerability status across current scope by @rawaha-e in #353

🛠 Improvements

• Allow lone boolean elements in CI conditions by @youennlj-sfl in #345
• Trigger Docker image build workflow automatically when a tag is pushed by @WilsonZiweiWang in #232
• Map all yocto sources to yocto_cve_check by @rawaha-e in #349

🐛 Bug Fixes

• Review: show heading UI when there is no data by @rawaha-e in #350
• Fix the file remaining in the input field after upload by @WilsonZiweiWang in #348
• Supplier: do not render tooltip when unknown by @rawaha-e in #351
• Fix: scope Yocto Description to observation by @youennlj-sfl in #321
• Prevent dev API URL from leaking by @ValentinBoudevin in #358
• Fix config.env persistence and MultiEdit status changes by @reh-sfl in #359
• Fix: Metrics UI responsive by @ValentinBoudevin in #357

---

New Contributors

• @reh-sfl made their first contribution in #354

Full Changelog: v0.15...v0.16

0.15

🛠 Improvements
Backend typing and small refactoring by @youennlj-sfl (#324)
Refactor routes by @rawaha-e (#333)
Handle cpe23Type in BOM and normalize purl epoch qualifier by @WilsonZiweiWang (#327)
Refactor controllers by @rawaha-e (#330)
Refactor Flask command scripts by @rawaha-e (#329)
Refactor views by @rawaha-e (#332)

✨ Features
Export custom assessments as individual OpenVEX files by @rawaha-e (#328)
Add ability to import / export custom user data by @rawaha-e (#334)
NVD single CVE info refresh by @WilsonZiweiWang (#339)
cvss: add author field and more filters by @rawaha-e (#341)

📦 Release
Changelog v0.15.0 by @rawaha-e (#342)
Release v0.15.0 by @WilsonZiweiWang (#344)

Full Changelog: v0.14...v0.15

v0.14

✨ Features
CQFD flavor to validate exported SBOM files by @rawaha-e (#314)
SBOM table: add filter by SBOM Document by @rawaha-e (#280)
Use --project and --variant for import/export custom assessment by @youennlj-sfl (#317)
Parse supplier info in SPDX 2.3 by @WilsonZiweiWang (#323)
Add assessment fields in Scan Tab by @ValentinBoudevin (#318)

🛠 Improvements
Remove patch-finder related code by @WilsonZiweiWang (#316)
Update copyright headers by @ValentinBoudevin (#322)
Split merger.ci, remove code duplication by @ValentinBoudevin (#320)

🐛 Bug Fixes
Fix the project scope correctly for vulnerability edit by @ValentinBoudevin (#313)

Full Changelog: v0.13...v0.14

0.13

✨ Features
Templates: add new fields after DB migration by @rawaha-e (#277)
Review: implement assessment edit / delete features by @rawaha-e (#279)
Scan: Rework of the feature to include NVD/OSV/GRYPE by @ValentinBoudevin (#300)
SBOM: add CPE/PURL columns by @ValentinBoudevin (#302)

🧠 Improvements
Add documentation for interactive mode by @rawaha-e (#301)
Fix: Create a new helper for "active scans" by @ValentinBoudevin (#304)

🐛 Bug Fixes
Include UTC offset in serialized timestamps by @ValentinBoudevin (#299)
Variant enrichment uses correct scan IDs by @ValentinBoudevin (#303)
Remove the unknown URL by @ValentinBoudevin (#305)
Scanning tool second scan provide wrong results by @ValentinBoudevin (#306)
Only check the active packages in new assessments by @ValentinBoudevin (#308)

📚 Documentation & Maintenance
Update the changelog for v0.13 by @ValentinBoudevin (#309)
Release v0.13 by @ValentinBoudevinSFL (#310)

Full Changelog: v0.12.1...v0.13

0.12.1

✨ Features
scan management commands by @youennlj-sfl (#271)

🧠 Improvements
Code quality: added shellcheck, fixed flake8 configuration, fixed pre-commits by @youennlj-sfl (#278)

🐛 Bug Fixes
Update initialization message to get URL by @ValentinBoudevin (#275)
Upgrade cyclonedx-python-lib to 11.7.0 by @ValentinBoudevin (#274)
Strip staging prefix from filename by @ValentinBoudevin (#284)
Error 500 when setting a custom assessment by @ValentinBoudevin (#282)
UI bug fixes by @L-series (#285)
Fix DB lock after a few assessments due to NVD taking control of the DB by @ValentinBoudevin (#287)
Persist custom report templates by @ValentinBoudevin (#295)
Remove API GET request per CVE on Review by @ValentinBoudevin (#291)
Correct vulnerability count in multiedit by @ValentinBoudevin (#290)
Fix frontend data clearing when navigating by @ValentinBoudevin (#289)
Use PURL as OpenVEX product @id instead of name@version by @ValentinBoudevin (#283)
Raise warning for wrong files on --add-* command by @ValentinBoudevin (#297)

📚 Documentation & Maintenance
Add Read the Docs config by @ValentinBoudevin (#288)
Update README to remove cqfd command by @ValentinBoudevin (#294)
Changelog v0.12.1 by @rawaha-e (#296)
Release v0.12.1 by @rawaha-e (#298)

🙌 New Contributors
@L-series made their first contribution (#285)

Full Changelog:
v0.12...v0.12.1