v0.7.0

Author: andrew

CHANGELOG.md

@@ -1,8 +1,19 @@
 ## [Unreleased]
 
+## [0.7.0] - 2026-01-09
+
+- `git pkgs vulns` subcommand for vulnerability scanning via OSV API
+- `git pkgs vulns scan` to scan dependencies for known vulnerabilities
+- `git pkgs vulns show` to display details for a specific vulnerability
+- `git pkgs vulns sync` to prefetch vulnerability data for all packages
+- `git pkgs vulns exposure` to analyze vulnerability exposure over time
+- `git pkgs vulns praise` to show resolved vulnerabilities with attribution
+- SARIF output format for CI integration (`--format=sarif`)
+- Docker container support for running git-pkgs without local Ruby installation
+- `list` command now shows locked versions and manifest kind
 - `--stateless` flag for `list`, `show`, and `diff` commands (auto-enabled when no database exists)
+- Update ecosystems-bibliothecary to ~> 15.2
 - Fix `-f` flag conflict in `diff` command (was defined for both `--from` and `--format`)
-- Disable GPG signing in test suite for faster tests
 
 ## [0.6.2] - 2026-01-06
 

Gemfile.lock

@@ -7,7 +7,7 @@ GIT
 PATH
   remote: .
   specs:
-    git-pkgs (0.6.2)
+    git-pkgs (0.7.0)
       ecosystems-bibliothecary (~> 15.2)
       purl (~> 1.7)
       rugged (~> 1.0)
@@ -138,7 +138,7 @@ CHECKSUMS
   docile (1.4.1) sha256=96159be799bfa73cdb721b840e9802126e4e03dfc26863db73647204c727f21e
   ecosystems-bibliothecary (15.2.0) sha256=bef81a0175f8bdf1d61938d5d5d32e226ec4ff44a54d5d5d34faea663ed67a24
   erb (6.0.1) sha256=28ecdd99c5472aebd5674d6061e3c6b0a45c049578b071e5a52c2a7f13c197e5
-  git-pkgs (0.6.2)
+  git-pkgs (0.7.0)
   hana (1.3.7) sha256=5425db42d651fea08859811c29d20446f16af196308162894db208cac5ce9b0d
   hashdiff (1.2.1) sha256=9c079dbc513dfc8833ab59c0c2d8f230fa28499cc5efb4b8dd276cf931457cd1
   io-console (0.8.2) sha256=d6e3ae7a7cc7574f4b8893b4fca2162e57a825b223a177b7afa236c5ef9814cc

lib/git/pkgs/version.rb

@@ -2,6 +2,6 @@
 
 module Git
   module Pkgs
-    VERSION = "0.6.2"
+    VERSION = "0.7.0"
   end
 end