Fixes:

• Ignore Yarn 1.x workspaces that do not contain a package.json

Full changelog: 0.24.0...0.25.0

Improvements:

• Added support for prefetching Rust-based Python extensions
• Added support for Python 3.13

Full Changelog: 0.23.0...0.24.0

Improvements:

• Rebrand the project from Cachi2 to Hermeto
• Improves error messages raised when evaluating paths that point ouside of the repository root folder

Fixes:

• Fix issue caused by the existence of symlinks in a repository being prefetched
• Filter workspace globs to only match directories when prefetching for yarn

Full Changelog: 0.22.2...0.23.0

Fixes

• Fix how project files paths are updated regarding our temporary working copy of the source repository
  • this fixes release 0.22.1
    this makes sure that hermetic builds involving the Pip, NPM, and bundler backends are working again

Full Changelog: 0.22.1...0.22.2

Improvements

• Using a temporary directory for resolving all package managers

Fixes

• Container image is now buildable from source tarball

Full Changelog: 0.22.0...0.22.1

Improvements:

• [cargo] Enable support for the cargo (Rust) package manager backend

What's Changed

• Report pip build dependencies in the SBOM by @brunoapimentel in #801
• Bump the max supported gomod version to 1.24 by @eskultety in #834
• Fix resolving yarn projects by @slimreaper35 in #849

Full Changelog: 0.20.0...0.21.0

Bug fixes

• SPDX: Don't include falsy versions in SPDXID
• SPDX: Sanitize SPDXID strings - https://spdx.github.io/spdx-spec/v2.3/package-information/#7.2

Improvements:

• [Dockerfile] Added a new convenience tool - jq - to the container image
• [yarn] Report v4 optional builtin patches in the SBOM

Bug fixes:

• [yarn] report yarn patches as Pedigree objects of parent components instead of independent Components in the SBOM
• [yarn] improve offline mirror tarball name collisions to allow usage of NPM aliases which previously may have caused these collisions

Breaking changes:

• [gomod] Deprecation of the --force-gomod-tidy flag

Improvements:

• [rpm] Optional RPM summary can be added to the SBOM
• SBOM can now be generated in SPDX format

Bug fixes:

• Fix build-time issue caused by wrongly generated project files when using yarn