Alex Goodman c4c0907d4e fix: keep panic stacks out of archive unknowns ...

A recovered panic while cataloging an archive became an unknown whose reason carried the full
goroutine stack, so a crafted archive that panicked a decoder put kilobytes of stack and build paths
into the published SBOM.

- the reason is now just `panic while cataloging archive: <value>`
- the stack is logged at debug, matching `runSubTaskSafely`

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

2026-10-21 11:42:23 -04:00

..

archive

fix: charge the budget for compressed tar bytes that are skipped, not just kept

2026-10-21 11:41:32 -04:00

bus

chore: simplify and cleanup

2026-09-22 00:23:36 -04:00

cache

ci: run the full unit suite on windows (#5370)

2026-10-05 10:41:03 -04:00

capabilities

ci: run the full unit suite on windows (#5370)

2026-10-05 10:41:03 -04:00

cmptest

fix: keep RealPath as top-level, use FullPath and utility functions FullNestedPath, LocalPath, Path

2026-10-19 15:44:37 -04:00

evidence

Location order on packages should consider evidence annotations when sorting (#3720)

2025-03-11 10:34:37 -04:00

file

fix: restore case-insensitive java globbing for licenses, version and nested jars

2026-10-21 11:37:45 -04:00

jsonschema

chore(deps): bump the go-minor-patch group across 2 directories with 14 updates (#4947)

2026-06-04 17:06:25 -04:00

licenses

chore: centralize temp files and prefer streaming IO (#4668)

2026-03-18 10:53:51 -04:00

log

chore(deps): update Go version (#4773)

2026-04-15 10:01:39 -04:00

mimetype

internalize format helpers (#2543)

2024-01-26 12:16:26 -05:00

os

fix: keep RealPath as top-level, use FullPath and utility functions FullNestedPath, LocalPath, Path

2026-10-19 15:44:37 -04:00

packagemetadata

feat: catalog CPAN distributions installed by perl clients (#5131)

2026-09-30 14:15:05 -04:00

redact

fix(redact): reset redaction store between command runs (#5386)

2026-10-07 20:28:15 +00:00

relationship

fix: don't index nested packages under the outer archive path

2026-10-21 11:35:21 -04:00

sbomsync

feat: add relationships to ELF package discovery (#2715)

2024-05-09 13:53:59 -04:00

sourcemetadata

chore(deps): update Go version (#4773)

2026-04-15 10:01:39 -04:00

spdxlicense

chore(deps): update SPDX license list (#5315)

2026-09-30 15:50:47 +00:00

spillbuf

chore: pin the bounds from the unbounded allocation work (#5298)

2026-09-17 14:11:16 -04:00

task

fix: keep panic stacks out of archive unknowns

2026-10-21 11:42:23 -04:00

testutils

fix: keep RealPath as top-level, use FullPath and utility functions FullNestedPath, LocalPath, Path

2026-10-19 15:44:37 -04:00

tmpdir

ci: run the full unit suite on windows (#5370)

2026-10-05 10:41:03 -04:00

unknown

fix: don't infer archive nesting from paths in error text

2026-10-21 11:28:53 -04:00

buffered_seek_reader_test.go

Split the sbom.Format interface by encode and decode use cases (#2186)

2023-10-25 13:43:06 +00:00

buffered_seek_reader.go

Split the sbom.Format interface by encode and decode use cases (#2186)

2023-10-25 13:43:06 +00:00

constants.go

chore: bump schema

2026-10-19 16:31:31 -04:00

docs.go

improve doc comments

2020-11-17 12:37:13 -05:00

err_helper.go

suppress file already closed errors (#3695)

2025-02-27 21:52:50 +00:00

generate.go

migrate json schema generation (#4270)

2025-10-10 14:16:28 +00:00

input.go

510 - SBOM attestation stdout (#785)

2022-02-22 21:45:12 -05:00

line_scanner_test.go

fix: report scanner errors and raise the line cap in metadata parsers (#5353)

2026-09-29 16:52:58 -04:00

line_scanner.go

fix: report scanner errors and raise the line cap in metadata parsers (#5353)

2026-09-29 16:52:58 -04:00

regex_helpers_test.go

Use reader when scanning for package versions over reading entire binary into memory (#3558)

2025-01-02 22:12:37 +00:00

regex_helpers.go

chore(deps): update Go version (#4773)

2026-04-15 10:01:39 -04:00

safetensors.go

fix(ai): bound model companion file reads and validate their contents (#5344)

2026-09-29 09:33:57 -04:00

set_test.go

Add relationships for python poetry packages (#2906)

2024-06-04 20:00:05 +00:00

set.go

Add relationships for python poetry packages (#2906)

2024-06-04 20:00:05 +00:00

string_helpers_test.go

Add ability to scan snaps (as a source) (#3929)

2025-06-25 16:53:35 -04:00

string_helpers.go

chore(deps): update Go version (#4773)

2026-04-15 10:01:39 -04:00

tprint.go

chore(deps): update Go version (#4773)

2026-04-15 10:01:39 -04:00