Version updated for https://github.com/msaad00/agent-bom to version v0.97.5. This action is used across all versions by 1 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. Action Summary The GitHub Action automates the scan and reporting of security vulnerabilities across AI, cloud infrastructure, and tools. It helps centralize evidence and enforce runtime calls, providing a single Finding with a UnifiedGraph model accessible from CLI, API, UI, and MCP. The action supports scanning from CLI, CI, Docker, or cloud connections on a custom control plane, allowing for comprehensive visibility into security risks across various environments.

Version updated for https://github.com/msaad00/agent-bom to version v0.97.2. This action is used across all versions by 1 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. Action Summary The GitHub Action automates the scanning and discovery of security vulnerabilities in AI, MCP, and cloud infrastructure. It can scan from CLI, CI, Docker, or a self-hosted control plane via cloud connect or scheduled estate scans. The action generates centralized evidence and enforces runtime MCP/tool calls.

Version updated for https://github.com/msaad00/agent-bom to version v0.96.3. This action is used across all versions by 1 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. Action Summary The GitHub Action automates the process of scanning software assets to identify vulnerabilities, generating a Unified Graph for context and visibility, and serving findings in real-time. It streamlines security operations by providing a unified interface for both internal and external stakeholders to access security information. The action supports various tools and platforms, making it versatile for organizations looking to enhance their cybersecurity posture and streamline incident response processes.

Version updated for https://github.com/msaad00/agent-bom to version v0.95.0. This action is used across all versions by 1 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. Action Summary This GitHub Action automates the scanning of software vulnerabilities using Open Source Security Framework (SARIF) format. It integrates with various security tools such as Snyk, Checkmarx, Veracode, and more to scan code repositories, container images, and APIs. The action generates findings in SARIF format, which can be integrated into existing vulnerability management systems or used for compliance reporting.

Version updated for https://github.com/msaad00/agent-bom to version v0.94.2. This action is used across all versions by 1 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed What’s Changed feat(cloud): roll up account→resource OWNS in org hierarchy (#3742 PR 1) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3743 feat(cloud): complete live EXPOSED_TO network paths (#3742 PR 2) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3744 fix(api): dedupe CIS checks per scan and surface persist failures by @msaad00 in https://github.com/msaad00/agent-bom/pull/3746 fix(deploy): SPCS native-app install blockers + deploy hardening by @msaad00 in https://github.com/msaad00/agent-bom/pull/3747 fix(ui): clean, actionable sign-in screen by @msaad00 in https://github.com/msaad00/agent-bom/pull/3748 feat(api): opt-in anonymous viewer alongside configured credentials by @msaad00 in https://github.com/msaad00/agent-bom/pull/3749 chore(deps): combine compatible July 9 dependency updates by @msaad00 in https://github.com/msaad00/agent-bom/pull/3758 feat(cloud): network entry EXPOSED_TO paths (#3742 PR 4) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3759 feat(cloud): cross-account inventory → toxic + fusion (#3742 PR 5) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3760 fix: pre-release graph-accuracy + anonymous-viewer hardening by @msaad00 in https://github.com/msaad00/agent-bom/pull/3761 docs(readme): fold intro, Quickstart next, Snowflake vendor lockup by @msaad00 in https://github.com/msaad00/agent-bom/pull/3763 chore(release): 0.94.2 by @msaad00 in https://github.com/msaad00/agent-bom/pull/3762 Full Changelog: https://github.com/msaad00/agent-bom/compare/v0.94.1...v0.94.2

Version updated for https://github.com/msaad00/agent-bom to version v0.94.0. This action is used across all versions by 1 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed What’s Changed fix(docs): repair out-of-tree links breaking strict mkdocs build by @msaad00 in https://github.com/msaad00/agent-bom/pull/3632 fix(cli): unified terminal UX — sections, deduped CIS, quiet cloud by @msaad00 in https://github.com/msaad00/agent-bom/pull/3633 fix(cloud): Key Vault CIS false-PASS + least-privilege deep-scan grants by @msaad00 in https://github.com/msaad00/agent-bom/pull/3636 fix(cloud): scan Lambda deployment packages + deep-scan pre-tagged container images by @msaad00 in https://github.com/msaad00/agent-bom/pull/3634 fix(cloud): Lambda discovery on by default (no –include-lambda) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3635 ci(docs): gate PRs on mkdocs build –strict by @msaad00 in https://github.com/msaad00/agent-bom/pull/3638 feat(output): scale-ready tabbed + paginated HTML report by @msaad00 in https://github.com/msaad00/agent-bom/pull/3637 feat(ui): Storybook harness for large dashboard components by @msaad00 in https://github.com/msaad00/agent-bom/pull/3640 feat(enrich): mature the multi-provider LLM enrichment harness by @msaad00 in https://github.com/msaad00/agent-bom/pull/3639 fix(scanners): correct OSV fixed_version resolution by @msaad00 in https://github.com/msaad00/agent-bom/pull/3644 fix(output): SARIF/json finding-count parity + –reproducible timestamps + /dev/null exit by @msaad00 in https://github.com/msaad00/agent-bom/pull/3645 Part of #1469 (Phase 0: hardware-backed device identity) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3646 chore: logo + branding consistency pass by @msaad00 in https://github.com/msaad00/agent-bom/pull/3647 Part of #3499 (Iceberg catalog export) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3648 Part of #3499 (ClickHouse findings-ingest) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3650 perf(db): fix cvss filesort + O(table) origin count on hub current reads by @msaad00 in https://github.com/msaad00/agent-bom/pull/3654 Part of #3192 (drift-as-UI lens) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3649 Part of #1969 (phase 1: strict mypy for models + core API) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3655 Closes #3499 tail (Swift bare-call precision) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3656 perf(db): generic RANGE-partition maintenance + retention rollover by @msaad00 in https://github.com/msaad00/agent-bom/pull/3657 fix(rbac): resolve NO_AUTH_ROLE from env at call time (kills release-blocker CI flake) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3660 docs: canonical how-it-works + deployment matrix + editions page by @msaad00 in https://github.com/msaad00/agent-bom/pull/3668 fix(api): consistent empty-scan response shape across MCP and HTTP surfaces (CI flake) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3663 Closes #1522 (split output/html.py) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3661 perf(graph): bounded snapshot-stats, rollup orphans, deep-offset cap (Part of #3664) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3669 refactor(cli): unify scan verb, tier flags behind –help-all, dedup formats by @msaad00 in https://github.com/msaad00/agent-bom/pull/3672 fix(cis): fail-closed on per-resource permission denial across ~25 checks (Closes #3679) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3691 fix(mcp): gate ingest_external_scan as a destructive write (Closes #3681) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3692 fix(ingest): chunked reconcile_absent + pip-visible ai-enrich security floors by @msaad00 in https://github.com/msaad00/agent-bom/pull/3693 fix(cis): ERROR on partial permission denial (strict GRC coverage) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3695 fix(malicious): synthesize vuln-less malicious findings end-to-end by @msaad00 in https://github.com/msaad00/agent-bom/pull/3694 fix(audit): genesis chain verification and git-SHA range false-positive by @msaad00 in https://github.com/msaad00/agent-bom/pull/3696 feat(runtime): shield fail-closed defaults, cred redact, SSRF guard by @msaad00 in https://github.com/msaad00/agent-bom/pull/3699 feat(audit): signed chain checkpoint detects tail truncation by @msaad00 in https://github.com/msaad00/agent-bom/pull/3700 feat(identity): SCIM patch fixes, audit RBAC, session logout hardening by @msaad00 in https://github.com/msaad00/agent-bom/pull/3701 chore(dev): ‘make preflight’ to catch OpenAPI/schema drift before push by @msaad00 in https://github.com/msaad00/agent-bom/pull/3702 docs: consolidate duplicate doc clusters (stage 1 of #3703) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3704 feat(identity): auto-bind SCIM subject on API key issuance by @msaad00 in https://github.com/msaad00/agent-bom/pull/3705 feat(platform): DB-aware /readyz and firewall reload fail-closed by @msaad00 in https://github.com/msaad00/agent-bom/pull/3707 feat(cloud,runtime): full coverage and shield hardening by @msaad00 in https://github.com/msaad00/agent-bom/pull/3706 fix(config): warn on unparseable env bool/int/float values by @msaad00 in https://github.com/msaad00/agent-bom/pull/3711 feat(output): add SARIF partialFingerprints for GitHub dedup by @msaad00 in https://github.com/msaad00/agent-bom/pull/3712 docs(config): canonical env aliases and regenerated ENV_VARS (#3677) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3713 refactor(api): centralize /v1 mount on shared API router (#3666) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3715 chore(tests): group cloud tests under tests/cloud/ (#3703) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3716 fix(security): resolve CodeQL sensitive export and exception alerts by @msaad00 in https://github.com/msaad00/agent-bom/pull/3717 chore(tests): group API tests under tests/api/ (#3703) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3718 fix(security): clear CodeQL alerts and finalize MCP catalog drift (#3675) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3719 docs(deploy): add README for raw Kubernetes manifests by @andres-linero in https://github.com/msaad00/agent-bom/pull/3720 docs(deploy): add README for Snowflake deployment assets by @andres-linero in https://github.com/msaad00/agent-bom/pull/3721 chore(release): prepare 0.94.0 by @msaad00 in https://github.com/msaad00/agent-bom/pull/3722 fix(accuracy): git-SHA advisory false positives + malicious packages missing from CSV by @msaad00 in https://github.com/msaad00/agent-bom/pull/3723 docs(release): fold #3723 into 0.94.0 changelog by @msaad00 in https://github.com/msaad00/agent-bom/pull/3724 Full Changelog: https://github.com/msaad00/agent-bom/compare/v0.93.5...v0.94.0

Version updated for https://github.com/msaad00/agent-bom to version v0.93.5. This action is used across all versions by 1 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed What’s Changed chore(deps): consolidate weekly dependency and registry updates by @msaad00 in https://github.com/msaad00/agent-bom/pull/3600 feat(ui): guided demo lock cards on runtime surfaces (Part of #3468) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3602 feat(output): svg/html formatter convergence (Part of #2918) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3601 feat(ui,deploy): /login + collector mTLS defaults (Part of #3175) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3603 refactor(parsers): extract skill metadata checks into skill_audit_metadata by @andres-linero in https://github.com/msaad00/agent-bom/pull/3604 refactor(api): split postgres_store into per-store modules by @andres-linero in https://github.com/msaad00/agent-bom/pull/3605 feat(ui): rollup-by-default and asset drift lens (Part of #3192) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3606 feat(ast,output): PHP/Swift symbol reach and Parquet export (Part of #3499) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3607 docs(audit): consolidate epic queue merge state (#3601–#3607) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3611 feat(runtime): OIDC discovery shim for legacy IdP MCP interop (Part of #3609) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3612 feat(findings): runtime evidence + compliance moat lift (Part of #3608, #3610) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3613 fix(scan,output): CLI AST gate + Parquet compliance_tags parity (audit P1/P2) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3614 feat(runtime): trace explorer joined to findings and compliance (Part of #3608) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3615 feat(ui,graph): runtime evidence overlay badges (Part of #3610) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3616 feat(proof): release smoke, demo estate, trust doc, proof-path nav (#3618) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3619 docs(deploy): unified install script, quickstart, and intake diagrams by @msaad00 in https://github.com/msaad00/agent-bom/pull/3621 fix(audit): P3 login redirect, Swift bare calls, rollup URL persistence by @msaad00 in https://github.com/msaad00/agent-bom/pull/3622 feat(scan,docs): GLM/Zhipu inventory + BYOM quickstart (closes #3609 tail) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3623 fix(audit): malicious findings stream, COUNT cache, demo hardening, SCIM keys by @msaad00 in https://github.com/msaad00/agent-bom/pull/3624 fix(ui): capture hydration + refreshed product-proof screenshots by @msaad00 in https://github.com/msaad00/agent-bom/pull/3625 fix(audit): post-3624 follow-up — reachability, demo safety, scale bench by @msaad00 in https://github.com/msaad00/agent-bom/pull/3626 chore(release): v0.93.5 by @msaad00 in https://github.com/msaad00/agent-bom/pull/3628 fix(pre-release): CI isolation, README SVGs, and UI readability by @msaad00 in https://github.com/msaad00/agent-bom/pull/3629 fix(audit): SARIF malware flag on CVE path + PHP heredoc/nowdoc reach masking by @msaad00 in https://github.com/msaad00/agent-bom/pull/3630 Full Changelog: https://github.com/msaad00/agent-bom/compare/v0.93.0...v0.93.5

Version updated for https://github.com/msaad00/agent-bom to version v0.93.0. This action is used across all versions by 1 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed What’s Changed fix(docs): keep extension contract link mkdocs-strict safe by @msaad00 in https://github.com/msaad00/agent-bom/pull/3429 docs(readme): refresh personas and terminal demo for 0.92.0 CLI by @msaad00 in https://github.com/msaad00/agent-bom/pull/3430 fix(ci): unblock Sigma WebGL E2E dynamic import by @msaad00 in https://github.com/msaad00/agent-bom/pull/3432 chore(perf): findings read bench and 2k CI regression by @msaad00 in https://github.com/msaad00/agent-bom/pull/3440 feat(retention): enforce graph snapshot purge and history cap (PR1) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3441 feat(api): server-side compliance hub findings pagination (PR1) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3442 fix(scan): skip unreachable Go checksum lookups by @msaad00 in https://github.com/msaad00/agent-bom/pull/3443 fix(compliance): normalize pci-dss slug alias and SAML install hint (#3439) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3444 feat(helm): Alembic pre-upgrade hook; chore(sdks): bump Python SDK (#3433, #3438) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3445 fix(scan): reduce secret FP on OAuth token minting assignments (#3437) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3447 refactor(output): migrate compact and console formatters to Finding (#2918) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3448 feat(skills): CI exit code and wider skill file discovery (#3434) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3449 fix(hardening): Role enum, Grafana creds, ecosystem claims, HOSTS rollup (#3242) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3450 feat(release): SBOM release asset, image scan gate, air-gap vuln-DB docs (#3436) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3451 fix(hardening): severity unification and cosign/MCP audit fixes (#3242) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3452 feat(retention): per-tenant graph retention and analytics cap (PR2) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3453 feat(api): findings read PR2 — approximate counts and UI pagination (#3192) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3454 chore(deps): combine dependency updates (2026-07-03) by @andres-linero in https://github.com/msaad00/agent-bom/pull/3460 feat(api): expression-indexed severity/cvss finding sorts (#3192) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3461 fix(api): idempotent finding ingest (P0) (#3242) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3462 fix(reliability): tenant fail-closed, cloud retry, health rate-exempt, batch cap by @msaad00 in https://github.com/msaad00/agent-bom/pull/3464 feat(enrich): bundle KEV and EPSS into offline vuln-DB layer by @msaad00 in https://github.com/msaad00/agent-bom/pull/3466 feat(ui): labeled demo estate and surface lock states (PR1) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3467 feat(api): finding lifecycle L1 — monotone current-state merge (#3465) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3470 fix(api): batch cap returns 422 and index filtered severity+cvss reads (#3474) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3477 chore(repo): hygiene + session cookie Secure default (#3475) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3479 fix(auth): cluster-safe SAML RelayState nonce store (#3476) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3478 feat(api): finding lifecycle L2 — occurrence log keyed on scan_id (#3465) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3480 feat(sdk): expose finding lifecycle ingest on control-plane clients by @msaad00 in https://github.com/msaad00/agent-bom/pull/3483 feat(api): finding lifecycle L3+L4 — resolve reconcile and current-state reads (#3465) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3481 docs(audit): add sanitized 2026-07-03 ledger with issue mapping by @msaad00 in https://github.com/msaad00/agent-bom/pull/3500 fix(api): harden OCSF ingest — cap/offload (A) + deterministic event IDs & ClickHouse dedup (J) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3501 feat(ui): interactive blast-radius overlay on the lineage graph by @msaad00 in https://github.com/msaad00/agent-bom/pull/3502 fix(ui): dock graph lens switcher — stop overlaying the canvas by @msaad00 in https://github.com/msaad00/agent-bom/pull/3505 docs(deploy): auto-migration hook, finding encryption prereq, ClickHouse OSS+Cloud by @msaad00 in https://github.com/msaad00/agent-bom/pull/3504 feat(ui): wire estate roll-up navigation for large graphs by @msaad00 in https://github.com/msaad00/agent-bom/pull/3507 fix(api,http): bound ScanRequest list elements and jitter sync retries by @msaad00 in https://github.com/msaad00/agent-bom/pull/3508 fix(api): gate external compliance frameworks and lock OCSF product attribution by @msaad00 in https://github.com/msaad00/agent-bom/pull/3509 fix(api): restore overview tiles from compact scans and add current-state sort indexes by @msaad00 in https://github.com/msaad00/agent-bom/pull/3515 refactor(api): deduplicate current-state hub payloads via ledger refs by @msaad00 in https://github.com/msaad00/agent-bom/pull/3517 feat(api): keyset cursor pagination for hub current-state findings by @msaad00 in https://github.com/msaad00/agent-bom/pull/3518 perf(api): gzip JSON responses and zstd-compress hub payloads at rest by @msaad00 in https://github.com/msaad00/agent-bom/pull/3516 feat(helm): enterprise-demo profile with AWS estate inventory cron by @msaad00 in https://github.com/msaad00/agent-bom/pull/3519 feat(api,ui): overview graph drill and estate correlation API by @msaad00 in https://github.com/msaad00/agent-bom/pull/3520 fix(cloud,helm): http_client GPU connectors + scoped API NetworkPolicy by @msaad00 in https://github.com/msaad00/agent-bom/pull/3522 feat(scanners): runtime-enforce driver run() and failure_mode by @msaad00 in https://github.com/msaad00/agent-bom/pull/3524 fix(api): Postgres rate-limit sliding window matches docstring by @msaad00 in https://github.com/msaad00/agent-bom/pull/3523 docs: compact session/enforcement flow diagrams by @andres-linero in https://github.com/msaad00/agent-bom/pull/3525 feat(api): async findings report export jobs by @msaad00 in https://github.com/msaad00/agent-bom/pull/3526 perf(analytics): ClickHouse sink dedup for canonical rows by @msaad00 in https://github.com/msaad00/agent-bom/pull/3527 fix(api): CVSS keyset pagination and report export truncation by @msaad00 in https://github.com/msaad00/agent-bom/pull/3530 refactor(api): hub reference-table normalization by @msaad00 in https://github.com/msaad00/agent-bom/pull/3528 docs(deploy): audit Alembic, encryption prerequisite, ClickHouse positioning by @msaad00 in https://github.com/msaad00/agent-bom/pull/3532 fix(api/scim): group PATCH, deprovision keys, SCIM error envelopes by @msaad00 in https://github.com/msaad00/agent-bom/pull/3540 feat(export): delta-stream connector for SIEM and data-lake sinks by @msaad00 in https://github.com/msaad00/agent-bom/pull/3531 test(api): lock in hub current-state payload dedup by @msaad00 in https://github.com/msaad00/agent-bom/pull/3541 feat(api): S3 report export artifacts with presigned URLs by @msaad00 in https://github.com/msaad00/agent-bom/pull/3542 fix(api/scim): PUT full replace and schema discovery by id by @msaad00 in https://github.com/msaad00/agent-bom/pull/3543 fix(api): gate bulk-ingest O(n) snapshot walk (#3544) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3545 fix(fleet): local discovery push for fleet sync by @msaad00 in https://github.com/msaad00/agent-bom/pull/3546 chore(glama): pin release ref and verify Dockerfile on publish by @msaad00 in https://github.com/msaad00/agent-bom/pull/3547 docs(audit): sync AUDIT-2026-07-03 ledger with shipped main by @msaad00 in https://github.com/msaad00/agent-bom/pull/3550 docs(readme): lead with personas, Start Here, and demo proof by @msaad00 in https://github.com/msaad00/agent-bom/pull/3548 feat(headless): wire findings push CLI and hub current-state list (#3482) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3549 feat(ui): show findings lifecycle status and timestamps in queue by @msaad00 in https://github.com/msaad00/agent-bom/pull/3551 fix(cli): skip PyPI update check in offline and air-gap mode (#3242) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3552 fix(deploy): mount ~/.agent-bom for abom user in compose profiles (#3242) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3553 fix(cli): reject reserved tenant ids on CLI and MCP resolvers (#3242) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3554 docs(audit): headless ingest docs and audit ledger sync by @msaad00 in https://github.com/msaad00/agent-bom/pull/3555 fix(cli): honor –offline for PyPI check and loopback fleet push by @msaad00 in https://github.com/msaad00/agent-bom/pull/3556 fix(headless): offline push, MCP check version, token-derived auth by @msaad00 in https://github.com/msaad00/agent-bom/pull/3557 chore(ci): reject LLM co-author trailers in commit messages by @msaad00 in https://github.com/msaad00/agent-bom/pull/3558 refactor(output): use canonical severity_rank in remediation plan by @msaad00 in https://github.com/msaad00/agent-bom/pull/3559 docs(audit): sync ledger for headless hardening #3556-#3558 by @msaad00 in https://github.com/msaad00/agent-bom/pull/3560 fix(auth): reject replayed OIDC JWTs via jti one-time store by @msaad00 in https://github.com/msaad00/agent-bom/pull/3561 refactor(trust): derive CVE weights from canonical severity_rank by @msaad00 in https://github.com/msaad00/agent-bom/pull/3562 docs(audit): sync ledger post #3561 OIDC jti replay by @msaad00 in https://github.com/msaad00/agent-bom/pull/3563 feat(plugins): runtime activation for opt-in plugin entry points by @andres-linero in https://github.com/msaad00/agent-bom/pull/3564 refactor(severity): unify API scan and compact CIS sort ranks by @msaad00 in https://github.com/msaad00/agent-bom/pull/3565 refactor(severity): canonical CIS sort ranks in HTML report by @msaad00 in https://github.com/msaad00/agent-bom/pull/3566 refactor(severity): canonical package severity rank in Mermaid output by @msaad00 in https://github.com/msaad00/agent-bom/pull/3567 refactor(severity): canonical CIS sort ranks in console renderer by @msaad00 in https://github.com/msaad00/agent-bom/pull/3568 refactor(severity): canonical sort ranks in skills, license, extensions by @msaad00 in https://github.com/msaad00/agent-bom/pull/3569 feat(reachability): export Python symbol reachability in findings by @msaad00 in https://github.com/msaad00/agent-bom/pull/3571 refactor(output): migrate markdown CVE sections to unified Finding by @msaad00 in https://github.com/msaad00/agent-bom/pull/3570 perf(db): partition hub observations with retention rollover by @msaad00 in https://github.com/msaad00/agent-bom/pull/3572 feat(reachability): include symbol reachability in delta-stream snapshots by @msaad00 in https://github.com/msaad00/agent-bom/pull/3573 refactor(output): migrate PDF CVE sections to unified Finding by @msaad00 in https://github.com/msaad00/agent-bom/pull/3574 feat(reachability): multilang symbol join + CWE/CVE/CPE advisory context by @msaad00 in https://github.com/msaad00/agent-bom/pull/3576 feat(reachability): wire symbol reach into triage scoring and VEX by @msaad00 in https://github.com/msaad00/agent-bom/pull/3577 refactor(output): migrate SARIF CVE loop to unified Finding stream by @msaad00 in https://github.com/msaad00/agent-bom/pull/3578 feat(reachability): Java/Rust AST symbol join for Maven and Cargo by @msaad00 in https://github.com/msaad00/agent-bom/pull/3579 docs(readme): product-first flow, compact persona band, plain-language taglines by @msaad00 in https://github.com/msaad00/agent-bom/pull/3580 feat(reachability): NuGet/C# AST symbol join for .NET MCP backends by @msaad00 in https://github.com/msaad00/agent-bom/pull/3581 feat(reachability): RubyGems AST symbol join for Rails MCP backends by @msaad00 in https://github.com/msaad00/agent-bom/pull/3582 feat(reachability): Gradle-only Java symbol join via build.gradle coords by @msaad00 in https://github.com/msaad00/agent-bom/pull/3584 docs(roadmap): validated quick-wins queue for evidence and discovery by @msaad00 in https://github.com/msaad00/agent-bom/pull/3583 feat(ingest): wire SARIF into external scanner detect_and_parse path by @msaad00 in https://github.com/msaad00/agent-bom/pull/3585 feat(vex): ingest CSAF and CycloneDX VEX documents by @msaad00 in https://github.com/msaad00/agent-bom/pull/3586 feat(output): registry verified badge and evidence ingest docs by @msaad00 in https://github.com/msaad00/agent-bom/pull/3587 refactor(output): migrate json and html CVE tables to Finding stream by @msaad00 in https://github.com/msaad00/agent-bom/pull/3588 feat(alignment): VEX on Finding stream and API scan field parity by @msaad00 in https://github.com/msaad00/agent-bom/pull/3589 chore(release): prepare v0.93.0 by @msaad00 in https://github.com/msaad00/agent-bom/pull/3590 feat(gap): pre-tag slice — Finding topology, lock cards, close #3242 by @msaad00 in https://github.com/msaad00/agent-bom/pull/3592 Full Changelog: https://github.com/msaad00/agent-bom/compare/v0.92.0...v0.93.0

Version updated for https://github.com/msaad00/agent-bom to version v0.91.0. This action is used across all versions by 1 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed What’s Changed docs(release): 0.90.1 hygiene — soften SCA framing, fix stale pins, README callouts by @msaad00 in https://github.com/msaad00/agent-bom/pull/3314 fix(sca): honor NVD CPE inclusive/exclusive version bounds exactly by @msaad00 in https://github.com/msaad00/agent-bom/pull/3315 fix(output): surface match_confidence_tier across SARIF, JSON, HTML by @msaad00 in https://github.com/msaad00/agent-bom/pull/3317 fix(release): harden post-0.90 audit findings by @msaad00 in https://github.com/msaad00/agent-bom/pull/3316 fix(output): carry match_confidence_tier on the JSON blast_radius rollup by @msaad00 in https://github.com/msaad00/agent-bom/pull/3319 fix(ui): fail fast offline and polish README how-it-works diagram by @msaad00 in https://github.com/msaad00/agent-bom/pull/3318 fix(sca): make NVD capped sync ingest its unsynced tail across runs by @msaad00 in https://github.com/msaad00/agent-bom/pull/3320 fix(version): correct post-release regex and prerelease ordering in version compare by @msaad00 in https://github.com/msaad00/agent-bom/pull/3330 fix(graph): keep cross-page attack paths in filtered /graph by @msaad00 in https://github.com/msaad00/agent-bom/pull/3321 fix(cli): fail-close –fail-on-severity on unknown/none findings by @msaad00 in https://github.com/msaad00/agent-bom/pull/3322 fix(mcp): emit canonical OWASP codes from tool-abuse rules by @msaad00 in https://github.com/msaad00/agent-bom/pull/3323 fix(sarif): de-duplicate cloud CIS failures in SARIF output by @msaad00 in https://github.com/msaad00/agent-bom/pull/3324 fix(inventory): keep distinct MCP servers distinct across identity, enrichment, and Cortex audit by @msaad00 in https://github.com/msaad00/agent-bom/pull/3325 chore(deps): combine UI dependency updates by @msaad00 in https://github.com/msaad00/agent-bom/pull/3337 fix(model-scan): close pickle-scan size gate and memo evasion by @msaad00 in https://github.com/msaad00/agent-bom/pull/3326 fix(version): honor tagged bounds for Go pseudo-versions by @msaad00 in https://github.com/msaad00/agent-bom/pull/3327 fix(image): warn on legacy rpmdb instead of silent zero coverage by @msaad00 in https://github.com/msaad00/agent-bom/pull/3328 fix(mcp): block SSRF in repo scan and offload clone off the event loop by @msaad00 in https://github.com/msaad00/agent-bom/pull/3329 feat(ui): design-system foundation — Collapsible, Card/Section, entity icons, vendor logos, state primitives by @msaad00 in https://github.com/msaad00/agent-bom/pull/3338 fix(sca): harden OSV/NVD/KEV/GHSA sync + SQLite concurrency (availability) by @msaad00 in https://github.com/msaad00/agent-bom/pull/3339 feat(ui): real connections experience — vendor logos + connector cards wired to backend by @msaad00 in https://github.com/msaad00/agent-bom/pull/3340 fix(api): bind audit tenant server-side, harden rate-limit identity + global ceiling by @msaad00 in https://github.com/msaad00/agent-bom/pull/3341 fix(output): dedup CycloneDX components + scope finding id by package by @msaad00 in https://github.com/msaad00/agent-bom/pull/3342 fix(ui): align connections screenshot spec with redesigned headings by @msaad00 in https://github.com/msaad00/agent-bom/pull/3344 feat: capability-depth — reachability→CVE, perf, identity owner-binding, FinOps rates, SBOM attestation/SPDX2 by @msaad00 in https://github.com/msaad00/agent-bom/pull/3346 feat(ui): declutter, capability-driven IA, interaction-state fixes, real trust stack by @msaad00 in https://github.com/msaad00/agent-bom/pull/3347 feat(gateway): OAuth 2.1 AS conformance + inline A2A mutual-auth enforcement + per-tool-call scope/DLP by @msaad00 in https://github.com/msaad00/agent-bom/pull/3348 chore(release): v0.91.0 by @msaad00 in https://github.com/msaad00/agent-bom/pull/3349 Full Changelog: https://github.com/msaad00/agent-bom/compare/v0.90.0...v0.91.0