v0.2.5

Release Notes

This release implements version v0.2.0 of the OpenVEX spec in the go-vex module. This is the first revision to the specification which incorporates the changes discussed and approved by the community in the OPEV-0014 and OPEV-0015 enhancement proposals.

THIS RELEASE INTRODUCES A BREAKING CHANGE

The vex.VEX struct is not compatible with previous versions. Note that the release version has been kept in the v0.2.x range to keep the go-vex module version number close to the spec revision. Future releases will be on par with the spec versions and in line with good semver practices.

Release Notes:

• The OpenVEX Document format (vex.VEX) now conforms to the v0.2.0 spec.
• vex.Open() now has a compatibility mode that lets it seamlessly import
  documents in previous OpenVEX versions.
• All OpenVEX structs (document, statements, vulnerabilities, etc) now have
  functions to match software identifiers and vulnerability IDs.
• The document merging functions from vexctl have been ported to the vex
  package. Applications importing the go-vex module can now merge documents
  without needing to import the vexctl CLI as a module.

v0.2.1

v0.2.1

v0.2.0

v0.2.0