ts-scan Changelog¶

* Continued package-manager scans when dependency resolution produces no lockfile
* Used NuGet `project.assets.json` as a resolved dependency fallback, including solution scans
* Handled missing NuGet global-package-path output without failing the scan
* Added an NLog fallback example and regression coverage

* Added `--nuget:separateProjectScans` to create one module scan per project in a NuGet solution

* Changed the scanner interface to return an iterable of scans, allowing every scanner to produce zero, one, or multiple modules
* Preserved NuGet solution projects as graph roots and derived module identities from NuGet and MSBuild metadata
* Added multi-scan handling and regression coverage for analysis, vulnerability checking, conversion, and ordered uploads

* Improved NuGet project-reference resolution using assets files with project-file fallbacks
* Preserved exact lockfile-resolved versions and dependency relationships for transitive NuGet packages
* Prevented vulnerability checks from failing for small or empty scans
* Prevented SPDX and CycloneDX exports from silently dropping additional scans

* Added dependency scanning for Dart and Flutter projects
* Made in-depth analysis optional through the `analyse` extra, keeping the command visible with installation guidance when unavailable
* Added a CI/CD guide for failing pipelines when scan-result uploads fail

* Made the base installation self-contained and moved `ts-deepscan` and SCANOSS into the optional analysis dependency set
* Added Pyright configuration and corrected typing issues throughout the project
* Updated security policy links and contact information

* Fixed NuGet project-reference resolution using project paths and assembly names
* Preserved actual path casing when locating packages in the global NuGet cache
* Preferred `dotnet` for SDK-style projects while retaining NuGet CLI support for legacy `packages.config` projects
* Restored NuGet dependencies into the same persistent cache used for package lookup
* Installed the complete analysis dependency set in the Docker image

* Added "analyse" and "convert" commands
* Enhanced results enrichment using the SCANOSS API
* Implemented vulnerability checks for scans using the TrustSource API
* Added support for SPDX and CycloneDX as input/output formats
* Published documentation as GitHub Pages

* Forwarding parameters to PM tools
* Specifying executable paths
* Ignoring package managers while scanning
* Improved import of results produced by the Syft scanner
* Scan target can be now an URI that can be scanned by Syft enabling docker image scanning

* Fixed scanning of NPM and NuGet packages
* Fixed scanning of Maven projects with submodules

* Add support for the Syft scanner. The option '--use-syft' enables dependency scanning using Syft
* Added options '--tag' and '--branch' to the scan command to attach the VCS's tag/branch to the module

* Fix Maven issues on Windows

* Improved resolution of remote repositories for Maven

* Fix package's setup

* Add support for Maven, NPM and Nuget package managers
* Extraction of sources URLs for Maven packages

* Improve/adjust interfaces for adding new pakcage managers

* Minor bug fixes

* License identification in license files from Python's wheel packages

* Scanning of PyPi packages
* Uploading of TS scans
* Importing of SPDX (JSON and RDF) and CycloneDX SBOMs