proofwright 1.0.1

Git tag 1.0.1

Fixes core modules being reported as if they were contrib projects.

On a stock Drupal 11 install, the SBOM listed datetime, file, image, link, options and text as separate components, each with a pkg:composer/drupal/NAME package URL naming a package that does not exist. Nothing in a vulnerability feed could match those entries, so they were noise that resembled coverage.

proofwright 1.0.0

Git tag 1.0.0
New features

First release of the Drupal on-ramp for Proofwright CRA evidence.

Builds a CycloneDX 1.5 SBOM covering Drupal core, contrib and custom extensions, and sends it to your Proofwright console over HTTPS. Every component is mapped to a Composer package URL — Token 8.x-1.15 becomes pkg:composer/drupal/token@8.x-1.15 — which are the identifiers the Drupal security advisories and OSV feeds match on, so known vulnerabilities are recognised automatically once the SBOM lands.

proofwright 1.0.x-dev

Git branch 1.0.x
New features

First release of the Drupal on-ramp for Proofwright CRA evidence.

Builds a CycloneDX 1.5 SBOM of Drupal core, contrib and custom extensions, and sends it to your Proofwright console over HTTPS. Components are mapped to Composer package URLs, so known vulnerabilities are recognised automatically once the SBOM lands.

Sending is opt-in — nothing leaves the site until a licence key and console URL are configured. It can run on cron or on demand from the settings form.

Requires Drupal 10 or 11 and PHP 8.1+.

Subscribe with RSS Subscribe to Releases for Proofwright CRA Evidence