# Release articles ## Pages - [Announcing sbomify-action v26.9.0: The One That Runs on Every CI](https://sbomify.com/2026/09/24/announcing-sbomify-action-v26-9-0-the-one-that-runs-on-every-ci/) (2026-09-24): sbomify-action v26.9.0 gives TeamCity, Jenkins, CircleCI and Travis CI first-class support through a new CI platform subsystem, fixes the GitLab invocation we had published in every non-GitHub example, adds DOCUMENT_FILE for publishing PDFs and reports from a pipeline, and makes SPDX 3 documents survive a round trip intact. - [Announcing sbomify v26.9.0: The One That Speaks SPDX 3](https://sbomify.com/2026/09/24/announcing-sbomify-v26-9-0-the-one-that-speaks-spdx-3/) (2026-09-24): sbomify v26.9.0 makes SPDX 3 a first-class format end to end, ships a v2 API that calls things what the product calls them, adds a Helm chart for self-hosting on Kubernetes, puts certification badges and CSAF 2.0 discovery on the Trust Center, and rebuilds vulnerability browsing around a real findings table. - [Announcing sbomify-action v26.8.0: The One That Went on a Diet](https://sbomify.com/2026/08/25/announcing-sbomify-action-v26-8-0-the-one-that-went-on-a-diet/) (2026-08-25): sbomify-action v26.8.0 cuts the container image from 515MB to 106MB by fetching verified, attested tool bundles on demand, ends silent SBOM quality downgrades, adds git submodule support, and introduces Clearly Cached, a caching proxy that makes ClearlyDefined license data actually usable from CI. - [Announcing sbomify v26.8.0: The One With Security Advisories](https://sbomify.com/2026/08/25/announcing-sbomify-v26-8-0-the-one-with-security-advisories/) (2026-08-25): sbomify v26.8.0 adds full security advisory publishing with per-product gating, a rebuilt Trust Center, patch SLA targets and CRA KPIs, formal risk acceptance, malicious package detection, CSV evidence exports, and a new brand. - [Announcing sbomify v26.7.1: The One That Says "Not Affected"](https://sbomify.com/2026/07/30/announcing-sbomify-v26-7-1-the-one-that-says-not-affected/) (2026-07-30): sbomify v26.7.1 ships end-to-end VEX support across CycloneDX, OpenVEX, and CSAF, with in-product triage, Dependency-Track sync, and scheduled drift detection. CBOM ingestion now covers every lineage, the Trust Center exposes VEX and CBOM per release, and vulnerability counts finally reflect your current posture. - [Announcing sbomify v26.7.0: The One That Gets Quantum-Ready](https://sbomify.com/2026/07/07/announcing-sbomify-v26-7-0-the-one-that-gets-quantum-ready/) (2026-07-07): sbomify v26.7.0 adds Cryptography BOM (CBOM) support with NIST-grounded post-quantum readiness assessment, per-token API rate limiting with audit logging, a rebuilt authorization layer, and a broad security hardening pass. - [Announcing sbomify v26.3.0: The One That Ditches the Token](https://sbomify.com/2026/06/12/announcing-sbomify-v26-3-0-the-one-that-ditches-the-token/) (2026-06-12): sbomify v26.3.0 adds GitHub Actions OIDC trusted publishing so you can push SBOMs with no long-lived API token, expires personal access tokens by default, removes the Project layer, and ships a broad security and access-control hardening pass. - [Announcing sbomify v26.2.0: The One That Signs the DoC](https://sbomify.com/2026/05/13/announcing-sbomify-v26-2-0-the-one-that-signs-the-doc/) (2026-05-13): sbomify v26.2.0 completes the EU CRA workflow with a signed Declaration of Conformity, adds Component Lifecycle Events, SBOM signatures and provenance, and full CycloneDX 1.7 / SPDX 3.0.1 support. - [Announcing sbomify v26.1.0: The One Where We Switch to CalVer](https://sbomify.com/2026/04/02/announcing-sbomify-v26-1-0-the-one-where-we-switch-to-calver/) (2026-04-02): sbomify v26.1.0 introduces the CRA Compliance Wizard, switches to CalVer versioning, adds Trust Center subdomain routing, and brings full TEA v0.4.0 compatibility. - [Announcing sbomify-action v0.14: The One With Yocto](https://sbomify.com/2026/03/02/announcing-sbomify-action-v0-14-the-one-with-yocto/) (2026-03-02): sbomify-action v0.14 adds a dedicated Yocto/OpenEmbedded batch processing command, full SPDX 3.0.1 pipeline support, pipdeptree integration for Python transitive dependencies, caching for faster CI runs, and renames from github-action to sbomify-action. - [Announcing sbomify v0.27: The One with TEA](https://sbomify.com/2026/02/24/announcing-sbomify-v0-27-the-one-with-tea/) (2026-02-24): sbomify v0.27 adds full Transparency Exchange API (TEA) support, SPDX 3.0 compatibility, scoped access tokens, and improved account management. - [Announcing sbomify v0.26: The One Where Bootstrap Moved Out](https://sbomify.com/2026/02/16/announcing-sbomify-v0-26-the-one-where-bootstrap-moved-out/) (2026-02-16): sbomify v0.26 delivers a faster, more accessible UI, real-time dashboard updates, BSI TR-03183-2 compliance, and GDPR self-service account deletion. - [Announcing sbomify-action v0.13: The One Where We Go to FOSDEM](https://sbomify.com/2026/02/04/announcing-sbomify-action-v0-13-the-one-where-we-go-to-fosdem/) (2026-02-04): sbomify-action v0.13 brings hash enrichment from lockfiles, an interactive configuration wizard, Conan Center integration for C/C++, and improved NTIA compliance with supplier fields and PURL generation from VCS URLs. - [Announcing sbomify v0.25: The One with Attestations](https://sbomify.com/2026/01/23/announcing-sbomify-v0-25-the-one-with-attestations/) (2026-01-23): sbomify v0.25 introduces GitHub Attestation verification via Sigstore/cosign, SPDX 2.3 export, product lifecycle tracking, and compliance badges. - [Announcing sbomify-action v0.11: The One Where They Go to PyPI](https://sbomify.com/2026/01/20/announcing-sbomify-action-v0-11-the-one-where-they-go-to-pypi/) (2026-01-20): sbomify-action v0.11 transforms from a CI-only tool into a fully-fledged CLI available on PyPI. Major additions include audit trails for compliance, SPDX format support, a pre-computed license database covering 28 Linux distro versions, and native Rust SBOM generation. - [Announcing sbomify v0.24: The One with All the Plugins](https://sbomify.com/2026/01/14/announcing-sbomify-v0-24-the-one-with-all-the-plugins/) (2026-01-14): sbomify v0.24 introduces a powerful plugin-based assessment framework supporting security, license, compliance, and attestation plugins. Ships with NTIA, CISA, CRA, and FDA compliance plugins out of the box. - [Major Updates: sbomify v0.21 and Action Module v0.8 & v0.9](https://sbomify.com/2025/12/19/major-updates-sbomify-v0-21-and-action-modules/) (2025-12-19): Triple release: sbomify v0.21 with vulnerability trends dashboard, plus GitHub Action v0.8 and v0.9 featuring modular generation plugins and 8 enrichment data sources. - [Announcing sbomify v0.20: Custom Domains & Streamlined Onboarding](https://sbomify.com/2025/12/12/announcing-sbomify-0-20/) (2025-12-12): sbomify v0.20 release featuring custom domain support for Trust Centers, redesigned onboarding wizard, team invitation improvements, and security hardening. - [Announcing GitHub Action 0.7.0 and sbomify 0.19](https://sbomify.com/2025/12/05/announcing-github-action-0-7-0-and-sbomify-0-19/) (2025-12-05): Major releases: GitHub Action 0.7.0 with ecosyste.ms enrichment and SPDX support, plus sbomify 0.19 with full Django+HTMX migration, custom domains, and CycloneDX 1.7. - [Big Update to sbomify](https://sbomify.com/2025/07/04/big-update-to-sbomify/) (2025-07-04): sbomify v0.15 introduces document support alongside SBOMs, improved public pages, and product-level SBOM aggregation – evolving into a complete compliance hub. --- From sbomify: https://sbomify.com/tags/release/