Changelog
Dated changes to the site, the data and the methods, newest first.
- Stack Check accepts CycloneDX and SPDX SBOMs and exports a CycloneDX 1.6 AI-BOM.
- The Exposure Registry covers crates.io and Go modules as well as PyPI and npm.
- A package now counts as reaching an LLM component only through runtime dependencies. Optional extras no longer extend a chain.
- Classifier prompt v4 with a stated scope. Every record was classified again under it.
- Summaries and mitigations were rewritten under summary prompt v2.
- Severity for news, research and policy records is capped at medium.
- The classifier audit is published on the methods page, with the labelled sample as a download.
- Corrections to records are logged publicly.
- A weekly changes page and feed were added.
- EPSS scores and CISA KEV status are read again after a record is first enriched, and the dates are shown.
- The dataset export has 48 fields. The first 44 are unchanged from dataset version 3.0.
- News records older than 30 days leave search results and the sitemap. They stay on the site and in the API.
- The privacy policy was rewritten.
- Dataset version 3.0 was published on Zenodo (DOI 10.5281/zenodo.19519470).