Cut v0.8.0

[MoSLoF]

What

v0.7.5 was cut back at D-39. Eighty-two decisions (D-40..D-121) have landed since — the largest span any release of this project has carried — and every one is backwards-compatible: new opt-in flags, additive report fields, wider coverage. Semver says minor, so this cuts v0.8.0. (A 1.0 declaration is a product decision, deliberately not smuggled into a routine bump.)

The change is one line in pyproject.toml — the F-06 single source: the Go binary (make build ldflags), the wheel, and depsnort version all derive from it — plus the two README examples that name the current release.

What v0.8.0 carries over v0.7.5, by arc

• Drift axis (VC-010/VC-011): baseline capability/publisher-lineage comparison.
• Install-surface families: VC-002f..j (composer cradles, persistence, cgo flag injection, build-tag-gated init evasion with AST reachability, load-time native exec), package-runner + manager-install extraction, per-dependency vendor/module-cache attribution.
• Resolution: static pruned Go MVS proven against the go list oracle, per-ecosystem asserted-tier dispatch, full-send recursive defaults with honest gap disclosure.
• Lockfile/manifest sweep: uv.lock (incl. rootless), poetry.lock, pdm.lock, pylock.toml (PEP 751), Pipfile, pnpm-lock.yaml, bun.lock, build-backend disclosure — and the modern .NET surface (PackageReference, CPM, Directory.Build.props, .nuspec, dotnet-tools.json, project.json, paket.dependencies, project.assets.json).
• Live-fire precision hardening across meshclaw, OpenShell, Kibana, open-webui, elastic-agent, beats — every fix principled and mutation-proven, never an allowlist.
• Advisory correctness: the post-expansion OSV pass closing the prefetch/expansion false-clean gap; tolerant npm packument parsing; snapshot import/export.
• EPSS exploit-prediction arc: FIRST.org client, VC-008 annotation + ranking, structured scores in JSON/SARIF/PDF, opt-in -epss-gate.
• Adjudication doctrine: Miasma/Hades companions (RepoGuard, IOC feed) plus the two proof mechanisms — RepoGuard --verify tamper adjudication and -real-roots containment with complete root attribution.

Validation

• make build derives v0.8.0 from pyproject.toml; ./depsnort version reports depSNORT v0.8.0.
• Full suite green (34 packages).
• No other file hard-codes the version: test fixtures using "v0.7.5" as arbitrary strings, the PERFORMANCE.md historical baseline, and D-39's own text are records, not claims, and stay.

Files

• pyproject.toml — 0.7.5 → 0.8.0.
• README.md — the two current-release examples.
• docs/DECISIONS.md — D-122.

🤖 Generated with Claude Code

---

Generated by Claude Code