[SizzleUnrlsd]

Release 0.10.0 adds one change, following #149.

• Reports name what a result was produced with (Reports: name the plugins and advisory files a result was produced with #149). A directory check lists each plugin it loaded, by manifest name and version, and each advisory file it read, by path, each with the SHA-256 digest of its content. They appear in every format:

  • JSON: tool.components;
  • SARIF: tool.extensions;
  • CycloneDX SBOM: metadata.tools.components;
  • OpenVEX: tooling, so the document @id changes with the advisory data.

  Every finding about an advisory names, in advisory_source, the plugin (name@version) or advisory file it comes from.

A report stays readable by a consumer that ignores the new fields. The cache format does not change.

The curated data needs this release: versioning it (CoreTrace-Entreprise/coretrace-python-analyzer-plugins#34) only lets a result be traced to one dataset once reports name the plugin version.

Changes in this PR

• Version: bumped in pyproject.toml, coretrace_python.__version__, the release test and the report example of the usage guide.
• CHANGELOG.md: the Unreleased section is dated as 0.10.0. No entry changed.

Verification

• pytest: 1110 passed, 2 skipped.
• pytest -m regression under Python 3.12: 19 passed.
• ruff check on the tracked files, and mypy: clean.

Tag v0.10.0 after merge to publish.