This is an older version. The current version is 0.14.4. dfetch 0.14.4 · Released:
Installer files 0.14.0
| Architecture | Type | Scope | File size | Download | SHA256 |
|---|---|---|---|---|---|
| 32-bit | MSI · und | All users | — | github.com | VirusTotal |
Link and SHA256 come from the Windows Package Manager community manifest. Compare the hash of the downloaded file before running it.
Release notes
Release 0.14.0 (released 2026-06-14)
- Update Winget manifest to the Windows Package Manager Community Repository on new release (#1263)
- Check for new dfetch version during dfetch check & dfetch environment (#1262)
- Respect the superproject's line-ending preference (#1260)
- Strip user:password@ userinfo before storing metadata (#1206)
- Warn when a project URL uses a plaintext transport scheme (#1229)
- Documentation and threat-model clarifications for existing release attestation support (#1208)
- Report SVN externals fetched during update (#1220)
- Use .cdx.json as the default extension for CycloneDX SBOM reports (#1118)
- Embed base64-encoded license text in SBOM licenses[].text when a license is successfully identified (#1112)
- Set SBOM licenses to the SPDX expression NOASSERTION when a license file is not found or cannot be classified (#1112)
- Add a dfetch:license:finding property to SBOM when NOASSERTION is set, explaining the reason (#1112)
- Add dfetch:license:threshold and dfetch:license:tool SBOM properties (#1116)
- Add dfetch:license:<spdx-id>:confidence SBOM property for per-licence confidence scores (#1116)
- Use github purl, repo and version for a github release archive in SBOM (#1063)
- Allow dfetch freeze to accept project names to freeze only specific projects (#1063)
- Edit manifest in-place when freezing inside a git or SVN superproject, preserving comments and layout (#1063)
- Add new remove command to remove projects from manifest and disk (#26)
- Fix "unsafe symlink target" error for archives containing relative .. symlinks (#1122)
- Print runtime errors (e.g. svn not available on system) directly in context of the failing subproject instead of collecting and showing them at the end (#1096)
- Fix dfetch add crashing with a ValueError when the remote URL has a trailing slash (#1137)
- Fix unhelpful error message when a metadata file is malformed (#1145)
- Fix arbitrary file write via malicious tar/zip symlink (#1152)
- Prevent SSH command injection (#1152)
- Allow manifests with no projects key so dfetch add can bootstrap empty manifest (#1197)
- Fix ValueError when generating a PackageURL (e.g. for an SBOM) from an empty or path-only remote URL
- Fix SSH shorthand URLs (git@host:path) being incorrectly joined with / when used as url-base with repo-path (#1247)
- Run svn+ssh:// connections in non-interactive mode to prevent hanging (#1230)
