Bump bact/pitloom from 0.16.2 to 0.16.4

[dependabot]

Bumps bact/pitloom from 0.16.2 to 0.16.4.

Release notes

Sourced from bact/pitloom's releases.

v0.16.4

This patch release fixes a bug that allows duplicated entry of the same dependency in the SBOM.

[!NOTE] Limitation notes: While Pitloom can work with any Python project, it currently gathers more information from Hatchling project. More complete support for setuptools is planned for version 0.17.0. uv_build, Poetry Core, PDM-Backend, and Flit-Core are also in the plan. See full limitation notes.

Install for CLI/Python API:

pip install -U pitloom

Install for AI coding assistant:

See the website on how to install Pitloom AI skills and the Claude Code plugin. Try asking the AI agent to "help me complete this SBOM".

Report issues: https://github.com/bact/pitloom/issues

What's changed

• Deduplicated dependencies by @​bact in bact/pitloom#184
• Tighten code quality config by @​bact in bact/pitloom#185

Full Changelog: bact/pitloom@v0.16.3...v0.16.4

v0.16.3

This patch release fixes IndexError on unbalanced ')' in license expressions and will auto-sync ID registry after SBOM generation, so that in the next generation the IDs will be stable.

[!NOTE] Limitation notes: While Pitloom can work with any Python project, it currently gathers more information from Hatchling project. More complete support for setuptools is planned for version 0.17.0. uv_build, Poetry Core, PDM-Backend, and Flit-Core are also in the plan. See full limitation notes.

Install for CLI/Python API:

pip install -U pitloom

Install for AI coding assistant:

See the website on how to install Pitloom AI skills and the Claude Code plugin. Try asking the AI agent to "enrich this SBOM".

Report issues: https://github.com/bact/pitloom/issues

What's changed

• Add fuzz harnesses and strict pytest warnings by @​bact in bact/pitloom#179
• Add sigstore and provenance attestation by @​bact in bact/pitloom#180
• Auto-sync Loom ID registry after SBOM generation by @​bact in bact/pitloom#178

... (truncated)

Changelog

Sourced from bact/pitloom's changelog.

---

Last-Modified: 2026-09-01 SPDX-FileCopyrightText: 2026-present Arthit Suriyawongkul SPDX-FileType: DOCUMENTATION SPDX-License-Identifier: CC0-1.0

Changelog

All notable changes to this project are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

• Full release notes: https://github.com/bact/pitloom/releases
• Commit history: bact/pitloom@v0.16.4...v0.17.0

[Unreleased]

Added

• Add Poetry backend wheel file discovery and lock parsing (#198)
• Add pitloom fragment validate CLI command, using spdx3-validate's library API; new pitloom[validate] optional extra (#200)
• Add --debug/--no-debug flags / PITLOOM_DEBUG env var to surface DEBUG:-level diagnostics on stderr, consistently across every subcommand (#201)
• Add pitloom verify-wheel/validate-wheel CLI commands and matching embed-wheel --verify/--validate flags (#202)
• Add SBOM name/version cross-check to verify-wheel, with --fail-on-mismatch to make a mismatch fatal (#204)
• embed-wheel --sbom now cross-checks the SBOM's name/version against the wheel's METADATA before writing; aborts on mismatch unless --allow-mismatch (#204)

Changed

• Promote 18 log messages from DEBUG: to WARNING: (shown by default, not just under --debug) where a failure silently drops data from the generated SBOM/AIBOM: Hugging Face Hub fetch failures (model card, model_info(), license files), PyTorch/PT2 pickle/graph/metadata parse failures, fastText args/labels reads, README enrichment frontmatter, sdist pyproject.toml fallback parsing, and pitloom.loom caller-provenance detection. Each promoted message names the affected SBOM field(s) via one grep-able shape, ... | Field(s) affected (skipped|degraded): <name> (#201)

... (truncated)

Commits

• 5b58806 Merge pull request #185 from bact/code-quality-config
• 78db45e Bump version to 0.16.4
• a48f8ba Update CHANGELOG
• 682b671 Tighten code quality config
• 7b8e12a Merge pull request #184 from bact/dedup-deps
• 76ecd26 Update CHANGELOG.md
• 9cad71f Deduplicated dependencies
• bda2e8c Merge pull request #183 from bact/release-v0.16.3
• 3f8df8a Update CHANGELOG.md
• aeea3f0 Bump version to 0.16.3
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #44.