Bump bact/pitloom from 0.16.2 to 0.17.0

[dependabot]

Bumps bact/pitloom from 0.16.2 to 0.17.0.

Release notes

Sourced from bact/pitloom's releases.

v0.17.0

This release adds support for setuptools projects. It also fix a number of non-security bugs, see details in CHANGELOG.

[!NOTE] Limitation notes: While Pitloom can work with any Python project, it currently gathers more information from Hatchling and setuptools projects. Support for uv_build, Poetry Core, PDM-Backend, and Flit-Core is in the plan. See full limitation notes.

Install for CLI/Python API:

pip install -U pitloom

Install for AI coding assistant:

See the website on how to install Pitloom AI skills and the Claude Code plugin. Try asking the AI agent to "help me complete this SBOM".

Report issues: https://github.com/bact/pitloom/issues

What's changed

• Reorganize HF tests by @​bact in bact/pitloom#187
• Prune two unreachable branches in _setuptools_cfg.py by @​bact in bact/pitloom#188
• Cap artifact-metadata annotation size, canonicalize via RFC 8785 by @​bact in bact/pitloom#189
• Only declare simpleLicensing when a real claim exists by @​bact in bact/pitloom#190
• Prune two unreachable branches in _pyproject.py by @​bact in bact/pitloom#195
• Add backend-aware setuptools wheel file discovery by @​bact in bact/pitloom#196

Full Changelog: bact/pitloom@v0.16.4...v0.17.0

v0.16.4

This patch release fixes a bug that allows duplicated entry of the same dependency in the SBOM.

[!NOTE] Limitation notes: While Pitloom can work with any Python project, it currently gathers more information from Hatchling project. More complete support for setuptools is planned for version 0.17.0. uv_build, Poetry Core, PDM-Backend, and Flit-Core are also in the plan. See full limitation notes.

Install for CLI/Python API:

pip install -U pitloom

Install for AI coding assistant:

See the website on how to install Pitloom AI skills and the Claude Code plugin. Try asking the AI agent to "help me complete this SBOM".

Report issues: https://github.com/bact/pitloom/issues

What's changed

... (truncated)

Changelog

Sourced from bact/pitloom's changelog.

---

Last-Modified: 2026-09-08 SPDX-FileCopyrightText: 2026-present Arthit Suriyawongkul SPDX-FileType: DOCUMENTATION SPDX-License-Identifier: CC0-1.0

Changelog

All notable changes to this project are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

• Full release notes: https://github.com/bact/pitloom/releases
• Commit history: bact/pitloom@v0.16.4...v0.17.0

[Unreleased]

Added

• Add PDM-backend and Flit-core metadata extraction and wheel file discovery (#205)
• Add Poetry backend wheel file discovery and lock parsing (#198)
• Add pitloom fragment validate CLI command, using spdx3-validate's library API; new pitloom[validate] optional extra (#200)
• Add --debug/--no-debug flags / PITLOOM_DEBUG env var to surface DEBUG:-level diagnostics on stderr, consistently across every subcommand (#201)
• Add pitloom verify-wheel/validate-wheel CLI commands and matching embed-wheel --verify/--validate flags (#202)
• Add SBOM name/version cross-check to verify-wheel, with --fail-on-mismatch to make a mismatch fatal (#204)
• embed-wheel --sbom now cross-checks the SBOM's name/version against the wheel's METADATA before writing; aborts on mismatch unless --allow-mismatch (#204)
• Add PEP 639 [project.license-files] support: each declared license file gets a software_File element at the real wheel's .dist-info/licenses/ path and a hasDeclaredLicense relationship (#207)
• Add resolved-dependency parsing for loom project/loom generate from pylock.toml (PEP 751), uv.lock, pdm.lock, Pipfile.lock, and a fully pinned requirements.txt -- see Dependency sources and precedence (#208)

Fixed

... (truncated)

Commits

• 68b02e2 Merge pull request #197 from bact/prepare-0.17.0
• 0130542 Prepare for v0.17.0
• 3d7d806 Update roadmap.md
• 90dd815 Merge pull request #196 from bact/improve-setuptools
• 57608a9 Update stale docstring and docs
• 7e6c380 Update logging
• 20d04b1 Add more tests, fix bugs, update docs
• c96e536 Fix inconsistencies
• ba05924 Fix inconsistency between hatchling and setuptools
• e5a9f86 fix bug and redundancy
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)