cleave v1.1.0 expands what you get from a binary before reaching for a disassembler.
Header parsing was extended across all three formats. PE adds about sixty fields covering scalars, Authenticode chains, and timestamps. ELF gains another twenty: symbol counts, build IDs, debuglink, interpreter, soname, needed libraries, rpath, runpath. Mach-O adds twenty-five — CPU type, load commands, dylib info, build version. systemd unit files joined the file-type set.
The output schema rolled to V4 and is friendlier to whatever you pipe it into: criticality is now an unsigned ordinal (0–5), metrics are two-decimal, string fields are tuples. Breaking change from V3.
Archive scanning scales harder — member limits raised from 1K to 100K, and AES payload decryption now happens in memory instead of round-tripping to disk per file. The YARA classifier and fileid each moved into their own crate so embedders only pay for what they pull in.
Full notes on Codeberg.