Skip to content

CHANGELOG.md

Latest commit

 

History

History
1546 lines (1018 loc) · 114 KB

CHANGELOG.md

File metadata and controls

1546 lines (1018 loc) · 114 KB
Raw

Changelog

4.38.0 (2026-09-17)

Features

  • gitlab: add code quality reports and managed CI uploads (#851) (480faa4)
  • sca: add Poetry and Yarn scanning with offline SBOM export (#854) (fad21b3)
  • sca: scan pnpm lockfiles with workspace context (#850) (d9d9405)
  • sca: scan uv and npm lockfiles with advisory details (#847) (6bb2d05)

Bug Fixes

  • grep-verify: keep rescue evidence inside the analyzer scan boundary (#858) (93b69dd)
  • java: detect security issues across helper files and properties (#856) (2a814d1)
  • sca: resolve CI security scan warnings (#849) (a54b5c6)
  • security: recognize literal pytest path parameters (#859) (afc6c6a)
  • typescript: fold static esbuild entry points (#853) (a94808f)

Documentation

  • security: add security research note (#857) (f3c974b)

4.37.0 (2026-09-13)

Features

  • deadcode: detect unreachable nested python functions and closures (#840) (b3e27e2)
  • deadcode: detect unreachable python function groups, also harden grep verification (#830) (e893ffd)
  • deadcode: detect unreachable python methods using receiver resolution (#831) (37b8d86)
  • review: remember reviewed findings across scans (#842) (635bc35)
  • verification: add explicit local and branch comparison baselines (#829) (d99e238)
  • verify: compare Python working changes with HEAD (#827) (79756f8)

Bug Fixes

  • ai-defects: resolve nested local Python imports (#843) (7545406)
  • circular: make cycle selection independent of iteration order (#838) (5124f28)
  • circular: skip fallback self-cycles (#834) (08a6542)
  • deadcode: handle SKY-E003 references and reporting (#846) (be5d67f)
  • typescript: honor inline skylos ignore comments (#845) (c23dbff)

Performance Improvements

  • deadcode: reuse resolved paths within analysis passes (#841) (af82e8a)

4.36.1 (2026-09-08)

Bug Fixes

  • ai-defect: avoid API warnings when package metadata is unavailable (#819) (f80c5a3)
  • ai-defect: reject keywords for APIs with no parameters (#823) (5eb60f0)
  • analyzer: skip unsupported files before worker dispatch (#815) (f28a34a)
  • analyzer: track m3u8 client callbacks from live callers (#813) (0aa9ce0)
  • deps: use published dependency minimums (#825) (900459a)
  • quality: check all lock pairs in compound with statements (#824) (dd17dae)
  • remediation: correct dependency graph sorting (#821) (1dbf929)
  • rules: drop phantom SKY-D214 rule (#785) (a8ca42e)
  • typescript: recognize VitePress and Windows script entries (#822) (fc2a954)
  • typescript: resolve package entries outside src (#820) (25f64cf)

4.36.0 (2026-09-07)

Features

  • ai-defect: flag mirrored dependency version bumps (#808) (aefc020)

Bug Fixes

  • ai-defect: continue checks after failed Python files (#796) (b1d0ad7)
  • ai-defect: make SKY-A103 findings complete and deterministic (#793) (7536054)
  • ai-defect: report CI permission signals reliably (#792) (1172878)
  • ai-defect: resolve imported JS barrel exports (#799) (2983f8f)
  • analyzer: deterministic module name for multi source-root paths (#780) (0e96fdb)
  • analyzer: preserve scan context in Git hooks (#795) (38124e7)
  • analyzer: recognize declaration-only Python stubs (#801) (06b7fc3)
  • analyzer: reduce Django and Celery false positives (#800) (bc9ee49)
  • catalog: swap SKY-F101/F102 rule descriptions (#782) (009931b)
  • cicd: correct workflow rule locations and runner checks (#807) (43c9025)
  • cli: report circular dependencies consistently (#804) (825717e)
  • cwe: correct 10 misaligned CWE mappings (#784) (9f1fbc1)
  • jwt: detect decode calls through import aliases and direct imports (#783) (f1184b1)
  • security: prevent false SKY-D212 warnings on RegExp.exec() (#806) (975a3ad)

Performance Improvements

  • analysis: share parsed ASTs across rule passes (#779) (f99402e)
  • analyzer: index export lookups (#771) (65bd38c)

4.35.0 (2026-08-26)

Features

  • quality: detect generated-code mistakes (#762) (b59dbab)
  • typescript: detect type evidence bypasses (#761) (e5d7236)

Bug Fixes

  • ai-defect: recognize control-flow module exports (#759) (a1055d8)
  • ai-defect: support PEP 735 dependency groups (#764) (46d21dc)
  • analyzer: tighten dead-code and SQL matching (#770) (7d71ee2)

Performance Improvements

  • analyzer: batch engine-sensitive space patterns (#763) (8a03fa4)
  • analyzer: index abstract override lookups (#767) (8c07ef9)
  • analyzer: index qualified reference lookups (#769) (b0fbfdb)

4.34.0 (2026-08-23)

Features

  • security: add TypeScript security proofs and trusted evidence (#717) (a514a63)

Bug Fixes

  • ai-defect: avoid oversized registry responses (#751) (0ffd3ce)
  • analyzer: complete batched unicode verification (#729) (3f2cc94)
  • analyzer: fail closed on incomplete grep verification (#727) (d2510c2)
  • analyzer: scope diff verification to changed files (#731) (db51203)
  • ci: restrict Codecov coverage uploads (#755) (2361d68)
  • danger: fail closed on incomplete MCP analysis (#726) (448b433)
  • dead-code: preserve signature contract parameters (#750) (57606cc)
  • grep: stream oversized verification results (#757) (9b3f2de)
  • quality: break SKY-C401 clone-type ties deterministically (#756) (e7044e8)
  • quality: detect concrete ellipsis defaults (#728) (d4a047d)
  • quality: handle positional-only boolean traps and setters (#719) (c6364bd)
  • quality: handle positional-only defaults (#709) (d4a1c65)
  • sca: handle npm dependency sections safely (#752) (cc57c69)
  • sca: scope npm dependency line anchoring to its declaring section (#748) (aa56ed3)
  • secrets: avoid computed checksum false positives (#724) (9b8264b)
  • secrets: avoid ordered character set false positives (#753) (d9e4077)
  • secrets: skip untracked generated grep cache (#725) (0228225)
  • security: handle positional-only MCP defaults (#712) (94f2596)

Performance Improvements

  • ai-defect: batch API surface cache I/O (#746) (e300469)
  • analyzer: batch grep verification searches (#721) (03aa768)
  • dead-code: index documented method references (#744) (5c35c10)

4.33.2 (2026-08-09)

Bug Fixes

  • java: correct session trust boundary rule ID (#703) (3c1eca3)
  • secrets: validate lockfile checksums (#701) (e8bf0ee)
  • typescript: ignore null guards in timing comparison rule (#704) (56f666f)

4.33.1 (2026-08-06)

Bug Fixes

  • go: fail closed when native analysis is incomplete (#696) (e7dc79e)
  • secrets: scan lockfiles for high-entropy secrets (#695) (b3c980b)

4.33.0 (2026-08-05)

Features

  • reliability: add Kubernetes, GPU, and Scanner Proof gates (#683) (fa6fbd8)

Bug Fixes

  • ai-defect: recognize module dunder attributes in phantom refs (#691) (d626772), closes #684
  • cli: enable SKY-D223 when explicitly selected (#689) (9235c0d)
  • dependencies: parse pyproject metadata with TOML (#690) (97815ff)

4.32.0 (2026-07-30)

Features

Bug Fixes

  • ai-defect: handle imported submodule references (#671) (d9ca4b8)
  • analyzer: honor rule-specific inline ignores (#674) (f0ad568)
  • cli: render AI defects in rich output (#676) (34f696c)
  • security: bind keyword filesystem path arguments (#675) (b475414)

4.31.1 (2026-07-29)

Bug Fixes

  • ai-defect: recognize PEP 695 type aliases (#664) (2a645df)
  • analyzer: fail closed on compile-time syntax errors (#657) (ab8c249)
  • container: prevent false-clean Python scans (#654) (4d2a502)
  • dead-code: honor underscore discard bindings (#655) (fe908b6)
  • dead-code: invalidate grep cache on evidence changes (#661) (2277788)
  • dead-code: prevent unrelated parameter rescues (#658) (93e7ddb)
  • dead-code: wire evidence into reporting decisions (#652) (ae6936c)
  • quality: exempt Protocol method stubs (#663) (84e1ce4)
  • quality: exempt underscore exception discard (#662) (a0c2ede)

Documentation

  • readme: add MCP Toplist ranking badge (#656) (5593163)

4.31.0 (2026-07-27)

Features

  • audit: add deep audit investigator (#637) (967de71)
  • audit: harden Deep Audit evidence, CI, and benchmarks (#643) (050abd1)

Bug Fixes

  • analyzer: recognize VS Code and JavaFX FXML callbacks (#645) (bc7eb42)
  • analyzer: track PEP 695 type parameter refs (#644) (96f97d6)

4.30.0 (2026-07-18)

Features

  • agent: add deterministic behavior testing (#635) (90594d8)
  • verify: add cross-language API verification coverage (#632) (89b4c99)
  • verify: add language-aware verification coverage (#630) (7b0d9d6)

4.29.0 (2026-07-09)

Features

  • defend: add agent verification evidence (#625) (f3155e4)
  • defend: expand agent verification checks (#628) (f185cf3)

Bug Fixes

  • dead-code: recognize numba overload implementations (df7a2d3)

4.28.0 (2026-07-04)

Features

  • ai-defect: add AI hallucination contracts (#618) (6aa87d1)
  • ai-defect: harden AI code defect detection (#623) (2459ea2)

Bug Fixes

  • analyzer: improve fastapi framework liveness (#622) (5e172db)
  • analyzer: recognize django and gunicorn liveness (#621) (135677d)
  • scanner: reduce go and java false positives (#616) (ef5b069)
  • verify: surface AI contract diff findings (#620) (b56d543)

4.27.0 (2026-06-29)

Features

4.26.1 (2026-06-25)

Bug Fixes

  • sca: skip non-PyPI pyproject sources (#607) (93ce91d)

4.26.0 (2026-06-25)

Features

  • agent: add harness replay CLI (#604) (3081522)
  • dead-code: explain unused-code evidence in output (#597) (4457cdc)
  • llm: add agent review routing (#592) (c60f7f9)
  • llm: add replayable verification harness (#599) (fb0cf5d)

Bug Fixes

Documentation

4.25.0 (2026-06-19)

Features

Bug Fixes

  • analyzer: harden noqa import suppression lines (#585) (61f9c1a)
  • analyzer: make noqa suppressions code-specific (#584) (0effa8e)
  • analyzer: scope suppression state correctly (#586) (830ba43)

4.24.2 (2026-06-15)

Bug Fixes

  • dead-code: handle literal plugin registries (#566) (f5ecd25)
  • dead-code: reduce TS and Go false positives (#565) (92431bc)
  • java: reduce annotation dead-code false positives (#567) (ca06053)
  • release: retry GHCR image publish (#562) (4858863)

4.24.1 (2026-06-09)

Bug Fixes

  • dead-code: reduce Rust and TypeScript false positives (#560) (4d92fd5)

4.24.0 (2026-06-07)

Features

  • corpus: add pinned framework corpus runner (#559) (ad00c62)
  • dead-code: add Kotlin grep verification support (#554) (4352ab6)
  • dead-code: add Kotlin thin scanner layer (#553) (583a723)
  • kotlin: wire workflow registries (#556) (b8ae490)
  • llm: add critical AI security rules (#544) (dd6963a)
  • llm: detect excessive agent tool privilege (#545) (1df383a)
  • llm: detect unbounded LLM consumption (#546) (59e9d64)
  • llm: detect unsafe LLM app flows (#543) (f953830)
  • secrets: scan Kotlin source files (#555) (7624b6d)

Bug Fixes

  • analyzer: reduce quality scan false positives (#536) (c414818)
  • cloud: split sync setup helpers (#540) (7bbf4c4)
  • dead-code: qualify Java static call graph refs (#552) (4e79aeb)
  • dead-code: recognize stdlib callback hooks (#549) (0e69311)
  • dead-code: reduce language false positives (#551) (55e9ced)
  • dead-code: reduce Python framework false positives (#558) (40a94a4)
  • dead-code: resolve Go receiver method refs (#550) (b4813dd)
  • dead-code: track browser handler liveness (#547) (0961f30)
  • llm: harden security finding explanations (#541) (6855f73)
  • quality: reduce quality scan false positives (#538) (72172c5)
  • security: reduce browser scanner noise (#548) (253f6ae)
  • upload: require explicit scan uploads (#539) (6a00673)

Documentation

  • kotlin: list Kotlin in public metadata (#557) (9634e34)

4.23.1 (2026-06-04)

Bug Fixes

  • verify: catch api and stale-reference hallucinations (#530) (7c9d0e2)
  • verify: handle manifest-only dependency cases (#525) (9f3393c)

4.23.0 (2026-06-03)

Features

  • agent: add skylos verify workflow (#517) (ec57048)
  • bench: add ai code defect benchmark (#518) (676d872)
  • corpus: capture local structural signals (#522) (83f6dcc)
  • index: persist reference graph cache (#520) (f7c5646)
  • remediate: add verification proof tests (#523) (e694656)
  • verify: detect API and dependency hallucinations (#519) (dea81c5)
  • vscode: route idle analysis through verify (#521) (a6be270)

Bug Fixes

  • security: harden optional import and Dockerfile scanning (#515) (498a15d)

Documentation

4.22.1 (2026-05-30)

Bug Fixes

4.22.0 (2026-05-29)

Features

  • security: detect agent command exfiltration (#511) (f2c44a8)

Bug Fixes

  • cicd: gate dependency vulnerabilities by default (#512) (7619b0b)
  • security: harden repo-controlled IO surfaces (#509) (b7cbce1)

4.21.0 (2026-05-29)

Features

  • cli: support explicit config files (#506) (55f1671)
  • security: export threat traces in deep audit (#503) (004b36d)

Bug Fixes

  • security: harden CI workflow permissions (#508) (b29ca43)
  • security: harden config policy and MCP credits (#507) (56b3dbb)

4.20.0 (2026-05-27)

Features

  • analyzer: harden cross-language security and quality checks (#491) (7b3d62c)
  • cli: add security agent aliases (#500) (aeaeefa)
  • config: add edge deployment scanners (#497) (4fc098a)
  • security: add static threat traces (#501) (e18885f)
  • shell: add shell security scanning (#495) (8c764a0)

Bug Fixes

  • analyzer: reduce vscode extension dead-code false positives (#499) (6848ab9)
  • docs: avoid repo map line churn (#496) (df08da4)

4.19.0 (2026-05-24)

Features

Bug Fixes

  • debt: harden debt persistence file handling (#484) (d34a3d7)
  • gate: avoid terminal probe output during concise gate checks (#489) (9c718f9)
  • static: preserve security findings in parallel scans (#487) (f12a66f)

4.18.0 (2026-05-22)

Features

Bug Fixes

4.17.0 (2026-05-21)

Features

  • dead-code: add evidence ledger (#462) (0d82ef1)
  • debt: cap uploaded hotspot samples (#466) (14652fa)
  • llm: add grounded verification benchmarks (#467) (a900f14)
  • quality: add opaque identifier readability rule (#468) (1d0c5c8)
  • security: add symlink safety rules (#465) (f7b28a9)

Bug Fixes

4.16.2 (2026-05-19)

Bug Fixes

Documentation

4.16.1 (2026-05-19)

Bug Fixes

  • config: validate whitelist settings (#443) (1734ec0)
  • danger: track SQL and SSRF receiver aliases (#446) (99cf457)
  • excludes: honor absolute scan-root paths (#452) (627d763)
  • gate: allow non-critical threshold tuning (#449) (6fe6fe9)
  • precommit: block high severity quality findings (#451) (6306d61)
  • pytest: guard fixture report writes (#453) (19f5613)
  • scanner: bound language assignment scans (#448) (650e018)
  • typescript: bound duplicate condition scan (#450) (cc97185)
  • typescript: constrain glob expansion (#447) (28fee5b)
  • web: normalize analyze excludes (#445) (6cc31bf)

4.16.0 (2026-05-19)

Features

  • cli: add cache stats and rules catalog JSON (#438) (cd1e5df)
  • cli: add cache stats and rules catalog JSON (#439) (03bd425)
  • cli: improve terminal scan output (#420) (f9582d4)

Bug Fixes

  • analyzer: escape dynamic reference patterns (#435) (e10916a)
  • audit: scope deep processing to current scan (#419) (b9df22e)
  • ci: avoid PR-controlled scanner execution (#428) (13e2f87)
  • cicd: quote generated PR base refs (#417) (7d9e6b9)
  • ci: configure parity venv path at runtime (72b588a)
  • ci: keep parity venv outside checkout (#415) (6eedb7e)
  • cli: redact secrets in llm reports (#433) (af64e1f)
  • cli: sanitize pretty report text (#427) (176c0e2)
  • config: validate skylos project config (#436) (6e1d988)
  • llm: minimize changed-file review context (#432) (056a072)
  • login: avoid printing saved api token (#434) (f000851)
  • pipeline: review ordinary files in llm-only scans (e21696a)
  • remediation: reject edits outside scan root (#424) (c48a8b5)
  • secrets: avoid quadratic generic scan (#410) (8dd05af)
  • secrets: restore generic value export (#412) (08bd492)
  • secrets: scope hash suppression to candidates (#437) (2de8e2a)
  • security: bound prompt injection candidate collection (#429) (5f41874)
  • security: bound prompt injection scans (#423) (aee6754)
  • security: parse markdown fences linearly (#430) (81525ee)
  • security: prioritize prompt docs within scan cap (#426) (c22a004)
  • security: tolerate non-utf8 taskflow files (#416) (41e72d7)
  • sql: invalidate mutated static queries (#418) (d9765bc)
  • ssrf: flag uppercase f-string URL bases (#425) (acf6ee3)
  • sync: reject symlinked repo link (#413) (4b046c3)
  • typescript: detect child_process exec aliases (#414) (221e783)

Documentation

4.15.2 (2026-05-17)

Bug Fixes

4.15.1 (2026-05-16)

Bug Fixes

4.15.0 (2026-05-16)

Features

Bug Fixes

  • cli: scope grades to scanned categories (#363) (5b57a77)
  • cli: write rich output reports to file (#360) (baef30e)
  • core: tighten exception handling and split grep verifier (#359) (511d71a)
  • dead-code: resolve package-root imports (#361) (ffb82c9)
  • security: harden VS Code webview surfaces (#345) (b15e29b)
  • upload: harden Cloud report uploads (#352) (39cd7fc)

4.14.0 (2026-05-11)

Features

  • security: add Deep Mode audit foundation (#339) (d4a89d2)
  • security: add SSRF evidence packets (#336) (2990d2c)
  • security: complete deep audit workflow phases (#341) (3e3702b)

Bug Fixes

  • cli: prevent help from creating artifacts (#340) (72af4f0)
  • security: disable arbitrary pip install in verifier (#344) (8307280)
  • security: polish Deep Mode audit states (#343) (9b229ee)

4.13.1 (2026-05-10)

Bug Fixes

  • python: detect no-effect statements (#332) (7ffa1c9)
  • python: detect unreachable loop code (#334) (676a414)
  • python: keep same-name wrappers dead (#330) (7d4d32c)
  • security: harden agent service and API surfaces (#335) (05393ea)

4.13.0 (2026-05-09)

Features

  • languages: add Dart support and harden PHP scanning (#327) (681e754)
  • languages: harden Java and Go security flows (#323) (4f02b69)
  • quality: add architecture policy and placeholder checks (#318) (15e6be4)

Bug Fixes

  • analyzer: keep scanner caches at project root (#324) (294a03c)
  • architecture: add Q802 Q803 remediation hints (#326) (2f0f3f0)
  • gate: make file-level IAD architecture findings advisory (#325) (1df7ee1)
  • python: keep pyproject GUI scripts live (#328) (151b7e2)
  • python: suppress override method parameters (#329) (2a5cba3)

Documentation

4.12.1 (2026-05-08)

Bug Fixes

  • architecture: repair Q802/Q803 audit defects (#316) (633e911)
  • architecture: suppress private helper Q803 false positives (#315) (8ec8799)
  • cli: quiet LLM scan output (#313) (f13fff2)

4.12.0 (2026-05-07)

Features

Bug Fixes

  • architecture: rename misleading healthy zone fallback (#308) (3eba72c)
  • architecture: suppress library re-export false positives (#307) (117142d)

4.11.1 (2026-05-06)

Bug Fixes

  • architecture: suppress cli entrypoint false positives (#301) (73886c9)

4.11.0 (2026-05-05)

Features

Bug Fixes

  • architecture: preserve submodule coupling targets (#296) (90a1e1d)
  • cli: repair display severity filtering (#280) (0c3b929)

Documentation

  • contributing: add contributor roadmap (#292) (d398b8a)
  • security: document webhook signature rule (#290) (3024850)

[Unreleased]

Documentation

  • Document SKY-D282 webhook signature verification coverage.

4.10.0 (2026-05-02)

Features

  • analyzer: add configurable vibe guardrails (b789334)
  • analyzer: add Python liveness evidence for dead-code detection (#272) (f5c53b3)
  • cli: add concise IDE-friendly output (#279) (07d22cc)

Bug Fixes

  • analyzer: cover rust and workspace edge cases (721235b)
  • analyzer: harden rust and monorepo resolution (565fc8f)
  • analyzer: restore configurable vibe guardrails (#271) (61aa187)
  • ci: harden enterprise workflow generation (#268) (8568bc0)
  • cli, quality: honor gate exits and ignore annotation strings (#275) (5a8d3f6)
  • cli: honor strict scan exit codes (#278) (b98db50)
  • sync: block direct main pushes (#269) (9ed6fe6)

4.9.0 (2026-04-30)

Features

  • analyzer: add rust scanner and monorepo support (d2cb1b7)

4.8.0 (2026-04-28)

Features

  • cli: add upload session metadata (0758f77)

Performance Improvements

  • analyzer: reduce scan runtime without changing findings (#264) (9cff0c4)

Documentation

  • ci: add tokenless CI workflow example (723ec78)
  • readme: add validation results and trust badge (f359184)

4.7.0 (2026-04-26)

Features

  • cloud: support tokenless CI auth (60b3273)

Bug Fixes

  • release: restore release-please metadata flow (f4e233c)

4.6.0 (2026-04-26)

Features

  • languages: add js-jsx support and strengthen java-go security c… (#237) (c082fcf)
  • languages: add php foundation support (#243) (4a137cc)
  • languages: deepen go java and js-ts security checks (#238) (fde84e3)
  • languages: deepen js-ts reachability and entry discovery (#240) (6ea96a2)
  • languages: harden go archive symlink checks (#241) (4d37f14)
  • languages: harden java canonical path guard checks (#242) (d3958bf)
  • security: add security contract regression detection (#236) (1b48e52)
  • upload: add family-aware cloud uploads and debt reporting (#239) (55b75ea)
  • upload: add monorepo routing and sonar import (#244) (dc473d7)

Bug Fixes

  • dead-code: improve frozen benchmark precision and recall (#254) (4fd170c)
  • java: make security flow analysis structured (#253) (5d3a946)
  • python: fix critical logic gaps (#245) (96712b9)
  • python: improve security flow precision and recall (#250) (8af25d2)
  • quality: detect duplicate branch logic (#255) (8e76e9d)
  • security: improve typescript ssrf and go command precision (#251) (1218c9d)

Documentation

  • readme: refresh GHCR image release notes (#232) (bea165c)
  • readme: streamline landing pages and benchmark scorecard (#256) (f2af8c2)

4.5.0 (2026-04-22)

Features

  • docker: publish official GHCR image for Skylos CLI (#230) (0300f87)
  • docker: publish official GHCR image for Skylos CLI (#231) (96cc2b7)
  • security: add challenge pass for uncertain findings (#226) (a2b2927)
  • security: add review evidence for llm security findings (#218) (1670cde)
  • security: add security taskflow foundation and relax local pre-commit gate (#221) (1fa404b)
  • security: add taskflow candidate ledger (#222) (2459fb6)
  • security: add taskflow file facts (#223) (78cc52c)
  • security: persist taskflow run artifacts (#225) (3338eef)

Bug Fixes

  • cli: improve pre-commit UX and harden large upload flow (#210) (30fa686)
  • cli: reduce false positives in local pre-commit gating (#213) (e0b3a3e)
  • cli: reduce false positives in local pre-commit gating (#214) (5959fa8)
  • cli: scan staged test files for secrets only (#215) (9b1f199)

Documentation

  • readme: add security taskflow example (#227) (6434f2a)
  • readme: update security taskflow docs (#224) (251fe4d)

4.4.0 (2026-04-16)

Features

  • cli: add suite command for the full local bundle (#209) (1989905)
  • py: add repo-aware vibe reference detection (#208) (797b1ab)
  • ts: add AI defense beta for direct LLM integrations (#207) (dfb4fda)
  • ts: report monorepo workspace inventory (#202) (610c53b)

Bug Fixes

  • ci: publish releases from tags (#196) (be5e6ee)
  • ts: keep monorepo package entrypoints reachable (#205) (f0cb594)
  • ts: resolve direct project references in monorepos (#204) (c2b4c69)
  • ts: use declared workspaces for monorepo resolution (#203) (5a28512)

4.3.2 (2026-04-10)

Bug Fixes

  • sync: support top-level cloud pull config (#194) (8abe838)
  • ts: resolve workspace exports and local imports maps (#181) (322466c)

4.3.1 (2026-04-08)

Bug Fixes

  • upload: support large scan uploads via artifact transport (#179) (7f1641f)

4.3.0 (2026-04-08)

Features

  • cli: add explicit project selection flow (#171) (3eb3001)

Bug Fixes

  • core: honor root ignores and actionable clean edits (#165) (358dd1f)
  • release: align release-please bootstrap with 4.2.1 (8fb330f)
  • summary: include Java in language analysis summary (#175) (433c0e8)
  • ts: align Next.js convention coverage (#164) (05264b2)

[Unreleased]

Added

  • Added a Simplified Chinese README (README_CN.md)
  • Added configurable web UI port support for skylos run via --port or SKYLOS_PORT
  • Added monorepo workspace inventory reporting for TypeScript projects. Skylos now reports root packages, child workspaces from package.json / pnpm-workspace.yaml, tsconfig.json references, and undeclared workspace package diagnostics in analysis and MCP output
  • Added TypeScript AI defense beta support to skylos discover / skylos defend for direct Node / Next-style LLM integrations, reusing the existing guardrail engine and report format
  • Added skylos suite <path> as a single local command for static analysis, technical debt, AI defense, and provenance summary

Changed

  • SKY-L030: Lint rule for except Exception/except BaseException with trivial handler (CWE-396)
  • Continue CLI cleanup by extracting command boundaries, lazy-loading heavy analysis paths.Expanded regression guardrails around dispatch, output, and exit-code behavior
  • TypeScript monorepo resolution now uses declared workspaces as the package boundary, resolves root package self-imports, and honors JSONC-style tsconfig path inheritance
  • TypeScript resolution now supports importer-local direct tsconfig.json project references for composite monorepos without leaking those references into global package resolution
  • TypeScript dead-file and unnecessary-export analysis now treats workspace package entrypoints as reachability roots, including packages kept alive through direct local tsconfig.json project references
  • AI defense file discovery for discover / defend now scans direct TypeScript and JavaScript source files in addition to Python
  • Docs, help, and tour now steer new users toward a smaller command set centered on skylos suite ., skylos ., skylos cicd init, and the agent commands

Fixed

  • Browser login callback now validates state and verifies the returned token metadata via whoami
  • Fixed local web UI rendering to avoid unsafe HTML insertion patterns
  • Sync credentials are written with stricter file and dir permissions

[4.2.1] - 2026-04-03

Changed

  • skylos agent scan now defaults to the fast review path. Slow dead-code verification is opt-in via --verify-dead-code
  • Agent review is more repo-aware, with better file selection and context for quality, security, and debt-style issues
  • Added agent benchmarks and Codex comparison runs with token reporting

Fixed

  • Agent scans now fail cleanly on missing API keys instead of crashing
  • Review output is clearer when dead-code verification is still running
  • LLM provider and runtime settings now propagate correctly through the agent path

[4.2.0] - 2026-03-30

Added

  • Added skylos debt <path> for technical debt hotspot analysis
  • Added separate structural debt scoring and hotspot priority_score

Changed

  • Refactored the CLI entrypoint by extracting baseline, badge, doctor, credits, init, whitelist, clean, whoami, login, sync, city, discover, defend, debt, ingest, provenance, and cicd into dedicated command modules.
  • CLI refactor guardrails to catch dispatch, output, and exit-code regressions during future cli.py cleanup
  • skylos debt --top now will override report.top
  • Changed-file debt scans now resolve git diffs from the repository root and include .js / .jsx
  • Debt baseline and history writes require project-root scans
  • Debt baseline comparisons no longer count unseen hotspots as resolved
  • Sync-installed pre-push hooks now run only the fast Rust/Python parity guard instead of a full skylos . scan, and checked-in Skylos hooks are limited to the pre-commit stage

Fixed

  • skylos agent watch --learn now forwards the learning flag into the watch loop

[4.1.4] - 2026-03-25

Fixed

  • skylos --llm now shows populated Problem: descriptions for dead code findings instead of blank lines (fixes #118)
  • Dead code findings in --llm output now include rule IDs (SKY-DC001–SKY-DC006) and proper severity levels
  • uvx skylos crash on Windows due to litellm's .pth file exceeding MAX_PATH (260 chars) in uvx cache paths (fixes #120)
  • Skylos now honors project .gitignore entries during file discovery, so ignored worktrees, custom virtualenvs, and other excluded paths are no longer scanned
  • Flask, FastAPI, Starlette, and Sanic imperative route or lifecycle registration (add_url_rule, add_api_route, add_route, register_listener, register_middleware) is now treated as a live framework entrypoint instead of dead code
  • Pytest and Pluggy hook implementations (@pytest.hookimpl, @hookimpl) are now treated as live plugin entrypoints instead of dead code
  • Grep cache saves now fail open on non-writable roots instead of aborting analysis

Changed

  • litellm moved from required to optional dependency — install with pip install skylos[llm] for LLM features. Core static analysis no longer pulls in litellm.
  • litellm version capped at <1.82.8 to avoid known supply chain compromise
  • Agent scans are faster on changed-file workflows, and fix generation is now opt-in
  • Phase 2b LLM audits now focus on high-signal files instead of scanning the full Python set
  • Static grep_verify now reuses .skylos/cache/grep_results.json across repeated local scans

[4.1.3] - 2026-03-22

Added

  • Configurable duplicate string threshold — duplicate_strings in [tool.skylos] (default: 3)
  • CLI table now prints a brief explanation of what each column means
  • CLI discoverability overhaul — skylos with no args shows grouped command overview of all 30+ commands
  • skylos commands — flat alphabetical listing of every command
  • skylos tour — guided 6-step walkthrough for new users
  • README Command Reference section with grouped tables
  • nudges config key in [tool.skylos] to suppress post-scan suggestions
  • Java language support. Dead code, security and quality
  • Spring/JUnit framework awareness — @Override, @Bean, @Test, @GetMapping, @Scheduled, lifecycle methods are suppressed

Fixed

  • Django/DRF false positives: Meta inner classes, urlpatterns, serializer_class, permission_classes, filterset_class, migration attrs, and AppConfig subclasses are fixed (fixes #115)
  • Added django_filters to framework detection

Changed

  • Quality table column renamed from "Function" to "Name"
  • Duplicate string findings now show repeated 5× (max 3) instead of cryptic 5 (target ≤ 3)
  • Complexity findings now show Complexity: 14 (max 10) instead of bare 14 (target ≤ 10)
  • skylos init template now includes duplicate_strings option
  • Post-scan hints replaced with context-aware nudges (1 per scan, based on results)
  • Argparse epilog simplified — points to skylos commands and skylos tour

[4.1.2] - 2026-03-20

Added

  • MCP validate_code_change — diff-level validation with security regression detection, dangerous pattern scanning, secret leak detection, and SQL injection checks
  • CI/CD review integration with security regression detection from diffs
  • Upload payload now includes definitions for Code City dashboard
  • Auto-detect changed files from git for quality checks when no explicit diff base is provided

Fixed

  • Crash on systems without clipboard mechanism (Docker, headless Linux) — pyperclip.PyperclipException is now caught
  • False positive on framework methods in nested classes
  • Removed unused DJANGO_SIGNAL_METHODS import in penalties module

[4.1.0] - 2026-03-20

Added

  • Security regression detection — SKY-L021 expanded to 13 categories: input validation, security headers, encryption, logging/audit, sanitization, permission checks. Findings include control_type field
  • Web scanner — public scan page at skylos.dev/scan, paste a GitHub URL, get a vibe code risk score. No signup, rate-limited (10/IP/hr)
  • MCP guardrails — validate_code_change (diff validation for regressions, dangerous patterns, secrets) and get_security_context (project security posture for agents)
  • Community rules — skylos rules install|list|remove|validate for YAML rule packs from duriantaco/skylos-rules or any URL. Taint-flow pattern support in YAML rules
  • AI provenance — --provenance flag annotates findings with AI authorship (cursor, copilot, claude, etc.). Per-agent and per-severity breakdowns
  • TypeScript dead code detection — cross-file analysis with SKY-E003 (unused files with transitive propagation), SKY-E004 (unnecessary exports), wildcard re-export chain resolution, .js→.ts path resolution
  • TypeScript export graph — aliased imports, default re-exports, namespace re-exports all tracked correctly
  • Python vibe detection — phantom security calls/decorators now resolve imported local modules and package re-exports like security.require_auth() and @guards.require_auth
  • Next.js security — SKY-D280 (missing auth in API routes), SKY-S102 (server secrets in "use client" files), SKY-D281 (SQL injection in "use server" actions)
  • SKY-S102: Client-side secret exposure in static/, public/, .next/, dist/, build/ paths
  • D230 enhanced: catches redirect(request.args.get("next", "/")) with urlparse/startswith guard suppression
  • SKY-Q306: Cognitive complexity (SonarQube S3776)
  • SKY-L027 (duplicate strings), SKY-L028 (too many returns), SKY-L029 (boolean trap)
  • Go quality rules (Q301, Q302, C303, C304) via tree-sitter-go
  • skylos[fast] — optional Rust accelerator
  • skylos provenance — detect AI-authored code in PRs
  • Agent-aware quality gate ([tool.skylos.gate.agent])
  • skylos agent watch, agent pre-commit, agent verify --fix --pr
  • Grep-based verification pass with parallel workers, GrepCache, CWE tagging + SARIF taxonomy

Changed

  • Agent CLI consolidated from 16 to 8 commands
  • TS definitions use filename:name as dict key (prevents collisions)

Fixed

  • Definition.to_dict() now includes is_exported flag
  • TS def key collisions and cross-file import resolution

[4.0.0] - 2026-03-15

Added

  • -a / --all flag — enables --danger, --secrets, --quality, and --sca in one shot
  • addopts config — set default CLI flags in pyproject.toml under [tool.skylos]
  • LLM verification agent — skylos agent verify <path> with 3-pass dead code verification
  • Batch LLM calls — up to 8 findings per call
  • Confidence feedback loop — auto-tunes heuristic weights across runs (~/.skylos/feedback.json)
  • MCP verify_dead_code tool
  • --verification-mode flag — judge_all and production modes
  • AI defense cloud dashboard — skylos defend . --upload sends results to Skylos Cloud
  • skylos cicd init --defend and skylos-defend pre-commit hook
  • Public API detection — documented API symbols suppressed without LLM calls

Changed

  • Dead-code verifier defaults to judge_all mode
  • Deterministic suppressors attached as verifier evidence

Fixed

  • Quality Gate step runs with if: always()
  • --upload on empty project prints "skipping upload"

[3.5.10] - 2026-03-10

Changed

  • Breaking: Removed skylos . --fix, skylos agent fix, skylos agent analyze --fix — use skylos agent remediate

Fixed

  • LiteLLMAdapter.complete() forwards response_format to litellm
  • create_llm_adapter() passes base_url from AgentConfig
  • Attribute context matching bug, _mark_refs() O(n) fallback replaced with lookup
  • Narrowed broad except Exception blocks to specific types
  • Git subprocess calls now have timeouts

[3.5.9] - 2026-03-10

Fixed

  • skylos cicd init no longer crashes with TypeError on generate_workflow()

[3.5.8] - 2026-03-10

Fixed

  • SKY-D260: multiline HTML comment duplicates, overly broad patterns, fenced code block exclusion, homoglyph false positives, single-line string regex
  • SKY-Q301: counts comprehension for/if and match case guards; threshold >=10 → >10

[3.5.7] - 2026-03-09

Added

  • skylos cicd init --upload for cloud dashboard workflows
  • SKY-L016 (undefined config), SKY-L023 (phantom decorator), SKY-L024 (stale mock), SKY-L026 (unfinished generation)
  • SKY-D260: AI supply chain security — multi-file prompt injection scanner
  • Vibe confidence metadata (vibe_category, ai_likelihood)
  • --llm flag for LLM-optimized reports

Fixed

  • SKY-C401 clone detection false positives reduced

[3.5.6] - 2026-03-07

Added

  • --diff [BASE_REF] — line-level precision filtering using unified diff hunk headers
  • Git blame attribution on findings
  • Auto-upload for linked projects (--no-upload to skip)
  • SKY-L010 (security TODOs), SKY-L011 (disabled security controls), SKY-L012 (phantom calls), SKY-L013 (insecure randomness), SKY-L014 (hardcoded credentials), SKY-L017 (error info disclosure), SKY-L020 (overly broad permissions)
  • Dynamic signal tracking (inspect.getmembers, dir())
  • Expanded default exclude folders for Go, TypeScript, VCS, IDE

Fixed

  • --exclude-folder with trailing slashes and CWD-relative paths

Changed

  • Table output is now the default (TUI opt-in via --tui)
  • MCP credit checks fail-open on network errors

[3.5.5] - 2026-03-04

Added

  • Claude Code Security integration — skylos ingest claude-security CLI subcommand
  • skylos cicd init --claude-security generates 3-job GitHub Actions workflow
  • Blue "Claude Security" badges on dashboard

Changed

  • Credit deduction is format-aware (2 credits for Claude Security, 1 for native)

[3.5.4] - 2026-03-03

Added

  • LLM-generated code-level fix suggestions with before/after snippets
  • PR inline comments with fenced code blocks, collapsible <details> in summary
  • Rule-based text suggestion fallback when LLM not used

Fixed

  • Phase 3 matching for findings without rule_id
  • _merge_llm_findings passes through vulnerable_code and fixed_code

[3.5.3] - 2026-03-03

Added

  • CVE reachability analysis via ca9 engine — proves whether vulnerable deps are actually reachable
  • skylos whoami command

Fixed

  • --json -o <file> writes to file instead of only stdout
  • CI/CD workflow: agent review uses --format json, auto-adds ANTHROPIC_API_KEY
  • PR review inline comments: absolute vs relative path mismatch fixed

[3.5.2] - 2026-03-01

Added

  • Go dead code detection

Fixed

  • engines/__init__.py missing

[3.5.1] - 2026-02-28

Added

  • TypeScript analysis 6.7x faster via batched tree-sitter queries
  • 11 new TypeScript security rules: SKY-D245 through SKY-D253, SKY-D270, SKY-D271, SKY-D510
  • SKY-Q305 (duplicate condition), SKY-Q402 (await in loop), SKY-UC002 (unreachable code)
  • Shannon entropy-based secret detection
  • Smarter attribute resolution, __init__.py re-export tracking
  • Expanded Django/DRF framework dictionaries
  • Go language support

Fixed

  • TUI category list focusable again

[3.4.3] - 2026-02-25

Added

  • Multi-path CLI support (skylos app/ tests/)
  • @abstractmethod suppression, framework dictionaries for Starlette, Flask-RESTful, Tornado, Marshmallow, SQLAlchemy, Celery, Click

Fixed

  • Pattern tracker double-counting, private_name penalty 80→60

[3.4.2] - 2026-02-22

Added

  • Next.js/React TypeScript dead code detection (convention exports, route handlers, hooks)
  • Dynamic dispatch: getattr(module, f"prefix_{var}") and globals() f-string detection
  • __init_subclass__ registry pattern detection, indirect enum inheritance

Fixed

  • Pattern tracker regex compilation, inline f-string handling, enum method/class variable detection

[3.4.1] - 2026-02-21

Added

  • BFS from entry points through import graph for false positive elimination
  • __getattr__ package handling, relative import resolution
  • skylos credits command, MCP server auth + rate limiting + credit deduction

Fixed

  • --trace --json and --pytest-fixtures --json producing invalid JSON

[3.4.0] - 2026-02-18

Added

  • TypeScript: interface, enum, and type alias dead code detection
  • TUI language display and severity bar chart
  • CI/CD visibility: skylos badge command, "30-second setup" in README
  • CBO coupling (SKY-Q701) and LCOM cohesion (SKY-Q702)
  • Architecture metrics: SKY-Q802 (distance from Main Sequence), SKY-Q803 (Zone of Pain/Uselessness), SKY-Q804 (Dependency Inversion violations)

Fixed

  • TypeScript class name capture, regex.exec() false positives, lifecycle method exclusion
  • export default function, export { name }, extends Base tracking
  • Callbacks, array storage, object shorthand, return values, spread, type annotations as references

Changed

  • TypeScript scanner uses Query() constructor instead of deprecated TS_LANG.query()

[3.3.0] - 2026-02-13

Added

  • Remediation agent — skylos agent remediate with --dry-run, --max-fixes, --auto-pr, --test-cmd, --severity
  • CI/CD integration — skylos cicd init|gate|annotate|review
  • MCP server — analyze, security_scan, quality_check, secrets_scan, remediate tools
  • SKY-D230 (open redirect), SKY-D231 (CORS), SKY-D232 (JWT), SKY-D233 (deserialization), SKY-D234 (mass assignment)
  • Sanitizer framework for taint analysis (XSS, CMD, URL, PATH)
  • TypeScript security: SKY-D503 through SKY-D507, SKY-D240 through SKY-D244
  • SKY-L005 (unused exception var), SKY-L006 (inconsistent return), SKY-Q501 (god class)
  • TypeScript quality: SKY-Q601 through SKY-Q604
  • Go language support via pluggable engine architecture
  • Secrets scanning expanded to .env, .yaml, .json, .toml, .ini, .cfg, .ts, .tsx, .js, .go

Fixed

  • import json inside main() shadowing module-level import
  • LLM false-aliving all _-prefixed dead code

Changed

  • Taint-flow scanners accept context-specific sanitizer sets
  • danger.py shares parsed AST tree across scanners

[3.2.5] - 2026-02-09

Fixed

  • exclude_folders wired through run_pipeline and run_static_on_files

[3.2.4] - 2026-02-08

Changed

  • Agent analyze/review refactored from parallel execution to pipeline architecture (static analysis as source of truth, LLM verifies)
  • LLM no longer independently discovers dead code

Added

  • DeadCodeVerifierAgent with call graph evidence and defs_map context
  • pipeline.py with run_pipeline and run_static_on_files

Fixed

  • Circular dependency checker feeding .ts/.go files to ast.parse()

[3.2.3] - 2026-02-07

Fixed

  • Hallucination detection PyPI "missing" status
  • Dependency parsing for pyproject.toml and setup.py (extras, project name inclusion)

[3.2.1] - 2026-02-05

Fixed

  • Import usage counting: aliases no longer mark the wrong module as used

[3.2.0] - 2026-02-05

Added

  • graph.py for taint analysis, data flow, and context slicing
  • FalsePositiveFilterAgent for LLM-based static finding verification
  • CI auto-detection (GitHub Actions, Jenkins, CircleCI, GitLab CI) with PR number extraction
  • Type2 clone detection, circular dependency display
  • CLI entrypoint decorator patterns, post-scan upload CTA, upload prompt with "don't remind me" preference
  • SKY-Q401 (async blocking)

Changed

  • visitor.py with call graph construction and dynamic string reference detection
  • analyzer.py uses CodeGraph for deep security audits
  • Hardened SKY-L001 (catches list(), dict(), set() constructors, comprehensions)

Fixed

  • Parent dir search for pyproject.toml/requirements.txt, dist-info name parsing, Python 3.13 AST compat

[3.1.3] - 2026-01-27

Added

  • Centralized LLM runtime resolver with auto-detection from --model
  • Symbol context tracking in taint visitors
  • skylos key command

Changed

  • Two-level dependency hallucination: SKY-D222 (CRITICAL, confirmed hallucinated) and SKY-D223 (MEDIUM, exists but undeclared)

[3.1.2] - 2026-01-25

Added

  • Console entrypoint parsing from pyproject.toml [project.scripts]
  • --pytest-fixtures flag for unused fixture detection
  • Dependency hallucination detection
  • Custom rules and compliance from web app (beta)

Changed

  • CLI displays paths relative to CWD
  • Switched to uv in CI workflows, litellm adapter, upload made optional

Removed

  • cache.py (unstable outputs), anthropic/openai adapters (replaced by litellm)

[3.1.1] - 2026-01-20

Added

  • --provider, --base-url flags and env variable support for LLM providers
  • Auto API key bypass for local endpoints
  • LLM-assisted detection agent

Fixed

  • --gate uploads before exiting, pre-commit hook exit codes, Protocol interface false positives

Changed

  • OpenAIAdapter uses Chat Completions API, provider resolution priority chain

[3.0.3] - 2026-01-10

Added

  • Protocol and ABC detection with duck typing (≥70% method overlap)
  • Mixin, base class, and framework lifecycle method confidence penalties
  • Data class field detection (dataclass, NamedTuple, Enum, attrs, Pydantic)
  • Optional dependency import handling (try/except ImportError)

Changed

  • # noqa comment support for line-level suppression

[3.0.1] - 2026-01-08

Added

  • --trace flag for runtime call tracing via sys.settrace()
  • Progress indicator during analysis
  • SKY-U002: dead file detection for empty Python files
  • AST body masking, framework-aware entrypoint detection
  • Config-based dead code suppression (pyproject.toml whitelists with patterns, reasons, expiration dates)
  • skylos whitelist command
  • Confidence column in output
  • Expanded soft patterns (visitor, pytest hooks, plugins)

Changed

  • Replaced --coverage with --trace
  • Penalty system: hard entrypoints (confidence=0), framework entrypoints (with context), soft patterns (proportional)

Fixed

  • Flask route detection, @login_required handling, Pydantic route type hints
  • ComplexityRule visitor, Python 3.13 compat, skylos init duplicate config sections

[2.7.1] - 2025-12-23

Fixed

  • Missing skylos.visitors.languages in package, --version crash, pre-commit gate script

[2.7.0] - 2025-12-19

Added

  • Instance attribute type tracking, expanded dunder methods
  • SKY-L004 (nested try blocks), SKY-U001 (unreachable code)
  • --coverage flag, ImplicitRefTracker for dynamic patterns

Fixed

  • Class(1).method(), self.attr.method(), super().method() patterns
  • Flask/FastAPI route false positives

[2.6.0] - 2025-12-05

Added

  • TypeScript support (dead code, security, quality) via tree-sitter
  • Language-specific config overrides in pyproject.toml
  • Multi-provider AI adapters (OpenAI, Anthropic) with keyring credential storage
  • AI-powered code repair (--fix)

[2.5.3] - 2025-11-28

Fixed

  • Exclusion patterns ignored in analyzer, nested directory exclusion support

[2.5.2] - 2025-11-24

Added

  • Quality gate (--gate) for CI/CD pipeline blocking
  • Config support via pyproject.toml [tool.skylos]
  • SKY-C303 (too many args), SKY-C304 (function too long), SKY-L001 (mutable default), SKY-L002 (bare except), SKY-L003 (dangerous comparison)

Fixed

  • Python 3.13 AST crash, JSON serialization of pathlib.Path, DangerousComparisonRule false positives

[2.5.1] - 2025-11-19

Added

  • --tree flag for ASCII tree output
  • Relative file paths in CLI

[2.5.0] - 2025-11-12

Added

  • Code quality scanner: cyclomatic complexity and nesting depth rules

Fixed

  • Dataclass schema class false positives, multi-part module import detection

[2.4.0] - 2025-10-14

Added

  • SKY-D211 (SQL injection), SKY-D217 (SQL raw API), SKY-D216 (SSRF), SKY-D215 (path traversal), SKY-D212 (command injection)

[2.3.0] - 2025-09-22

Added

  • VSCode extension on marketplace
  • Dangerous patterns scanner (SKY-D201 through D210), --danger flag, --table output

Fixed

  • Non-JSON prints breaking CI/CD, secrets regex false positives

[2.2.3] - 2025-09-18

Fixed

  • Interactive remove/comment for dotted imports and class/async methods

[2.2.2] - 2025-09-17

Added

  • Secrets scanning (SKY-S101): provider patterns + high entropy detection, --secrets flag
  • GitHub Actions CI workflow

[2.1.2] - 2025-08-27

Added

  • Dataclass field detection, first_read_lineno tracking, visit_Global binding

Fixed

  • Missing _dataclass_stack init, dataclass/global singleton false positives

[2.1.1] - 2025-08-23

Added

  • Pre-commit hooks

[2.1.0] - 2025-08-21

Added

  • CST-based safe edits for import/function removal via libcst

Changed

  • Visitor improvements: locals and types per function scope, constants handling

Fixed

  • self.attr/cls.attr false positives

[2.0.1] - 2025-08-11

Fixed

  • Framework-aware pass: route endpoints no longer clamped to low confidence
  • _mark_refs() rewritten for clarity

[2.0.0] - 2025-07-14

Added

  • Front end integration (Skylos Cloud dashboard)

[1.2.2] - 2025-07-03

Fixed

  • self.ignored_lines overwrite in loop

[1.2.1] - 2025-07-03

Added

  • Comment directives: # pragma: no skylos, # pragma: no cover, # noqa
  • proc_file() returns 7-tuple with ignored lines set

[1.2.0] - 2025-06-12

Added

  • Framework detection (Flask, Django, FastAPI) with confidence scoring
  • --confidence flag

Fixed

  • Flask/Django routes incorrectly flagged, test file exclusion improvements

[1.1.12] - 2025-06-10

Added

  • Test file auto-detection (patterns, imports, decorators)

Fixed

  • Private item (_-prefix) and __future__ import false positives

[1.1.11] - 2025-06-08

Added

  • --exclude-folder, --include-folder, --no-default-excludes, --list-default-excludes

Fixed

  • Test class identification false positives

[1.0.11] - 2025-05-27

Added

  • Unused parameter and variable detection

[1.0.10] - 2025-05-24

Changed

  • Rewritten from Rust to Python (faster), benchmark infrastructure, confidence system