v1.16.1

1.16.1 - 2026-10-01

• CI and publication read the Bun version from package.json. Bundle builds
  reject mismatched Bun runtimes before writing output. This release supersedes
  the unpublished 1.16.0 tag, whose gate rejected a bundle built with another Bun version.

• Bounded evidence scheduling, source selection, local discovery and ecosystem
  acquisition are separated from one common secure remote artifact reader.
  Successful Go, Nix, Zig and Hex integrity checks are retained in artifact receipts.

• Cancelled replay saves no snapshot; replay accepts the supported two MiB
  license-file bound while retaining the overall snapshot size limit.

• Inspection execution, shared scan result summaries, HTML markup and browser
  filtering have separate module owners while retaining existing report contracts.

• A bounded offline benchmark compares cold, warm and offline artifact caches
  in fresh processes, measuring collection, nested gzip decompression, license
  normalization, rendering and peak memory without external network traffic.

• Scan and CI save bounded inspection snapshots and replay their graph and
  extracted evidence under current policies without artifact collection or
  network access. Input and payload digests, rule versions, artifact receipts,
  production-only scope and repository coverage survive offline reevaluation.

• Evidence collection can capture bounded content receipts separately from
  successful declared-integrity checks, including cache, revalidation, network
  and local retrieval. Requested HTTP origins omit credentials, query and fragment.

• Yarn classic inputs receive a bounded token preflight before the external
  parser, rejecting unterminated strings and accepting end-of-file comments
  without entering the dependency's unbounded lexer loops.

• Parser boundary tests cover all registered input kinds with bounded seeded
  mutations, structural graph invariants, and retained synthetic failure inputs
  for deterministic reproduction. Archive readers use the same seeded corpus
  under explicit entry and decompression limits.

• --require-complete-graph and the corresponding Action input independently
  gate scan, CI, and both diff revisions on known dependency relationships.
  Partial-evidence overrides cannot bypass this requirement. Report schema 3.9
  exposes the graph gate in JSON, SARIF and CycloneDX; human reports and step
  summaries preserve the outcome.

• Review decisions use package coordinates, usage profile, production-only
  selection, and dependency type/scope independently of display paths. New
  decisionFingerprint waivers opt into this bounded identity; legacy ID and
  fingerprint waivers retain their existing scope. Diff and baseline checks use
  decision keys when present, while provenance-only changes remain visible
  without introducing risk. Report schema 3.8 and waiver/baseline schema 1.1
  describe this contract. Older baselines remain readable without automatic
  conversion of their reviewed keys; report-configuration changes require review.

• Adapters declare relationship reconstruction, development-scope detection
  and retained artifact pins for every supported input kind. Report schema 3.7
  exposes the support boundary separately from actual inspection completeness
  in scan/diff JSON, SARIF and CycloneDX; scan summaries show it as well. A
  generated support matrix stays synchronized with registered adapters. Baseline
  schema configuration changes require review; summaries still accept 3.5/3.6.

• Finding decisions ignore ordinary evidence-source labels and file renames
  while retaining license meaning, confidence, scope, component terms and
  conflicts. Waivers, diffs and packaged baselines share comparison with older
  semantic fingerprints; opaque legacy fingerprints remain exact. Dependency
  path changes still require review through the existing finding IDs.

• SBOM imports preserve public PURL qualifiers and subpaths in package identity,
  preventing architecture, distribution, and file-specific coordinates from
  collapsing into one finding. Qualifier order is canonical; authentication
  material is omitted from public identity and reports. Unqualified IDs are
  unchanged; waivers for previously collapsed qualified packages require review.

• Held-out release evaluation requires reviewed SPDX semantics, choices,
  exceptions, evidence signals, and package/component scope in addition to
  severity and confidence. Reports distinguish semantic mistakes, risk under-
  and over-classification, and decisions deferred for insufficient evidence.

• npm, pnpm, and uv source edges and reachable package records survive bounded
  display-path truncation. Independent source traversal retains cycles and
  scoped relationships, reports missing pnpm/uv records, and fails explicitly
  at graph resource limits. npm v1 inferred roots and opaque pnpm links remain
  distinguishable from proven complete relationships.

• npm v1 and modern lockfiles retain missing required dependency requests and
  mark name-based installation recovery unproven. These requests survive graph
  merging, input reordering, and bounded display paths, and make CI and gated
  diffs partial even when no package evidence fetch failed. Optional dependencies
  and optional peers may be absent; production scans exclude development-only
  missing requests.

• Inspection completeness separates input, dependency relationships, evidence
  collection, and license identification. JSON scan and diff sides share the
  same contract, with matching state in SARIF and CycloneDX metadata.

• Merged package artifacts no longer select the first input when locations or
  checksums conflict. Unresolved identities are unavailable evidence and produce
  a structured artifact_identity_conflict diagnostic, so strict CI and diff
  gates reject them. Equal supported digest encodings permit deterministic
  mirror collection with normal archive integrity verification.

• Release verification uses the global 82% line and 90% function coverage gate
  consistently across Bun versions. Installed package smoke tests check the
  current report schema 3.9 exports.

• Mixed-ecosystem scans and SBOM inputs now keep packages with the same name
  and version separate, including their paths, license evidence, and findings.
  Existing waivers for formerly colliding package IDs require review.

• npm lockfile resolution checks every ancestor installation before selecting
  a hoisted root package, including scoped packages and npm aliases.

• Gated diffs reject incomplete evidence from either revision unless explicitly
  allowed. Report schema 3.6 records each side's completeness and gate status;
  report summaries retain partial comparison failures.

• The bundled GitHub Action forwards allow-partial-evidence for ci and
  diff, and its documentation describes informational and gated comparisons.

• CycloneDX, SPDX, and Nix inputs retain source dependency edges independently
  of bounded display paths. CycloneDX output distinguishes unknown adjacency
  from explicit leaves, including XML composition declarations. Production
  filtering preserves reachable packages when their saved display paths omit
  the production route.