v6.0.0

[6.0.0] — 2026-07-07

Added

• Supply Chain Guard M1-M3 checks for dependency trust drift, package metadata suspicion, and install-time execution behavior, enabled with scan --supply-chain-guard.
• calvigil supply-chain diff for comparing baseline and target JSON reports to flag new direct dependencies, downgrades, possible dependency-confusion names, and lockfile drift.
• AI slop code-smell scoring for OSS scans. Existing AI-SEC pattern findings, Semgrep AI code-quality findings, and optional AI enrichment indicators now roll up into slop_code_smells in JSON plus table and HTML report summaries.
• Documentation and examples explaining that slop code smells are concrete quality/security symptoms, not proof of AI authorship.
• Five new AI-SEC pattern signals informed by current secure-coding research and standards:
  • AI-SEC-019 external HTTP requests without explicit timeout or abort signal.
  • AI-SEC-020 fail-open error handling that returns success/allow/true after failures.
  • AI-SEC-021 temporary security bypass comments around auth, CSRF, validation, sanitization, or access control.
  • AI-SEC-022 unbounded Go goroutine fan-out without an obvious limiter.
  • AI-SEC-023 Go HTTP servers started without read/write/idle timeout configuration.
• Configurable regex pattern rule packs via --pattern-rules, with YAML/JSON file or directory support, duplicate-ID validation, severity validation, RE2 compilation checks, and project-local trust guardrails.
• Community-aligned Semgrep rule pack with 27 original Calvigil rules for framework, JWT, TLS, deserialization, C/C++, PHP/Ruby, Dockerfile, and shell supply-chain patterns.
• Bundled Semgrep rule integrity tests that parse every rule pack, enforce required fields, validate severity values, and prevent duplicate rule IDs.

Changed

• Built-in regex pattern coverage increased from 47 to 52 rules: 29 general SEC-* rules and 23 AI-SEC-* code-quality/security signals.
• AI slop code-smell scoring now maps additional timeout, fail-open, insecure-default, validation, and secret-exposure rules into the summary categories.
• Bundled Semgrep coverage increased from 74 to 101 rules across four packs after comparing Calvigil's gaps with the public semgrep/semgrep-rules repository structure.

Fixed

• Corrected malformed bundled Semgrep YAML in existing packs so all shipped rules parse cleanly in automated tests.

v5.3.0

Full Changelog: v5.2.0...v5.3.0

v5.2.0

[5.2.0] — 2026-06-19

Added

• Regular JSON scans now enrich package inventory licenses before reporting or Enterprise push, not only during scan-license.

Changed

• NVD matching and CVSS enrichment are more resilient:
  • Default dependency, image, and binary scans include NVD package keyword search again, capped at 20 unique package names and conservatively paced.
  • Exact-CVE enrichment uses up to 100 cveIds per request, a 2-minute request timeout, a 10-minute enrichment budget, controlled keyed parallelism, six-second request pacing, transient-error backoff, and a 24-hour local CVE cache.
  • Timed-out or 503 CVE batches split down to individual CVE lookups so partial successes are preserved.

Fixed

• Report upload validation now rejects non-JSON and empty scan reports before Enterprise submission.
• NVD CVSS enrichment now falls back to contributed CVSS metrics such as CISA-ADP when NVD/NIST primary scoring is not yet available.
• OSV Go advisories that alias CVEs now receive CVSS score/severity enrichment when the ecosystem-specific OSV record omits CVSS data.
• PyPI license resolution now reads version-specific license_expression metadata, normalizes PyPI license classifiers, and recognizes canonical full license text. This fixes packages such as pkg:pypi/zstandard@0.25.0, pkg:pypi/tiktoken@0.12.0, and pkg:pypi/pathspec@1.1.1 that previously appeared as unknown.

v5.1.0

Added

• calvigil push: Upload an existing JSON scan report to Calvigil Enterprise.
  • Supports Enterprise URL/API key via flags, config, or environment variables.
  • Supports CI metadata: project, ref, commit, environment, CLI version, and idempotency key.
  • --fail-on-policy evaluates the Enterprise policy gate before storing and exits non-zero without consuming quota on policy failure.
  • --evaluate-only checks policy without storing the scan.
• Enterprise config keys: enterprise-url, enterprise-key; env vars:
  CALVIGIL_ENTERPRISE_URL, CALVIGIL_API_KEY, and CALVIGIL_ENTERPRISE_API_KEY.
• NVD CVSS enrichment for already-matched CVEs:
  • Uses the NVD cveIds batch parameter with up to 100 IDs per request.
  • Fills missing score and severity on OSV/other-source findings while preserving the original match source.
  • Fixes Go advisory cases where an OSV GO-* record aliases a CVE but does not include CVSS data.

v5.0.0

Added

• Sonatype OSS Index matcher: New always-on vulnerability database alongside OSV.dev
  • PURL-based component-report API covering all supported ecosystems
  • Works anonymously; optional free account raises rate limits
  • Config keys: ossindex-user, ossindex-token; env vars: OSSINDEX_USER, OSSINDEX_TOKEN
• CISA KEV enrichment: Findings are checked against the CISA Known Exploited
  Vulnerabilities catalog after matching
  • Exploited findings flagged ⚠ KEV in table output and counted in the scan summary
  • New known_exploited field on vulnerability records in JSON/report output
  • Best-effort: feed failures never alter scan results
• Canonical Data Model (internal/matcher/canonical.go): all sources are
  normalized into one consistent shape before reporting
  • CVE IDs preferred as primary identifier; GHSA/ecosystem IDs demoted to aliases
  • Cross-source merge: duplicate findings (matched by ID or alias) are merged
    instead of dropped — missing severity, CVSS score, fix version, summary, and
    references are filled in from whichever source has them
• --skip-tests flag: exclude test files from reachability analysis
• LM Studio Support: New AI provider for running local LLMs via LM Studio
  • OpenAI-compatible /v1/chat/completions endpoint (default: http://localhost:1234)
  • Full code analysis and vulnerability enrichment support (same capabilities as Ollama)
  • CLI flags: --provider lmstudio, --lmstudio-url, --lmstudio-model
  • Config keys: lmstudio-url, lmstudio-model
  • Environment variables: LMSTUDIO_URL, LMSTUDIO_MODEL
  • Auto-detection in --provider auto mode (tried after Ollama, before OpenAI)
  • Availability check via /v1/models endpoint
• AI-Generated Code Detection: 18 new pattern rules (AI-SEC-001 through AI-SEC-018) targeting anti-patterns commonly introduced by AI code generators (Copilot, ChatGPT, Claude, etc.)
  • Resource leak detection: unclosed HTTP response bodies, files/connections opened in loops (CWE-404)
  • Race condition detection: concurrent map access without sync, goroutine loop variable capture (CWE-362)
  • Inefficient algorithm detection: O(n²) nested loops, string concatenation in loops (CWE-400, CWE-407)
  • Error handling anti-patterns: ignored error return values, overly broad exception handlers (CWE-252, CWE-396)
  • Deprecated API usage: ioutil (Go), distutils (Python), Buffer() (Node.js), Thread.stop (Java) (CWE-477)
  • Insecure defaults: overly permissive file permissions (0777/0666), hardcoded server addresses (CWE-732, CWE-547)
  • Unbounded data loading: SELECT * without LIMIT, ReadAll on request bodies (CWE-770)
  • Missing input validation: unchecked type conversions from user input (CWE-20)
  • Sensitive data in logs: passwords, tokens, API keys in log output (CWE-532)
  • Missing timeouts: HTTP/DB calls with context.Background() instead of timeout context (CWE-400)
  • Synchronous crypto in Node.js event loop: pbkdf2Sync, scryptSync (CWE-400)
  • Template literal SQL injection in JavaScript/TypeScript (CWE-89)
  • State-changing endpoints without CSRF protection (CWE-352)
• Semgrep AI Code Quality Rule Pack: New rules/semgrep/ai-code-quality.yaml with 25+ semantic rules for deep AST-level detection of AI-generated code issues across Go, Python, Java, and JavaScript/TypeScript
• AI Code Indicator in Enrichment: AI enrichment layer now classifies findings as LIKELY_AI, POSSIBLY_AI, or UNLIKELY_AI to help teams identify AI-generated code risks
• Enhanced AI Prompts: System and enrichment prompts updated to specifically target AI-generated code fingerprints (boilerplate security disabling, missing cleanup, naive implementations)
• CHANGELOG.md: This file, for tracking changes date-wise going forward

Changed

• Vulnerability aggregation now merges duplicate findings across databases (by ID or alias)
  instead of keeping only the first occurrence — reports may show richer data for the same finding
• AIEnrichment model now includes AICodeIndicator field for AI-generated code classification
• aiEnrichmentResult struct updated with ai_code_indicator JSON field
• HTML reporter displays AI code indicator alongside enrichment details
• Table reporter shows [AI-Generated: LIKELY_AI] tag in enrichment output
• Pattern rule count increased from 29 to 47 (29 SEC + 18 AI-SEC)
• Semgrep bundled rule packs increased from 52 to 77+ rules (3 YAML files)

Fixed

• UNKNOWN severity appearing when a source omitted a severity label:
  • OSV: severity now derived from CVSS v3 → v4 → v2 vectors (top-level and per-affected)
  • GitHub Advisory: falls back to numeric CVSS score when the label is missing
  • Canonical normalization derives severity from CVSS score as a last resort

v4.3.0

Full Changelog: v4.2.0...v4.3.0

v4.2.0

Full Changelog: v4.1.0...v4.2.0

v4.1.0

Full Changelog: v4.0.0...v4.1.0

v4.0.0

Full Changelog: v3.1.0...v4.0.0

v3.1.0

Full Changelog: v3.0.0...v3.1.0