1.54.0

• pip/pipx installs now ship the native Rust ggshield on common platforms
  (Linux x86-64/aarch64 for glibc and musl, macOS universal2, Windows x86-64); the Python implementation is installed
  alongside as ggshield-py. Platforms without a native wheel fall back to the
  pure-Python wheel, where ggshield is the Python entry point — as does
  Homebrew, which builds from the source distribution.

Added

• Add secret-scanning hook support for Mistral Vibe 2.21 and later. Global and
  project installation preserves existing hooks.toml content and configures
  Vibe's pre_tool and post_tool events.

• A native ggshield-hook binary implements ggshield secret scan ai-hook,
  removing the interpreter startup cost the hook paid twice per tool call. It
  resolves the instance's scan limits from the same places ggshield does
  (GG_MAX_DOC_SIZE / GG_MAX_DOCS, the on-disk auth-check cache, then
  /v1/metadata), so a document or a batch the instance would reject is split or
  skipped instead of failing the scan. It caches what it learns from
  /v1/metadata for five minutes, so a hook path where only the native binary
  runs does not pay that round trip on every scan.

• The native hook now honours the GITGUARDIAN_INSTANCE, GITGUARDIAN_API_URL
  and GITGUARDIAN_API_KEY settings a .env file provides, instead of declining
  to scan when it found one. It reads the file from the same places ggshield does
  (GITGUARDIAN_DOTENV_PATH, then the working directory, then the repository
  root), and gives it the same precedence: a value in the .env overrides the
  same variable already exported in the environment. A self-hosted instance
  configured through a .env is therefore scanned against, rather than left
  unscanned. Two caveats: an unbraced $ in a value is expanded as a variable
  reference (so GITGUARDIAN_API_KEY=abc$def resolves to abc — quote it as
  'abc$def' to keep the $), and a GITGUARDIAN_* line the parser rejects
  still leaves the action unscanned, with a message naming the variable.

• AI discovery now reports, per agent, the email of the assistant subscription that agent is signed into, so a personal
  subscription can be told apart from a company one. Read locally from Claude Code, Codex and Cursor. Mistral Vibe and
  VSCode keep no account on disk and report nothing.

• GGSHIELD_NO_NOTIFICATION suppresses the AI hook's desktop notification. The
  secret is still detected and the tool call still blocked; only the banner is
  withheld.

Changed

• Release binaries are now built with Python 3.14 instead of 3.10, ahead of Python 3.10's
  end-of-life. This also updates the SQLite bundled in the released binaries, fixing
  CVE-2025-6965 and CVE-2025-7709.

• AI hooks no longer call the API twice for the same document. An unambiguously clean
  scan result is cached locally for 15 minutes, keyed on the exact document sent and on
  the instance and token it was sent with, so a file read costs one API round trip
  instead of two (PreToolUse and PostToolUse scan the same file).

• ggshield starts faster: each command now imports only the modules it needs, and
  plugin discovery runs only when a plugin command is actually resolved. This speeds
  up every invocation, in particular the ones that run automatically on every git
  commit (secret scan pre-commit) and on every AI agent tool call
  (secret scan ai-hook).

• ggshield secret scan ai-hook is now much faster on MCP tool calls: the local
  discovery walk is cached for an hour instead of running on every call, and the
  secret scan and the MCP activity call now run concurrently instead of one after
  the other. Measured against a mock API at the production p50 latency, an MCP
  PreToolUse event goes from 1183 ms to 387 ms (p50). Other events are
  unaffected. As a consequence, an MCP tool call is now reported to GitGuardian
  even when the secret scan blocks it.

• AI hooks now scan all the payloads of an event in a single API call instead of one
  call each. A prompt mentioning three files used to cost four round trips; measured
  against a mock API at the production p50 latency, such a UserPromptSubmit goes from
  1561 ms to 395 ms (p50). Single-payload events are unchanged.

• In the standalone packages (.pkg, .deb, .rpm, .msi, Chocolatey, archives), ggshield
  is now a small native dispatcher: it runs ggshield secret scan ai-hook and hands every other
  command to the bundled Python implementation. There is still a single ggshield command, and
  every command behaves as before.

• AI hooks now resolve the file paths of Read tool calls and prompt @-mentions to an
  absolute path against the event's working directory. A file mentioned in a prompt and the
  same file later read by a tool now share one verdict-cache key, so it is scanned once
  instead of twice. As a result, the file path reported in block messages (and sent for
  scanning) is now absolute for prompt-mentioned files.

• The native hook accepts a .gitguardian.yaml key spelled with - or with _,
  but no longer resolves a config that sets the same key in both spellings the
  way the Python implementation does: the last spelling in the file wins. Using
  one spelling per key, which every documented example does, is unaffected.

• When the AI hook blocks, its message now shows the secret.ignored_matches
  entry that would silence it, one line per detected secret. The message censors
  every match, so the entry could not previously be written by hand from what it
  showed. The value shown is the ignore sha, a digest rather than the secret,
  and is the same one ggshield secret ignore --last-found writes.

• ggshield plugin install and ggshield plugin update no longer send an
  installation report to the GitGuardian instance. The endpoint it targeted was
  never implemented, so the call always failed and was silently discarded.

• The GitGuardian logo shipped with ggshield is the refreshed one: the Chocolatey
  package icon uses the solid black mark, and the macOS desktop notification icon
  uses the app icon on its own dark ground.

• ggshield now requires py-gitguardian 1.34.0, which carries the
  AgentInfo.subscription_email field the AI discovery report sends.

Fixed

• On macOS, ggshield no longer triggers the Xcode Command Line Tools install prompt
  when the tools are not installed.

• On macOS, ggshield no longer pops a "Keychain Not Found" dialog when checking
  whether the keyring is usable. The check now only reads from the credential
  store instead of writing a probe entry, which also stops it from silently
  falling back to file-based token storage on machines where the keychain can be
  read but not written.

• ggshield secret scan ai-hook no longer skips the scan when a Bash command starting with
  cat or Get-Content is not a plain file read (a heredoc, a redirection...).
  Such commands are now always scanned as text.

• ggshield secret scan ai-hook now scans only the lines an agent actually reads, instead of
  the whole file. A file over the API's 1 MiB document limit was skipped outright — allowed
  without being scanned at all — even when the agent only read a few hundred lines of it;
  that slice now scans normally. Ranges are read from Claude Code (offset/limit) and
  VS Code (startLine/endLine); a read without a range still scans the whole file.

• The AI discovery is now submitted to GitGuardian only when the local AI/MCP
  configuration actually changed, as it was always meant to be. A type mismatch
  between a freshly discovered MCP configuration and one read back from the local
  cache made the comparison always report a change, so every MCP tool call
  uploaded a full discovery payload.

• When a secret is found in a file mentioned in a prompt (@path), AI hooks now name
  that file in the block message instead of reporting it as a secret "in your prompt".
  The previous wording pointed at the wrong content and asked the user to edit a prompt
  that did not contain the secret.

• On macOS, the token stored by ggshield auth login is now created with a
  Keychain ACL trusting every ggshield binary, so the native hook can read it
  without prompting. Previously only the writing binary was trusted and each
  login reset the ACL, making "Always Allow" wear off.

• On macOS, ggshield no longer asks for Keychain access again after every upgrade. The
  code-signing identifier embedded a per-build hash, so the "Always Allow" grant recorded
  for one release stopped matching the next one; it is now pinned to
  com.gitguardian.ggshield. One grant made from a release built with this fix onwards
  keeps working across upgrades.

• The AI hooks no longer create incidents on your dashboard when secret.source_uuid is set
  in your configuration (a setting shared with CI scanning): a hook event is not a source
  scan, and every prompt and every file the agent read was creating an incident. They also
  now always scan with all_secrets, so they can block on a secret that is already known to
  GitGuardian instead of letting it through.

• tomli was added to the dev dependency group, without a marker, so dev environments always have it regardless of the
  Python interpreter, and ty can resolve the fallback branch it insists on analyzing

• secret scan ai-hook now honours secret.ignored_paths from
  .gitguardian.yaml, as every other secret scan command already did. A file
  excluded there is no longer read, sent, or blocked on when an agent reads it.
  Previously the setting was silently inert on this path. ignored_matches and
  ignored_detectors were never affected. This also brings the default
  exclusions to the hook: reads under node_modules/, .venv/, vendor/,
  .git/ and the other IGNORED_DEFAULT_WILDCARDS entries are no longer
  scanned. Those defaults are matched against the path relative to the project
  and with symlinks resolved, so a checkout that itself lives under a directory
  named vendor/, node_modules/ or .venv/ is still scanned normally, and a
  symlink parked in a vendored tree cannot hide a file living outside it.

• On macOS, ggshield auth login no longer writes the token straight to the
  Apple Keychain when PYTHON_KEYRING_BACKEND selects another backend: the write
  now follows the backend the token is read back from. Previously login reported
  success while nothing could authenticate afterwards.

• keyring now requires 25.0 or later, the first version carrying the
  create_cf binding the Keychain ACL is built with. On 24.x the ACL silently
  never applied.

• AI discovery no longer reports MCP server configurations for agents that are not
  installed. A project .mcp.json is read by several agents, and Copilot also declared a
  hardcoded GitHub MCP server, so machines without those agents reported configurations
  they could not run.

• On macOS and Windows, ggshield now finds VSCode's user directory, so its global MCP
  servers and its known workspaces are discovered there too.

• The cryptography shipped in the released binaries is now 50.0.0, fixing
  CVE-2026-69247, a Bleichenbacher oracle in PKCS#7 EnvelopedData decryption.
  ggshield does not use that code path.

• The AI hook installed from the macOS standalone package now points at
  /usr/local/bin/ggshield instead of the versioned /opt/gitguardian/ggshield-<version>/
  directory an upgrade removes, so it keeps scanning after an upgrade.

• ggshield machine setup now repoints an AI hook command whose ggshield binary is gone,
  or is reachable through a more stable path, instead of leaving the broken command in
  place.

• On macOS, ggshield machine setup now asks the Keychain for access as the binary
  that actually runs the AI hook. Keychain grants are per binary, so the hook used to
  raise its own authorization dialog inside an agent-spawned process, where the agent's
  timeout could kill it before "Always Allow" was recorded and the dialog came back on
  every prompt.

• ggshield no longer reads the OS credential store on startup. The token is now
  fetched when a command actually needs it, so commands that do not use one (such as
  ggshield config list, ggshield plugin list and ggshield install) no longer
  trigger a macOS Keychain password prompt.

• ggshield secret scan ai-hook no longer leaves a whole event unscanned when the file path
  it guessed from a Bash command or an @-mention cannot be read. Such a candidate is
  dropped instead of being sent to the scanner, where the read error aborted the event and
  allowed the action with a "could not scan" warning, so the command or prompt text of that
  same event is now always scanned. A candidate longer than the filesystem's limits (a
  heredoc mistaken for a file name) is also recognized as text without a filesystem call.