v2.6.0

What's Changed

• fix(release): generalize floater handling to vX/vX.Y tags by @IkarusAILabs in #212
• Build(deps): bump github/codeql-action/upload-sarif from 4.38.1 to 4.38.2 by @dependabot[bot] in #215
• Build(deps): bump github/codeql-action/analyze from 4.38.1 to 4.38.2 by @dependabot[bot] in #216
• fix(ci): align codeql-action init/autobuild to 4.38.2 by @IkarusAILabs in #217
• feat(reporting): security_brief layer + decision-support HTML sections by @IkarusAILabs in #218
• feat: add Microsoft Teams Integration #182 by @therealestbenji in #219
• test(exceptions): pin the scope-escape boundaries; gate unverified scope (#196) by @ARAVIND281 in #220
• docs(roadmap): re-baseline around Agent Authority Evidence research programme by @IkarusAILabs in #221

New Contributors

• @therealestbenji made their first contribution in #219

Full Changelog: v2.5...v2.6.0

v2.5.0

What's Changed

• docs(readme): badge tracks v2.4.0 release by @ikaruscareer in #194
• fix(ci): bump codeql-action in lockstep to 4.38.1 by @ikaruscareer in #195
• docs(gfi): index security review & test issues #196-#201 by @ikaruscareer in #202
• fix: sanitize untrusted text in PR comment renderer by @HarshRajSinghania in #204
• fix(report): sanitize terminal output against ANSI/OSC injection by @chenzeyan54-commits in #203
• feat(v2.5): IaC authority evidence, Lane B by @ikaruscareer in #205
• Add security audit tests for release workflow (fixes #201) by @thadidaniel-ctrl in #206
• docs(credits): recognize five uncredited contributors by @ikaruscareer in #207
• chore(release): bump version to 2.5.0 by @ikaruscareer in #208
• fix(release): dynamic tag version in check_release.py by @ikaruscareer in #209

New Contributors

• @HarshRajSinghania made their first contribution in #204
• @chenzeyan54-commits made their first contribution in #203
• @thadidaniel-ctrl made their first contribution in #206

Full Changelog: v2.4.0...v2.5.0

v2.5.0

fix(release): skip pipeline gracefully on floating v2 tag pushes (#211)

* fix(release): dynamic tag version in check_release.py (was hardcoded 2.4.0)

Signed-off-by: Ikarus Career Tech <ikaruscareer@gmail.com>

* docs(readme): badge tracks v2.5.0 release

Signed-off-by: Ikarus Career Tech <ikaruscareer@gmail.com>

* fix(release): skip pipeline gracefully on floating v2 tag pushes

Signed-off-by: Ikarus Career Tech <ikaruscareer@gmail.com>

---------

Signed-off-by: Ikarus Career Tech <ikaruscareer@gmail.com>
Co-authored-by: Winters <2954677+WintersCoder@users.noreply.github.com>

v2.4.0

What's Changed

• docs(roadmap): v2.3.0 shipped by @ikaruscareer in #172
• fix(ci): skip version-match check for floating v2 tag by @ikaruscareer in #173
• test(benchmarks): document static subprocess precision limitation by @Teachmeplaycode in #174
• feat: show policy profile in reports by @nikitajos7 in #175
• docs: credit new contributors by @ikaruscareer in #176
• feat(report): add architecture component diagram to HTML reports by @ikaruscareer in #178
• docs: audit good-first-issues against current codebase by @ikaruscareer in #177
• docs(roadmap): integrate AI-governance assessment direction by @ikaruscareer in #179
• docs(roadmap): fix three stale planned markers by @ikaruscareer in #180
• Build(deps): bump sigstore/cosign-installer from 3.10.1 to 4.1.2 by @dependabot[bot] in #188
• Build(deps): bump github/codeql-action/upload-sarif from 4.38.0 to 4.38.1 by @dependabot[bot] in #186
• Build(deps): bump build from 1.5.0 to 1.6.1 by @dependabot[bot] in #183
• Build(deps): bump urllib3 from 2.7.0 to 2.8.0 by @dependabot[bot] in #184
• docs: strategic reorientation around Agent Authority Security by @ikaruscareer in #190
• feat(v2.4): ChangeGuard lanes + evidence hardening (WS1-WS5) by @ikaruscareer in #191
• fix(ci): pin cosign-release to v2.6.1 explicitly by @ikaruscareer in #192
• feat(v2.4.x): security architecture hardening (WS1-WS11) by @ikaruscareer in #193

New Contributors

• @Teachmeplaycode made their first contribution in #174
• @nikitajos7 made their first contribution in #175

Full Changelog: v2.3.0...v2.4.0

v2.3.0

What's Changed

• feat(cli): add --digest-file to export a detached manifest digest sidecar by @burakeyler in #148
• Build(deps): bump sigstore/cosign-installer from 3.8.1 to 4.1.2 by @dependabot[bot] in #153
• Build(deps): bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.0 by @dependabot[bot] in #149
• fix(ci): pin all pip installs by hash in release workflow by @ikaruscareer in #154
• fix(ci): pin all transitive build deps by hash by @ikaruscareer in #157
• feat(adapters): add OpenClaw and Copilot config adapters by @YaoSong808 in #159
• docs: credit community contributors for PRs 148 and 159 by @ikaruscareer in #160
• Add multi-framework scan automation script by @Karthik9849309055 in #161
• docs(roadmap): re-baseline around five outcomes by @ikaruscareer in #163
• feat(ce23): plugin SDK and rule ecosystem (WS1-WS7) by @ikaruscareer in #164
• docs(release): align public surfaces with v2.2.1 by @ikaruscareer in #165
• release: v2.3.0 (CE 2.3 Plugin SDK and Rule Ecosystem) by @ikaruscareer in #168
• fix(ci): pin full transitive closure in requirements-test.txt by @ikaruscareer in #169
• fix(ci): pin py3.11-only transitive build deps by @ikaruscareer in #170
• fix(ci): pin cosign-installer to v3.10.1 (cosign v2.6.1) by @ikaruscareer in #171

New Contributors

• @burakeyler made their first contribution in #148
• @YaoSong808 made their first contribution in #159
• @Karthik9849309055 made their first contribution in #161

Full Changelog: v2.2.1...v2.3.0

v2.2.1

Full Changelog: v2.2.0...v2.2.1

v2.2.0

Full Changelog: v2.1.2...v2.2.0