v5.1.2

5.1.2 (2026-11-05)

Bug Fixes

• hooks: wait the library default of 5 s for a judge review (#573) (75c6123)

v5.1.1

5.1.1 (2026-11-05)

Bug Fixes

• detection: never cache or score an unusable call-text vector (#572) (b95c2a7)
• mcp: fail closed when the detection pipeline throws (#570) (204e949)

v5.1.0

5.1.0 (2026-11-04)

Features

• approvals: semantic approvals that can only add approvals (#569) (38af348)
• detection: report detectors that did not run as configured in each scan (#565) (6fc3ffa)

v5.0.0

5.0.0 (2026-11-04)

⚠ BREAKING CHANGES

• AI.Sentinel.ClaudeCode.Cli, AI.Sentinel.Copilot.Cli and AI.Sentinel.Mcp.Cli target net10.0 only and need the .NET 10 SDK to install.

Features

• approvals: post a webhook when an approval request is created (#556) (99548df)
• cli: approve and deny from sentinel dashboard (#558) (d9bc1c5)
• native AOT builds of sentinel-hook, sentinel-copilot-hook and sentinel-mcp (#553) (9f1a486)

Bug Fixes

• keep the net8.0 TestHost line out of the Renovate pin (#560) (e480040)

v4.2.0

4.2.0 (2026-10-31)

Features

• scan budget — new messages only, MaxScanBytes, fail closed on oversize and regex timeouts (#546) (beae3de)
• session history and drift escalation (#551) (d665340)

v4.1.1

4.1.1 (2026-10-30)

Bug Fixes

• aspnetcore: redirect the dashboard prefix to its trailing-slash URL (#539) (3ad730c)

v4.1.0

4.1.0 (2026-10-30)

Features

• detectors: re-tune SEC-01, SEC-05 and SEC-09 for paraphrased attacks (#535) (474c8bf)
• detectors: review bands for CMP-01 to CMP-04, re-tuned CMP-03 and CMP-04 examples (#538) (182de91)

v4.0.0

4.0.0 (2026-10-30)

⚠ BREAKING CHANGES

• detection: a semantic detector's embedding result is capped at Medium unless a reviewer verdict confirms a higher severity; regex fast-path matches keep their severity, a configured SeverityFloor raises the cap to the floor, and DetectorConfiguration.CapSemanticSeverity = false restores the uncapped severity per detector. SemanticDetectorBase.ReviewCriterion is abstract and ILlmEscalatingDetector has a ReviewCriterion member, so custom detectors must state what they look for. EscalationClient is now shorthand for an LlmJudgeReviewer that also judges semantic hits and near misses, so a verdict can turn a near miss into a finding; reviews run concurrently within MaxReviewsPerScan, default 4, and ReviewTimeout, default 5 s, a failure logs a warning, and a reviewed reason reads "detector reason — Reviewed: outcome — reviewer reason". The CLI hosts read SENTINEL_REVIEW_* to configure a reviewer, with a 3 s timeout in the hooks. See the Migrating to 4.0 page.

Features

• detection: embedding hits become triage, confirmed by a pluggable second-stage reviewer (6435b34)

Bug Fixes

• review: send temperature only when the caller sets one (#532) (271d8ad)

v3.9.0

3.9.0 (2026-10-30)

Features

• detectors: SEC-24 detects tag-character and variation-selector smuggling (#517) (e6609d2), closes #441

Bug Fixes

• detection: embed each text once per scan, on each pipeline's own generator (#520) (3da797c)
• keep the generated authorization registration internal in every package (#513) (a10fa24), closes #512
• read the LLM escalation verdict from its severity field and fence the flagged content (#515) (5d6ea26)

v3.8.0

3.8.0 (2026-10-29)

Features

• use an embedding generator registered in DI when none is configured (#509) (2cbab2e)