v0.2.0

What's Changed

Other Changes

• Add changed_files context collector for scoping reviews to uncommitted work by @MrPunyapal in #18
• Add --dirty scope to auditor:report and auditor:ci by @MrPunyapal in #19

Full Changelog: v0.1.7...v0.2.0

v0.1.7

What's Changed

Dependencies

• Update laravel/mcp requirement from ^0.7.1|^0.8.0|^0.9.0 to ^1.0.0 by @dependabot[bot] in #15

Other Changes

• Add architecture code-smell catalog by @MrPunyapal in #16
• Bootstrap self-audit tracker by @MrPunyapal in #17

Full Changelog: v0.1.6...v0.1.7

v0.1.6

Added

• custom_agents config so you can wire any installer agent from config (guidelines, skills, optional JSON/TOML MCP, detection markers). Unknown --agents values warn and are skipped.
• database_schema now includes foreign keys (name, columns, foreign_schema, foreign_table, foreign_columns, on_update, on_delete).

Fixed

• database_schema scopes tables to the connection's current schema. On MySQL, unscoped getTables() was returning every visible database.
• composer audit failures now include the exit code and stderr instead of reporting no parseable JSON output.

v0.1.5

Added

• Deep performance audit expansion: 14 new performance rules — AUD-PER-008 through AUD-PER-018 (materialized aggregates, PHP-vs-database filtering/sorting, relationship count/existence loading, queries inside loops, unbounded retrieval, over-selection of columns, repeated external HTTP calls, repeated/unbuffered filesystem work, unbounded job data and oversized payloads, rendering-path queries, avoidable intermediate collections) plus ecosystem-gated AUD-LW-003 (Livewire render/update cost), AUD-FIL-003 (Filament table/form database work), and AUD-IN-003 (Inertia shared props). Every rule carries evidence requirements, false-positive considerations, and semantic-equivalence verification guidance.
• Rewritten laravel-audit-performance skill teaching the full investigation pipeline (signal → context → behavior → verification → impact → finding) with a worked example and its counter-example (get()->count() flagged only when the collection has no other consumer), severity-by-impact guidance, mechanism-based impact statements, and a 20-point performance checklist.
• New guidelines/performance.md (+ Boost mirror) defining the performance finding contract: mandatory semantic-equivalence verification, structured metadata.impact (resource/mechanism/amplification), no invented benchmarks, and a noise floor.
• Performance example finding (F-2026-0002) in the packaged examples demonstrating rule mapping, verification notes, and impact metadata; rendered by auditor:report --example.
• Dedicated performance audit prompt in the prompt examples docs.
• Tests covering the new catalog: schema completeness, evidence-first/noise guards, package gating for the ecosystem rules, command-level domain scoping, and example report rendering.
• Optional read-only filter arguments on the four highest-volume context tools: routes (uri, name, action, method), models (class, table), database_schema (table), and dependencies (package). Calling a tool without arguments returns the same payload as before; filtered responses keep every documented field and add filtered and total_count. Unknown filters are rejected instead of silently ignored, and the dependencies filter never narrows composer audit advisory data.

Fixed

• Findings may now omit rule_id when no catalog rule matches, as the audit skill already teaches. Finding::fromArray() no longer fails on a missing key, finding.schema.json no longer lists rule_id as required, and the Markdown/Text/SARIF renderers handle unmapped findings (unmapped label or omitted SARIF ruleId).

Changed

• MCP tool output is now compact JSON instead of pretty-printed JSON. No field was added, removed, or renamed — only indentation whitespace is gone.
• AUD-PER-006 description now defers to the specific rules (AUD-PER-008, AUD-PER-009, AUD-PER-012) when they match. Severity and confidence are unchanged.
• Documentation rule counts updated from 61 to 75.

Full changelog: v0.1.4...v0.1.5

v0.1.4

What's Changed

Dependencies

• Bump actions/configure-pages from 5 to 6 by @dependabot[bot] in #2
• Bump actions/upload-pages-artifact from 3 to 5 by @dependabot[bot] in #3
• Bump actions/setup-node from 4 to 7 by @dependabot[bot] in #4
• Bump actions/checkout from 4 to 7 by @dependabot[bot] in #5
• Bump actions/deploy-pages from 4 to 5 by @dependabot[bot] in #6

Other Changes

• MCP context: up to 93% smaller payloads, focused filters, honest findings by @MrPunyapal in #7

New Contributors

• @MrPunyapal made their first contribution in #7
• @dependabot[bot] made their first contribution in #2

Full Changelog: v0.1.3...v0.1.4

v0.1.3

What's Changed

Other Changes

• Default context.composer_audit to on by @mathiasonea in #1

New Contributors

• @mathiasonea made their first contribution in #1

Full Changelog: v0.1.2...v0.1.3

v0.1.2

Compatibility release. No public command, config key, MCP tool name, or rule ID was removed.

Laravel Auditor is meant to stay backward compatible. Breaking changes will be rare and would require a major version.

Fixed

• Standalone and Boost security skills are now identical and cover CSRF, XSS, raw SQL, and dependency advisories
• Guidelines list all 11 context tools, including subsystems
• laravel-audit writes findings JSON, ranks metadata.priority, and renders via auditor:report / auditor:ci
• OpenCode is detected from opencode.json / opencode.jsonc only
• Collectors find workbench/application paths for migrations, tests, subsystems, and project_info signals
• configuration reports file and top-level keys; tests lists test files only
• MCP and SARIF versions come from the installed Composer package

Added

• Boost guidelines for findings and DSA
• Standalone laravel-auditor-development skill
• Written compatibility policy in the README and SCOPE

v0.1.1

Installer, MCP, and collector fixes.

Fixed

• auditor:install no longer wires every supported agent when none are configured or detected
• Copilot detection no longer treats a .github or .vscode directory as proof the agent is in use
• MCP config writes honor --force and no longer overwrite an existing laravel-auditor entry by default
• Codex TOML MCP registration no longer appends a duplicate block on every install
• composer audit and pest --list-tests are off by default so MCP and context collection stay local
• project_info now reports whether a package is a Composer dev dependency correctly
• vendor:publish and auditor:status honor resources_target instead of assuming .ai
• MCP server registrations pass -q so Artisan boot output cannot break stdio framing
• Docs "Edit this page" links now point at md/ sources instead of missing repo-root files

v0.1.0

Initial release of Laravel Auditor.

What's included

• Evidence-based audit methodology with 6 core domains
• 61 evidence-first rules across security, performance, architecture, database, testing, and conventions
• 11 read-only context collectors exposed as MCP tools
• 8 agent skills, 3 guidelines, standalone installer
• Finding schema with severity, confidence, evidence, and P0-P3 priority tiers
• Report renderers: Markdown, JSON, CLI text, SARIF
• CI gating with configurable severity threshold
• Docsmith documentation site
• Support for OpenCode, Claude Code, Cursor, Copilot, Gemini, Codex, Junie, and Zed