Release v1.15.0

Nox v1.15.0 (2026-07-25T11:33:56Z)

Language-agnostic security scanner with first-class AI application security.

Installation

macOS/Linux (Homebrew)

brew tap felixgeelhaar/tap
brew install nox

Direct Download

Download the appropriate archive for your platform from the assets below.

What's Changed

Changelog

Features

• d13f06a feat(mcp): baseline MCP server manifests and detect drift (rug-pull) (#322)
• bd9c4da feat(metamorphic): corpus-wide rule-bug oracle (sweep + scheduled audit) (#324)
• 6aff1a6 feat(slop): predictive slopsquat feed (SLOP-002) — offline, signed, default-safe (#323)
• 385d69b feat(taint): role-aware AI prompt-injection (TAINT-AI-001 / AGENTFLOW-001) (#319)

Bug Fixes

• d7561d7 fix(ci): harden nox's own workflows and images, waive what is deliberate (#309)
• 0ba57de fix(deps): bump brace-expansion past GHSA-mh99-v99m-4gvg (restores grade A) (#318)
• 92f6411 fix(examples): pin the actions examples teach, waive what they demonstrate (#310)
• cef3d72 fix(iac): Dockerfile absence rules no longer fooled by comments or blank lines (#311)
• abc7930 fix(iac): a comment keyword can't satisfy an absence rule's property (closes #312) (#314)
• 7827b11 fix(iac): blank line before a Dockerfile instruction no longer mis-locates it (#325)
• cdb3624 fix(secrets): a data: URI payload is not a credential (#308)

Refactoring

• d7aed42 refactor(lexctx): unify comment-context matching onto lexctx (#317)

Others

• 9c02e45 ci(metamorphic): add rule-robustness invariance gate (#316)
• e4ab0af docs(changelog): 1.15.0 (#326)
• 9bc6960 docs(changelog): record the fixes merged since 1.14.0 (#315)
• 7725ef0 docs(changelog): record the role-aware AI taint change (#320)

Full Changelog: v1.14.0...v1.15.0