Release v1.17.1

Nox v1.17.1 (2026-07-25T22:51:54Z)

Language-agnostic security scanner with first-class AI application security.

Installation

macOS/Linux (Homebrew)

brew tap felixgeelhaar/tap
brew install nox

Direct Download

Download the appropriate archive for your platform from the assets below.

What's Changed

Changelog

Bug Fixes

• 73eede8 fix(ci): the SLSA generator must be tag-referenced, not SHA-pinned (#354)
• 73e6423 fix(vscode): declare the VS Code version the extension actually needs (#358)
• f66dc7a fix(vscode): resolve modules the way modern packages publish them (#359)

Others

• 3416308 chore(deps): Go 1.26.5, and drop the last hardcoded toolchain pins (#360)
• 5eb06a1 chore(deps): bump actions/checkout from 6.0.3 to 7.0.1 (#342)
• 9e8bc0e chore(deps): bump actions/setup-go from 6.4.0 to 7.0.0 (#351)
• 593c171 chore(deps): bump distroless/static-debian12 from a932952 to f5b485e (#343)
• 7656962 chore(deps): bump golang from 1.25-alpine to 1.26-alpine (#345)
• 1f24ead chore(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 (#341)
• 07be4eb chore(deps): bump vscode-languageclient from 9.0.1 to 10.1.0 in /editors/vscode (#349)
• db88016 chore(deps): golang.org/x/term 0.45.0, openai-go 3.46.0 (#363)
• f0e9fa3 chore(deps-dev): bump @types/node from 20.19.43 to 26.1.1 in /editors/vscode (#346)
• fea31bd chore(deps-dev): bump typescript from 5.9.3 to 7.0.2 in /editors/vscode (#348)
• e0183f6 docs(memory): scaffold Agent OS memory and capture 2026-07-19
• 5e501b0 fix(fix-actions): never SHA-pin a reusable workflow, never pick a prerelease (#356)

Full Changelog: v1.17.0...v1.17.1