Skip to content

Release v1.7.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Jul 08:36
v1.7.0
This tag was signed with the committer’s verified signature.
felixgeelhaar Felix Geelhaar
SSH Key Fingerprint: cX80lY2GZeIIZnX+21rko1JRu2m8TckPAYIm9CdL5hM
Verified
Learn about vigilant mode.
68b3f1c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Nox v1.7.0 (2026-07-06T08:31:40Z)

Language-agnostic security scanner with first-class AI application security.

Installation

macOS/Linux (Homebrew)

brew tap felixgeelhaar/tap
brew install nox

Direct Download

Download the appropriate archive for your platform from the assets below.

What's Changed

Changelog

Features

  • d08b10d feat(agentflow): deterministic agentic-dataflow analyzer (ASI01/ASI02) (#193)
  • 43f5034 feat(ai): model license + provenance in the AIBOM (#146 2.6) (#177)
  • 32304be feat(bench): harden precision harness — per-rule ratchet, anti-cheat + determinism guards, CI gate (#198)
  • 615a6a1 feat(bench): measure over-firing, ratchet precision, grow the suite (#191)
  • c0136d9 feat(core): reproducible output (SOURCE_DATE_EPOCH) + submodule-aware tracked scans (#176)
  • b48e9ee feat(lexctx): classify Go source; drop #195 self-scan workaround (#197)
  • e3412be feat(registry): add nox/llm-triage v0.1.0 (#175)
  • 6b2a6e8 feat(sast): precision foundation — structural matcher (live), context gate, taint catalog, precision bench, language depth (#188)
  • 0e8dd41 feat(sast): real intraprocedural taint engine (Python + JS/TS) (#190)
  • 371356f feat(taint): Go taint model — AST-precise dataflow closes the six Go FNs (#200)
  • e3c2d0f feat(taint): close Go tier-2 false negatives (XSS-to-response + container taint) (#207)
  • 1e467ec feat(taint): close Ruby render inline: SSTI/XSS false negative (recall 0.875→0.941) (#208)
  • b225664 feat(taint): lift Rust taint recall by modeling web-extractor params as sources (#209)
  • ecbcc9a feat(taint): same-file interprocedural taint via function summaries (#194)
  • 5a4d501 feat: end-to-end C# SAST support (lexctx + taint + honest corpus) (#204)
  • dfdb17f feat: end-to-end C/C++ SAST support (lexctx + taint + honest corpus) (#210)
  • 4ae29d5 feat: end-to-end Clojure SAST support (lexctx + taint + honest corpus) (#221)
  • 1a600f3 feat: end-to-end Dart SAST support (lexctx + taint + honest corpus) (#220)
  • 06be616 feat: end-to-end Elixir SAST support (lexctx + taint + honest corpus) (#219)
  • 740b885 feat: end-to-end Groovy SAST support (lexctx + taint + honest corpus) (#222)
  • 6a9a8a1 feat: end-to-end Java SAST support (lexctx + taint + honest corpus) (#202)
  • 6737f4c feat: end-to-end Kotlin SAST support (lexctx + taint + honest corpus) (#211)
  • eac6b10 feat: end-to-end Lua SAST support (lexctx + taint + honest corpus) (#217)
  • ad822e2 feat: end-to-end Objective-C SAST support (lexctx + taint + honest corpus) (#218)
  • 10e4094 feat: end-to-end Perl SAST support (lexctx + taint + honest corpus) (#215)
  • 693ae02 feat: end-to-end PowerShell SAST support (lexctx + taint + honest corpus) (#212)
  • 23b8486 feat: end-to-end Ruby SAST support (lexctx + taint + honest corpus) (#206)
  • 853311b feat: end-to-end Rust SAST support (lexctx + taint + honest corpus) (#205)
  • bd55342 feat: end-to-end Scala SAST support (lexctx + taint + honest corpus) (#214)
  • 8950b11 feat: end-to-end Shell/Bash SAST support (lexctx + taint + honest corpus) (#213)
  • 1bfc557 feat: end-to-end Swift SAST support (lexctx + taint + honest corpus) (#216)

Bug Fixes

  • 9bffd36 fix(sast): eliminate 2 residual precision-suite FPs at engine level (0.895 -> 1.00) (#196)

Others

  • 15a2638 chore(registry): converge 14 plugins to .sigstore.json signatures (#110) (#178)
  • 68b3f1c chore(release): 1.7.0 — 21-language SAST taint engine, precision 0.30→1.00 (#223)
  • 1845f36 docs(sotw): backfill mcp-python-sdk DONE entry (2026-05-04) (#180)
  • 7ca0448 docs(sotw): bi-weekly queue dates anchored on today's post (#182)
  • 1cd298d docs(sotw): distinct dates for the 06-05 batch in the queue (#181)
  • 1ceb7eb docs(sotw): pre-clone runbook for Scan of the Week under egress limits (#136) (#179)
  • 055e749 feat(lang-php): end-to-end PHP SAST — lexctx + taint + honest corpus (#203)
  • 2e36539 feat(llm-triage): ground LLM triage to deterministic findings + residual routing (#192)
  • 536385c feat(secrets,ai): raise SAST precision 0.30->0.89 by fixing three FP classes (#195)
  • 1b983dc test(bench): grow SAST precision suite onto Go (honest measurement) (#199)
  • 9a193c7 test(bench): honest SAST precision suite — real numbers, not a 1.000 scaffold (#189)
  • 34395de test(precision-suite): grow Go corpus to indict XSS-to-response + container taint gaps (#201)

Full Changelog: v1.6.0...v1.7.0

Assets 17
Loading