MEDUSA v2026.5.1 — Logic Bug Fixes

Bug Fixes in v2026.5.1

🔴 Critical

• --fail-on severity filtering — was counting ALL issues regardless of severity level. --fail-on critical now correctly exits non-zero only when CRITICAL issues are found. Previously it would exit on any LOW finding and falsely report "Found N issues at CRITICAL+ level".
• medusa init next steps — was recommending deprecated medusa install --all (does nothing). Now correctly shows medusa install --ai-tools.

🟠 High

• .env double-counting — files named .env were counted twice in file type detection (once by extension, once by name check), inflating stats.
• PHP install prompt in CI — did not check sys.stdin.isatty(), causing hangs in non-interactive environments.

🟡 Medium

• Dead code removed — redundant target path check after an earlier check already exits with code 2.
• Windows npm.cmd — redundant shutil.which('npm.cmd') call removed (result from first call was already checked).

🟢 Low

• SBOM version — was hardcoded to 2025.9.0.0 in both CycloneDX and SPDX output. Now uses __version__.
• Pattern analyzer dotfiles — .cursorrules, .clinerules, .windsurfrules, .env, .mcp.json, .continue now scanned by the repo analyzer (were silently skipped).

---

Install / Upgrade

pip install --upgrade medusa-security

Thanks to @exrienz for reporting the install logic bug in discussion #2 that kicked off this audit.