Skip to content

MEDUSA v2026.6.0

Choose a tag to compare

View all tags
@rosschurchill rosschurchill released this 10 Jun 15:47
· 24 commits to main since this release
v2026.6.0
519a9b6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

MEDUSA v2026.6.0 — code-review hardening + paid-code strip

A reliability, security, and correctness release. Combines the v2026.5.12 content (40,000+ rules + FP-hardening + integrity rewrite) with 20 fixes from a full multi-agent code review, and makes the free package fully standalone.

Reliability / correctness

  • --fail-on now actually fails the build (was a silent no-op — every CI gate was passing regardless of findings)
  • medusa scan --git no longer crashes on a default run (NameError)
  • --quick incremental cache now persists (was silently doing a full scan every time)
  • A FIFO/socket/device in the scan tree no longer hangs the whole scan
  • Per-scanner timeouts can no longer be swallowed; scanner crashes/timeouts are now recorded and summarised
  • Atomic cache writes; unreadable directories warned (no silent coverage loss); hardened config/rule-load guards; distinct internal-error exit code

Security

  • git clone hardened (no credential prompt, no token leak on timeout); cleartext http:// clones rejected; clone blob-size bound
  • Report files written 0o700 (they can embed detected secrets); defense-in-depth HTML/Markdown escaping

Output / housekeeping

  • Analyzer/rule counts corrected (79 / 40,000+); tightened ship-gate tests; suppressed nested-set FutureWarning console spam (notably on Windows)
  • Fixed long-standing CI workflow permission bug and invalid ruff/mypy version config

Standalone free product

Licensing, the REST API, and runtime rules have been removed from the package — the free scanner is fully self-contained and runs entirely locally.

Validation

441 tests passing; wheel smoke-tested in a clean venv on Linux and Windows; CI matrix green across Windows/macOS/Linux × Python 3.10–3.12.

Assets 2
Loading