v1.4.0

Added in 1.4.0

• Evidence-backed confirmed, needs_validation, and rejected finding verdicts with baseline
  carry-forward, Markdown grouping, and SARIF review states.
• Published schemas for findings reports, scan plans, and evidence runs, plus a stdlib validator and
  automatic normalized-report validation.
• Guidance for using deterministic scanner evidence before a complementary logic-level audit.

v1.3.1

Fixed in 1.3.1

• Verified all scanner parsers against real output and replaced synthetic fixtures with trimmed
  real finding and clean runs.
• Corrected govulncheck JSON-stream parsing, Composer and bundler-audit schemas, OSV severity and
  fix extraction, package versions, and zizmor source locations.
• Added runner-managed Semgrep evidence and corrected pip-audit and Gitleaks planner commands.

v1.3.0

Added in 1.3.0

• Bun planning, OSV-Scanner lockfile fallbacks, IaC detection, filesystem secret scanning, and
  offline GitHub Actions audits in planner schema v2.
• A read-only plan runner with execution metadata, timeout and scope controls, and evidence
  redaction before persistence.
• A fixture-tested findings normalizer with JSON, SARIF, and Markdown output, OWASP mapping,
  severity normalization, stable fingerprints, and baseline diffs.
• End-to-end planner, runner, normalizer, evidence layout, baseline, and SARIF documentation.
• A validated Claude Code plugin manifest for skills-directory installations.

v1.2.0

Added

• Repeatable planner exclusions with --exclude.
• Containerfile detection alongside Dockerfile detection.
• Actionable export guidance for uv and Poetry lockfiles.
• Installation and report examples plus a private vulnerability reporting policy.
• Python 3.10, 3.12, and 3.13 CI coverage and weekly GitHub Actions dependency updates.