v0.1.59

Niro v0.1.59

Summary

This release improves results for intentionally vulnerable training and benchmark applications and keeps remediation scratch data out of reusable Niro knowledge artifacts.

Changes

• Reproduced vulnerabilities in intentionally vulnerable training or benchmark applications are now treated as true positives even when challenge markers, solve hooks, or first-party tests show the weakness is deliberate.
• niro find keeps those confirmed challenge vulnerabilities in findings and reports; niro fix can create remediation pull requests for them.
• The developer agent no longer reinterprets those verifier true positives as accepted behavior.
• Remediator scratch work now lives outside the Niro configuration directory, preventing transient files from entering knowledge artifacts.

Security

This prevents deliberate training vulnerabilities from being suppressed as accepted behavior solely because the source documents their intent. Reproduction and a valid violated security invariant remain required; target labels alone do not promote a result to true positive.

Moving remediator scratch outside the configuration directory reduces accidental inclusion of temporary remediation material in reusable Niro knowledge artifacts.

Compatibility and upgrade

No CLI flags, MCP tool schemas, or configuration keys changed. Existing workflows and Niro configuration remain compatible. On intentionally vulnerable training or benchmark targets, expect more reproduced findings to remain reportable and eligible for remediation instead of being proposed as accepted.

Known issues

• checksums.txt covers platform archives but not niro.mcpb.
• Release artifacts do not include detached signatures, public binary provenance attestation, or an SBOM.
• niro upgrade follows stable rather than dev or RC releases, and Windows users must rerun the installer to change versions.