Skip to content

v0.1.62

Choose a tag to compare

View all tags
@gauravbsinghal gauravbsinghal released this 16 Jul 20:03
· 15 commits to main since this release
v0.1.62
2f856de

Niro v0.1.62

Summary

This release makes pentest findings cheaper to inspect and easier to hand off for verification. Test-case listing is now a compact metadata index, failed findings can be exported as complete verifier-ready bundles in one call, and attack steps are formatted more reliably in customer reports.

Changes

  • list_test_cases now returns the complete matching point-in-time index without pagination. Each row contains the test-case ID, status, severity, and either its title or invariant.
  • Full finding data remains available one case at a time through get_test_case_detail.
  • list_test_cases accepts an optional output_dir that writes every reportable FAILED finding to <output_dir>/<TC-ID>/finding.json. The returned index remains governed by filter; the export always contains the reportable FAILED snapshot.
  • The developer agent now seeds verifier handoffs with one export call and invokes the finding verifier separately for each test-case ID.
  • Attacker agent guidance now explains how CommonMark spacing affects rendered attack steps, helping keep numbered reproduction steps readable in customer PDFs.

Security

Finding export preserves the same customer-visible projection as get_test_case_detail: internal notes, findings below the configured minimum severity, and findings that hold only in development are not written. Export requires an absolute destination that is absent or completely empty, rejects symlinks and unsafe test-case path segments, stages the full snapshot before publication, and writes directories and files with restrictive permissions.

Compatibility and upgrade

No CLI flags or customer configuration keys changed.

The developer agent MCP surface changed. list_test_cases no longer exposes limit or offset, returns compact metadata rather than rich finding summaries, and adds optional output_dir. Integrations that need full data for one case should call get_test_case_detail; integrations preparing all reportable FAILED findings may use the new export.

Upgrade normally with niro upgrade or rerun the installer.

Known issues

  • checksums.txt covers platform archives but not niro.mcpb.
  • Release artifacts do not include detached signatures, public binary provenance attestation, or an SBOM.
  • niro upgrade follows stable rather than dev or RC releases, and Windows users must rerun the installer to change versions.
Assets 10
Loading