Dependency scanning
- Fetching on by default (--fetch=all); every fetched dependency gets its own verdict, not a slice of its parent's.
- Worker mode scans all resolvable dependencies; interactive scans stay gated to fresh releases — now including correctly-dated Go pseudo-versions.
Correctness
- Never posts a verdict it didn't compute — an unreached dependency no longer gets an invented "benign" that would bless a bad package.
Scale & speed
- Files up to 16 GiB (streamed — a 16 GiB sample scans on an 8 GiB host).
- Lockfile-heavy scans faster: registry JSON no longer YARA-scanned (~20s saved on 851 records).
- Worker count back to physical (non-E) cores — better throughput on hybrid CPUs.
LLM (optional)
- Legacy --interpret flag was renamed to --llm
- Now auto-picks the largest model served.
Project
- Rust 1.94, moved to GitHub, dependency updates.