AVE v1.1.0 — 51 records, schema v1.0.0, offline artifact now available

[chaksaray]

AVE v1.1.0 shipped on 2026-06-21. Here is what changed:

51 records, all at schema v1.0.0
All 48 original records migrated from schema 0.2.0 to 1.0.0. Three new records added:

• AVE-2026-00049: HTTP Host Header Injection (BadHost) — HIGH 7.2
• AVE-2026-00050: Parasitic Toolchain — HIGH 7.2
• AVE-2026-00051: OAuth Discovery Rebinding — HIGH 7.2

Detection rules and fixtures for every record
102 tests passing (51 records x 2 fixtures each). Every record now has a positive fixture (must trigger) and negative fixture (must not trigger).

AVE-in-SARIF convention published
docs/specs/ave-in-sarif.md defines how AVE findings travel as SARIF into GitHub Security tab and CI systems.

Offline record set
All 51 records as a single downloadable JSON array for air-gapped and bundled-install use cases: https://github.com/bawbel/ave/releases/download/v1.1.0/ave-records-v1.1.0.json

Implementer guide
docs/specs/ave-implementer-guide.md covers three consumption patterns: runtime API, bundled offline, and ID-only emission for downstream resolution.

Full release notes: https://github.com/bawbel/ave/releases/tag/v1.1.0
Registry: https://ave.bawbel.io/registry.html
API: https://api.piranha.bawbel.io