PatchScope v2.0.0

PatchScope v2.0.0 brings configurable diff review to your terminal and CI, with explained exceptions and portable SARIF reports.

What is new

• Configure built-in rule priorities or disable individual rules through an explicit JSON policy.
• Suppress a specific rule for an exact file and optional new-line number, with a required justification retained in reports.
• Export SARIF 2.1.0 from the CLI and GitHub Action, alongside Markdown and JSON.
• Opt into CLI priority thresholds with --fail-on high|medium|info; matching active prompts return exit code 2 while preserving the full report.
• Keep dependency prompts scoped to the relevant package and ecosystem in monorepos. Recognize Bun and npm shrinkwrap lockfiles.
• Get clearer examples, workflow comparisons and configuration guidance in the README.

Use v2 in GitHub Actions

- uses: brunnojob/patchscope@v2.0.0
  with:
    diff-file: review.diff
    # config-file: patchscope.json

The Action adds config-file, report-sarif and suppressed-count. Pin a reviewed full commit SHA for production workflows.

Upgrade notes

• JSON reports add suppressed, summary.suppressed and configuration metadata. Active counts exclude explained suppressions.
• Dependency prompts can increase for nested packages: shared ancestor lockfiles are not assumed to cover a package without workspace context.
• Invalid or duplicate CLI options now fail explicitly. Analysis remains non-blocking unless --fail-on is supplied.
• Browser configuration controls are not included; the browser workspace continues with default rules.

Validation

33 automated tests passed on Linux and Windows with Node.js 22 and 24 for the feature changes. SARIF examples were validated against the official OASIS 2.1.0 schema.

Zero runtime dependencies, no AI keys and no remote code processing. Heuristic triage supports human review; it is not a security audit.

Try PatchScope · Documentation

Full changelog: v1.0.0...v2.0.0