v1.11.0

1.11.0 (2026-11-02)

Features

• agent-config and workflow-security rules, CI exit policy, repo-aware init, faster TS and diff scans (#192) (145eb0d)
• ci: add GitHub Actions workflow-security rules (c082b50)
• cli: add -fail-on, -min-confidence and -quiet; gate the banner on TTY/CI/NO_COLOR (a9b149a)
• cli: add "did you mean" suggestions and validate flags before scan output (cce068e)
• cli: richer explain output and rules filters (7399a07)
• context: generate and refresh agent docs with codeguard context init|update (2a75286)
• doctor: probe govulncheck, check entrypoints and target languages (e3581ef)
• init: detect the repository and write a small config; scan without one (3377568)
• MCP finding filters, did-you-mean errors, gitignore-aware walk, concurrent quality passes, security precision (#193) (9b001b4)
• mcp: summary-first, filtered, paginated findings for scan and validate_patch (668c56a)
• prompts: govern Claude settings, MCP servers and hidden Unicode in agent config (a2243bb)
• report: richer SARIF for GitHub code scanning (3a6896f)
• rules: verified examples, confidence, and config keys in the catalog (bf88819)
• scan: honour .gitignore in the file walk (f71df06)
• security: honor justified gosec directives for shell-execution (f7f8423)
• security: show govulncheck stderr in failure diagnostics (fcf1880)
• shared taint engine, gocyclo-accurate complexity, richer SARIF, teaching explain, context generation, docs coverage (#194) (c6da761)

Bug Fixes

• action: make the sticky PR comment actually post (b2c9020)
• ai: remove the config-selectable mock triage provider (8979ac5)
• cache: keep security-secrets diagnostics on findings-cache hits (d7c3b9d)
• cache: key per-file findings on the cross-file inputs they read (5bed0ad)
• config: keep an explicit 0 for risk-scoring and production-risk weights (b04758d)
• config: report every validation failure, not just the first (c59bb5b)
• mcp: keep the 1.10 full report as the scan/validate_patch default (719bf8f)
• prompts: govern only config files under mcp/ directories (87f3fcc)
• quality: count && and || in Go cyclomatic complexity (30b7be1)
• quality: keep legacy Go cyclomatic counting as the 1.x default (8e59a2a)
• restore 1.x backward compatibility for MCP, SDK risk weights and Go complexity (#195) (59f8e0c)
• rules: retire dead quality.mixed-abstraction-levels; require emission sites (M6) (bd3c736)
• runner: fail scans whose target path is missing or unreadable (00a6a48)
• runner: fail the scan when a check section panics (35349a5)
• runner: report identical findings from overlapping targets once (76405d6)
• runner: stop callers mutating the shared corpus listing; make suppressed order total (062b01d)
• sdk: restore int risk weights and track explicit 0 per key (bcdf068)
• security: close Python taint gaps for request data, imported sinks (5593e90)
• security: grade provider-prefixed keys at high confidence (2efe169)
• security: match insecure-deserialization on masked source (ae38101)
• security: stop scanArgLiterals panicking on a lone-quote argument (a6b1615)
• security: stop the secret name heuristic spanning concatenation (26b4212)
• stop codeguard silently passing on broken scans (high-priority review fixes) (#189) (4104604)

Performance Improvements

• diff: batch and memoize base-ref reads in diff mode (04a7efb)
• quality: compute TS/JS module-scope flags in a single pass (310df11)
• quality: cut self-scan time ~46% by fixing three profiled hot paths (#191) (7660755)
• quality: gate the style-profile regexes behind literal pre-checks (4852024)
• quality: replace the clone tokenizer regex with a byte lexer (1e24245)
• quality: run whole-target passes concurrently and parallelize their per-file loops (9170132)
• runner: memoize C-like parses and inline suppressions per scan (e3095fe)
• scan: derive scan concurrency from GOMAXPROCS and parallelise serial passes (b68b7e4)