Skip to content

v4.1.4: Framework-aware dead code precision and grep verification improvements

Choose a tag to compare

@duriantaco duriantaco released this 28 Mar 06:42
· 927 commits to main since this release

Fixed

  • Honor project .gitignore during file discovery. Ignored worktrees, custom virtualenvs, and other excluded paths are no longer scanned
  • Treat imperative framework entrypoints as live code instead of dead code:
    • Flask add_url_rule(...)
    • FastAPI add_api_route(...)
    • Starlette add_route(...) / add_websocket_route(...)
    • Sanic register_listener(...) / register_middleware(...)
  • Treat pytest / Pluggy hook implementations (@pytest.hookimpl, @hookimpl) as live plugin entrypoints
  • Grep cache saves now fail open on non-writable roots instead of aborting analysis
  • skylos --llm now shows populated Problem: descriptions for dead code findings
  • Dead code findings in --llm output now include rule IDs and severity levels
  • Fixed Windows uvx skylos crash caused by litellm path length issues

Changed

  • Static grep_verify now reuses .skylos/cache/grep_results.json across repeated local scans
  • Phase 2b LLM audits now focus on high-signal files instead of scanning the full Python set
  • Agent scans are faster on changed-file workflows, and fix generation is now opt-in
  • litellm is now optional for core static analysis installs
  • litellm is capped at <1.82.8 due to the known supply chain issue