v4.16.0

4.16.0 (2026-05-19)

Features

• cli: add cache stats and rules catalog JSON (#438) (cd1e5df)
• cli: add cache stats and rules catalog JSON (#439) (03bd425)
• cli: improve terminal scan output (#420) (f9582d4)

Bug Fixes

• analyzer: escape dynamic reference patterns (#435) (e10916a)
• audit: scope deep processing to current scan (#419) (b9df22e)
• ci: avoid PR-controlled scanner execution (#428) (13e2f87)
• cicd: quote generated PR base refs (#417) (7d9e6b9)
• ci: configure parity venv path at runtime (72b588a)
• ci: keep parity venv outside checkout (#415) (6eedb7e)
• cli: redact secrets in llm reports (#433) (af64e1f)
• cli: sanitize pretty report text (#427) (176c0e2)
• config: validate skylos project config (#436) (6e1d988)
• llm: minimize changed-file review context (#432) (056a072)
• login: avoid printing saved api token (#434) (f000851)
• pipeline: review ordinary files in llm-only scans (e21696a)
• remediation: reject edits outside scan root (#424) (c48a8b5)
• secrets: avoid quadratic generic scan (#410) (8dd05af)
• secrets: restore generic value export (#412) (08bd492)
• secrets: scope hash suppression to candidates (#437) (2de8e2a)
• security: bound prompt injection candidate collection (#429) (5f41874)
• security: bound prompt injection scans (#423) (aee6754)
• security: parse markdown fences linearly (#430) (81525ee)
• security: prioritize prompt docs within scan cap (#426) (c22a004)
• security: tolerate non-utf8 taskflow files (#416) (41e72d7)
• sql: invalidate mutated static queries (#418) (d9765bc)
• ssrf: flag uppercase f-string URL bases (#425) (acf6ee3)
• sync: reject symlinked repo link (#413) (4b046c3)
• typescript: detect child_process exec aliases (#414) (221e783)

Documentation

• entrypoints: add call maps (#442) (a407739)