Skip to content

v5.0.0

Choose a tag to compare

View all tags
@duriantaco duriantaco released this 23 Oct 03:55
v5.0.0
85227d1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

5.0.0 (2026-10-23)

Features

  • agents: add skylos agent recap, hook activity in skylos doctor, and a live README badge (#1012) (ba7a926)
  • cicd: add skylos cicd agent-review for approved Cloud PR reviews, with GitHub OIDC, bounded source bundles and a generated trusted workflow (#1047) (0e4055c)
  • quality: add idiom advice backed by source evidence for repeated imports, boolean branches, f-string conversions and handlers that only re-raise (SKY-L036–SKY-L039) (#1042) (fa1c9a3)
  • security: add Dependabot execution and cooldown checks, decoded-secret exposure, workflow obfuscation and trusted-publishing advice (SKY-D360–SKY-D364) (#1043) (f806a0a)

Bug Fixes

  • analyzer: require source evidence for exclusions and live references; track import bindings and match mock targets exactly (#1025) (f93ce5e), (#1048) (d3d9d21)
  • dead-code: verify dynamic lookups, lazy exports, browser entrypoints, registration and import evidence before marking code as used (#1036) (55b81f3), (#1044) (8159626)
  • security: resolve sink receivers from source bindings and classify filesystem reads, writes and exclusive creates using their actual open modes (#1030) (59aecb8), (#1033) (f7accea)
  • security: trace filesystem paths through exact call sites and helper callers, preserving safe, untrusted, unknown and incomplete provenance (#1032) (d7ea15b), (#1039) (48c5f77)
  • security: lock SKY-D215 regressions for nested path-table lookups: retain proven safe temporary paths while reporting unsafe values and mutations and preserving unknown caller evidence (#1052) (d2e0588)
  • security: verify SQL, LLM and web input safety evidence; validate URL guards and bound XSS helper tracing (#1040) (58081f5), (#1045) (929e7b3)
  • security: verify workflow credential exposure and actor authorization; follow GitHub Actions expressions, outputs and reachable triggers before reporting injection or cache risks (#1035) (07e80f4), (#1043) (f806a0a)
  • secrets: preserve scalar values when reading pnpm lockfile streams (#1031) (34b5e20)
  • dependencies: verify declared and transitive import providers and explicit package scopes without treating unrelated lockfile entries as declarations (#1041) (65994e3)
  • performance: correct SKY-P401/SKY-P403 receiver and control-flow analysis (#1015) (7b5c5a3)
  • quality: correct metrics and typing scope, and report code left unused by PR changes (#1016) (9d6255f)
  • quality: reduce false positives using source and control-flow evidence for mutable defaults, resource lifetimes, test code and security context (#1013) (12ea15f), (#1018) (47d631c)
  • quality: respect pytest collection and typing contexts, preserve boolean-call evidence and keep advice scoped to the relevant code (#1021) (5f4a478), (#1023) (2b0c305)
  • quality: require source and policy evidence for annotation, parameter, metric and design advice (#1024) (7c2ce60), (#1027) (f43e565), (#1029) (2b15100)
  • quality: keep SKY-L036–SKY-L039 style advice out of default displays and gates while retaining raw JSON records; --all-advice and explicit rule selection include it (#1046) (9a98c5e)
  • reporting: combine complexity advice per function, preserve raw findings and count grouped advice consistently across reports, uploads and gates (#1019) (91ac1ed), (#1022) (5ecd621), (#1049) (1c80c7e)
  • reporting: normalize nested evidence and definition paths for uploads, keep receiver proofs relative to the scanned project, and mask external evidence paths (#1050) (7999e8f)
  • ci: fall back to a full scan when push history is unavailable and trigger releases after required checks finish (#1017) (851d8b7), (#1034) (2d9bda8)

Dependency Updates

Assets 2
Loading