v5.5.0

5.5.0 (2026-11-10)

Features

• analyzer: add Ruby and Terraform AWS checks (#1178) (c71902f)
• cleanup: add scoped plans, stronger verification and Cloud receipts (#1204) (23ec412)
• cleanup: cleanup for SKY-U001, U002 and L038 (#1202) (8a0d09d)
• cli: add opt-in type checking and profiling (#1194) (32aa94e)
• cli: skylos setup, skylos open and the codebase graph (#1162) (c04268e)
• csharp: model ASP.NET sources, typed sinks and unsafe deserialisation (#1166) (0496f64)
• deadcode: improve TS/JS, Go and Rust checks and add Swift (#1187) (9472dda)
• deadcode: improve TS/JS, Go and Rust usage tracking (#1185) (3cbc86a)
• evals: add internal regression evals and pre-push checks (#1182) (6262728)
• flow: one workflow from setup to the PR comment (#1191) (c07b2b5)
• go: model SQL libraries, XSS and framework sinks in the Go engine (#1157) (b51dd2c)
• java: expand security checks and spring request tracking (#1156) (df4fa52)
• kotlin: improve dead code detection and add security checks (#1164) (9a4a3e3)
• php: add command, code execution, XSS and Laravel SQL checks (#1167) (2b0d60a)
• sca: name your lines that use API a dependency upgrade removed (#1198) (c05b630)
• sca: scan dependencies across more package managers (#1163) (0fc6fc2)
• secrets: more credential and private key detection (#1188) (1ba3b8e)
• security: expand Python security coverage and add CWE IDs (#1154) (d011d64)
• supply-chain: add malware feed, install hook, upgrade review and agent and publish-job rules (#1190) (fa748ba)
• suppress: honour skylos ignore comments in every language and widen secrets coverage (#1152) (64936c8)
• typescript: expand request taint tracking and add nosql injection checks (#1155) (724f7a7)

Bug Fixes

• analyzer: fix Ruby, PHP and C# checks and benchmark scoring (#1181) (1a9d806)
• analyzer: improve dead-code precision and security coverage (#1175) (7766099)
• analyzer: reduce false positives and missed security findings (#1199) (7cf919a)
• benchmarks: reject incomplete scans and expand dead-code coverage (#1176) (b7ffee3)
• cicd: analyze changed files under default exclusions (#1172) (07265f6)
• cicd: preserve diff scope in summary-only PR reviews (#1186) (99a3e55)
• cicd: read the PR diff as bytes and parse Git's quoted paths (#1196) (380b2a3)
• cicd: recognize same-commit reusable workflow references (#1173) (68fec1e)
• deadcode: fix remaining robot and dynamic python FPs (#1174) (f5d8629)
• deadcode: fix shared-name references and nested file leaks (#1165) (0af927e)
• deadcode: improve TS/JS, Go and Rust detection (#1183) (efd665f)
• deadcode: match python registration decorators and read plugin entry points (#1153) (613727e)
• deadcode: model robot framework library and variable imports (#1169) (b529347)
• deadcode: stop reporting Protocol attribute declarations as unused (#1201) (06d4828)
• sbom: preserve direct dependency classification in SPDX exports (#1179) (bf6215f)
• sbom: protect additional dependency input filenames (#1168) (7eff6a5)
• scale: keep danger worker results picklable (#1200) (a10d85d)
• sca: only fail scans for a real reason and show how each package is used (#1197) (83362d2)
• secrets: improve detection and close scan coverage gaps (#1184) (9fbc521)
• security: avoid repeated YAML import scans (#1161) (bf241af)
• security: catch missed calls and improve guard checks (#1189) (7f38f88)
• security: close Python OWASP detection gaps (#1160) (6f83010)
• security: improve python security rule precision (#1159) (9cf0b2b)
• security: reduce FPs and catch missed Python findings (#1203) (3fca2b3)
• security: track random aliases and add corpus controls (#1180) (4481fea)
• tests: remove literal secrets from supply-chain fixtures (#1192) (8de226c)
• tests: remove literal Slack token from integrity fixture (#1193) (31d2814)

Performance Improvements

• secrets: speed up ASCII token checks (#1195) (ab0468d)

Documentation

• accessibility: add accessibility statement (#1171) (f8e287f)