Skip to content

CroCode v0.5.0

Choose a tag to compare

View all tags
@kacigaya kacigaya released this 02 Nov 23:43
· 10 commits to main since this release
v0.5.0
6fc73b4
  • Dashboard insights: see open pull requests, review totals, success rate, finding severity, and median review time. Review pages show PR metadata, findings, and run history.
  • Settings and model picker: installation settings have their own tab. Choose from models reported by enabled agent harnesses, or enter a model name manually.
  • Vulnerability dashboard: inspect open Dependabot alerts by repository. Filter by CVE or GHSA text, repository, package, severity, dependency scope, and patch availability.
  • Security coverage: distinguish readable alerts, denied access, unavailable repositories, rate limits, timeouts, and failed requests. Last-success history is bounded and resets on API restart.
  • Fix priority queue: rank matching alerts by severity, then known EPSS probability, then patch availability. Missing scores stay unknown. Filters and ranks apply to the current repository page.

Upgrade from v0.4.0

  1. Run crocode migrate with MIGRATION_DATABASE_URL before starting the API and worker. Compose runs the migration service before runtime services. This creates the agent_models table.
  2. To use the vulnerability dashboard, add Dependabot alerts: Read-only to the GitHub App and approve the permission for each installation. The signed-in user must also have security-alert access. Enable Dependabot alerts on the repositories.
  3. API clients must send a user token to /api/v1/agents.

See GitHub App setup and the API contract. Coverage measures alert access; it does not confirm that dependency scanning is enabled. EPSS estimates exploitation probability and does not prove active exploitation.

Validation

Rust format and Clippy checks, all 68 Rust tests including database integration tests, all six OSV tool tests, web lint and type checks, all 44 web tests, the production build, standalone smoke tests, docs build and export, and both Compose configurations pass. Release review found no concrete defects.

Known dependency advisory

The lint toolchain still includes minimatch 3.1.5 and 10.2.6, affected by GHSA-g3hv-75wg-m249 / CVE-2026-118764. No dependency versions changed in this release. OSV found no advisories in the public Rust dependency graph.

Full changelog

Assets 2
Loading