Skip to content

CroCode v0.6.0

Latest
Latest

Choose a tag to compare

View all tags
@kacigaya kacigaya released this 03 Nov 09:55
· 6 commits to main since this release
v0.6.0
368e923
  • Static analysis: OpenGrep scans the changed files in an offline sandbox before each review. The agent receives results on added lines as hints, confirms real issues, and drops false positives. The new Static analysis tab on the review page lists them. A pull request cannot hide code with .semgrepignore files or nosemgrep comments.
  • Review controls: admins can retry a failed or cancelled review and cancel a queued or running one. Failed and cancelled reviews show a plain reason and a next step.
  • Agent health and usage: the overview shows whether each agent CLI answers in the sandbox, and each agent's review count, median run time, token usage, and models. Review pages show agent time and tokens.
  • Weekly security digest: an opt-in Slack-compatible webhook gets new, fixed, and overdue Dependabot alerts every 7 days. The database stores the URL encrypted. Delivery connects only to public addresses.
  • Claude model list: the model picker shows versioned Claude models with their names, from the Anthropic Models API.

Upgrade from v0.5.0

  1. Rebuild the sandbox image: sudo docker build -t crocode-sandbox:latest docker/sandbox. It now bundles OpenGrep and the rules.
  2. Run crocode migrate with MIGRATION_DATABASE_URL before starting the API and worker. Compose runs the migration service first. Migrations 0004 and 0005 add usage, health, digest, and static analysis columns and tables.
  3. Optional: set CROCODE_SAST=off to skip static analysis, or sast: false in .crocode.yml for one repository. A scan adds about 30 s per review with runc and about 90 s with runsc.
  4. The digest needs the read-only Dependabot alerts App permission. Its URL is encrypted with a key derived from the GitHub App private key. After you rotate that key, enter the URL again.
  5. Codex now runs with --json. Recheck agent startup behavior if you pin another Codex version.

See the configuration guide, the security model, and the API contract.

Rules license

The bundled opengrep-rules use LGPL-2.1 with the Commons Clause. The clause does not grant the right to sell a product or service whose value derives mainly from the rules. CroCode code stays Apache-2.0. See the image notes before you offer CroCode as a paid service.

Validation

These checks pass: Rust format and Clippy, all 89 Rust tests including the database integration tests, all six OSV tool tests, both Compose configurations, web lint and type checks, all 49 web tests, the production build, the docs build and export, and the standalone smoke tests. Codex review passes found 13 defects across the release PRs, and all are fixed. A live check under runsc confirmed the static analysis scan.

Known dependency advisory

The lint toolchain still includes minimatch 3.1.5 and 10.2.6, affected by GHSA-g3hv-75wg-m249 / CVE-2026-118764. OSV found no advisories in the public Rust dependency graph, including the new tokio-rustls, webpki-roots, and ring crates.

Full changelog

Assets 2
Loading