v2.40.0

Security notes

This release contains four security fixes. Two are credential-disclosure or code-execution issues reachable by anyone who controls input the CLI already trusts - a source repository, or the configuration of an Azure Web App being scanned. Two affect the integrity of recorded fingerprints. Upgrading is recommended.

Issue	Affected commands	Severity	Fix
Config file loaded from the current working directory	all commands	High	#1152
Azure credential sent to a registry named by an untrusted source	snapshot azure	High	#1153
.kosli_ignore could exclude itself from the fingerprint	all directory fingerprints	High (partial)	#1156
S3 object keys with .. segments and colliding keys	snapshot s3	Medium	#1155

Before upgrading, check for: a kosli.yml in any repository where the CLI runs (#1152 is a breaking change - the working directory is no longer searched); self-excluding .kosli_ignore files (#1156 changes their fingerprint); and S3 buckets with unusual object keys (#1155 may cause a snapshot to fail).

What's Changed

• fix: paginate PR commits and reviews by @mbevc1 in #1144
• docs: note 1MB JSON payload limit and upgrade x/crypto by @sami-alajrami in #1148
• feat(jira): add --jira-trailer flag to extract Jira issue key from git trailer by @vidhu-balad in #1109
• docs(security): state that the CLI has no bug bounty and point to the platform program by @AlexKantor87 in #1151
• fix(snapshot azure): only send Azure credentials to Azure Container Registry by @AlexKantor87 in #1153
• fix(config)!: stop loading the config file from the working directory by @pbeckham in #1152
• chore: condense Claude comments by @mbevc1 in #1158
• ci: upload Snyk Code SARIF to GitHub code scanning by @dangrondahl in #1159
• fix(fingerprint): prevent .kosli_ignore from excluding itself by @pbeckham in #1156
• fix(snapshot s3): reject object keys with ".." segments and never overwrite a downloaded object by @AlexKantor87 in #1155
• fix: improve Claude comments instructions by @mbevc1 in #1160
• fix: improve testing robustness by @mbevc1 in #1161

Full Changelog: v2.39.2...v2.40.0