v1.3.0

Local-first security-platform release. No breaking changes; all existing
commands and .klr semantics are unchanged.

Added

• killer dependencies [--details] [--json] — dependency intelligence
  across six ecosystems from local manifests only (Cargo.toml, package.json,
  requirements.txt, go.mod, and now pom.xml and *.csproj). Reports
  per-ecosystem counts, production/development split, duplicate versions, and
  possibly-unused candidates. No CVE/advisory data — inventory, not scanning.
• killer compliance [--json] — maps the findings Killer detects onto
  OWASP Top 10 (2021) with a CWE reference each. Categories are reported as
  Warning, Passed, or Not assessed — a category Killer cannot check is
  never marked passed. The mapping table lives in mappings/compliance.toml
  (embedded, TOML to keep the zero-dependency build). Not a certification audit.
• killer report formats — --executive (score, risk band, headline
  findings, recommendations), --technical (evidence, severity, remediation),
  --json, and --markdown, alongside the existing --html.
• killer doctor now detects and reports the project's ecosystems.

Changed

• The dependency-usage heuristic (import matching + Rust inline crate::path
  scan) is shared between killer graph and killer dependencies.

Notes on scope

killer dependencies is inventory-only: no vulnerability/CVE database,
supply-chain reputation, or typosquatting detection (those need a dataset a
zero-dependency local tool cannot ship). killer compliance maps to OWASP/CWE
and is explicitly not a certified SOC 2 / ISO 27001 / NIST audit. Both remain on
the roadmap as future, un-stubbed work.

v1.2.0

Developer-workflow release. No breaking changes; all existing commands and
.klr semantics are unchanged.

Added

• killer graph [--json] — a structural project-graph engine. Parses
  per-file imports (Rust, JavaScript/TypeScript, Python, Go, Java, Ruby) and
  declared dependencies from manifests (Cargo.toml, package.json,
  requirements.txt, go.mod), then reports the most-imported modules, import
  hotspots, and possibly-unused declared dependencies — a supply-chain
  signal. Dependency usage is matched best-effort (hyphen/underscore
  normalization, plus an inline crate::path scan for Rust). --json emits the
  full node/edge graph.
• killer benchmark [--runs N] — times repeated scans and reports min/avg
  latency and files-per-second / lines-per-second throughput.
• killer fuzz — surfaces the .klr mutate/fuzz generators as a
  first-class command. Without --url it previews the adversarial inputs it
  would send; with --url it fires each one at a target (using the same
  zero-dependency HTTP client and request encoding as .klr mutate) and
  flags any input that triggers a 5xx server fault or an unreachable target.
  --list prints the generator catalog; --generators selects a subset;
  --field sets the mutated key; --fail-on-issues gates CI.
• killer watch — re-runs a scan whenever a source file changes, using a
  dependency-free polling watcher (periodic mtime snapshots, diffed between
  ticks) that honors the same ignore rules as killer scan. --interval
  tunes the poll period.
• killer init --scaffold — in addition to writing .killer.toml, creates
  a security-tests/ directory with a runnable starter .klr file so a new
  project can run its first test immediately.

Changed

• The fuzz-generator table now lives in a single fuzz module and is shared by
  both the .klr runner and killer fuzz, so the two can never drift.

Notes on scope

killer fuzz is a CLI surface over the existing input generators — not a
coverage-guided fuzzing engine — and killer watch polls rather than
subscribing to OS file events. killer graph is a structural graph
(imports + declared dependencies with heuristic usage matching), not a semantic
or data-flow graph. A standalone fuzzing/chaos subsystem, a true multi-language
IR / data-flow engine, a ratatui TUI, and a plugin marketplace remain on the
roadmap, not shipped.

v1.1.0

Ecosystem and release-infrastructure release. No breaking changes.

Added

• killer doctor [--fix] — diagnoses a project's setup (git, .killer.toml,
  the configured .klr directory, a writable .killer/) and repairs what it
  can with --fix.
• Built-in suites expanded to six: added database, crypto, and
  filesystem alongside web, api, and authentication.
• A severity bar chart in the scan report summary.
• Release automation — a GitHub Actions workflow that, on a vX.Y.Z tag,
  builds Linux/macOS/Windows binaries, attaches checksummed archives, and
  publishes a GitHub Release with notes from this changelog.
• Community & governance — CODE_OF_CONDUCT.md, SUPPORT.md,
  GOVERNANCE.md, issue templates, and a pull-request template.