v2026.11.02.3

What's Changed

• Look first at a located medium report too, and keep libmbfl as php-src's own code by @alexandre-daubois in #42

Full Changelog: v2026.11.02.2...v2026.11.02.3

v2026.11.02.2

What's Changed

• Score a worker held until its time limit as exhaustion, give a bypassed check an impact, and count script callbacks as attacker code by @alexandre-daubois in #41

Full Changelog: v2026.11.02.1...v2026.11.02.2

v2026.11.02.1

What's Changed

• Resume the agent session for the correction round through harness RunSession by @alexandre-daubois in #34
• Add setup subcommands by @alexandre-daubois in #36
• Pin the agent images built from c02013c by @github-actions[bot] in #37
• Decide the severity from the policy, add guidance packs and name upstream projects by @alexandre-daubois in #39
• Triage the selected advisories again with FORCE, keeping the previous triage when the new one fails by @alexandre-daubois in #40
• Run the triage on made-up reports with the real models behind an evals tag, and let a project list the reports it does not treat as vulnerabilities by @alexandre-daubois in #38

Full Changelog: v2026.10.30.3...v2026.11.02.1

v2026.10.30.3

What's Changed

• Quote the since description, whose colon broke the action manifest, and test that the manifest parses by @alexandre-daubois in #35
• Pin the agent images built from 98839ac by @github-actions[bot] in #33

Full Changelog: v2026.10.30.2...v2026.10.30.3

v2026.10.30.2

What's Changed

• Use GitHub Actions workflow lockfile by @TimWolla in #31
• Make since optional without comments and count the sub-issues of each issue as its duplicates by @alexandre-daubois in #32

New Contributors

• @TimWolla made their first contribution in #31

Full Changelog: v2026.10.30.1...v2026.10.30.2

v2026.10.30.1

What's Changed

• Bump to harness/v0.1.18 by @alexandre-daubois in #27
• Remove the get_advisory tool the duplicate search no longer uses by @alexandre-daubois in #28
• Pin the agent images built from ac1fe81 by @github-actions[bot] in #29
• Keep a private project board in sync with the triaged advisories by @alexandre-daubois in #26
• Release macOS and Windows binaries next to the Linux ones by @alexandre-daubois in #30

Full Changelog: v2026.10.28.3...v2026.10.30.1

v2026.10.28.3

Full Changelog: v2026.10.28.2...v2026.10.28.3

v2026.10.28.2

Full Changelog: v2026.10.28.1...v2026.10.28.2

v2026.10.28.1

What's Changed

• Ignore the severity, CVSS and CWE the reporter claims by @alexandre-daubois in #21
• Bound runs by time and fix two report rendering errors by @alexandre-daubois in #22
• Update dependencies released at least a week ago by @alexandre-daubois in #23
• Rewrite the documentation for readability by @alexandre-daubois in #24
• Pin the agent images built from 89bdca2 by @github-actions[bot] in #25

Full Changelog: v2026.10.27.1...v2026.10.28.1

v2026.10.27.1

What's Changed

• Use block style lists and wrap if conditions in workflows by @alexandre-daubois in #19
• Mark the oldest exact duplicate in the triage comment by @alexandre-daubois in #18
• Confirm private exact duplicates separately by @alexandre-daubois in #17
• Pin the agent images built from d0b469c by @github-actions[bot] in #20

Full Changelog: v2026.10.26.3...v2026.10.27.1