ThreatCrush 0.11.1

What's Changed

• fix(scan): exempt the metasyntactic credential pair in a DSN by @ralyodio in #107
• fix(scan): take notice of a gosec G101 annotation already on the line by @ralyodio in #108
• Add tcfeed: a ranked shortlist of repositories worth scanning by @ralyodio in #109
• feat(tcfeed): add tcfeed pr, which installs the scan workflow by @ralyodio in #110
• fix(tcfeed): make tcfeed pr actually fork, and add tcfeed check by @ralyodio in #111
• fix(auth): complete GitHub OAuth with cookie-backed PKCE by @rissrice2105-agent in #113
• feat(tcfeed): read GitHub search as well as the subreddit by @ralyodio in #114
• feat(tcfeed): bound the search at 1k..10k stars by @ralyodio in #115
• feat(tcfeed): add pr --all, the last scan worst first by @ralyodio in #116
• feat(tcfeed): raise the pr cap to 20, matching the scan by @ralyodio in #117
• feat(tcfeed): add RSS feeds as a third source, kept as OPML by @ralyodio in #118
• fix(tcfeed): report why a command failed, and recover a stale fork branch by @ralyodio in #119
• feat(tcfeed): ask first, then offer, then clean up after itself by @ralyodio in #121
• feat(tcfeed): budget the account, and refresh the requests already sent by @ralyodio in #122
• feat(tcfeed): refresh open requests to the current pack by @ralyodio in #123
• feat(tcfeed): raise the daily budget to 20, matching the run cap by @ralyodio in #124
• feat(tcfeed): show what the scanner actually does, before asking by @ralyodio in #125
• fix(tcfeed): one unreadable repository must not end the batch by @ralyodio in #126
• fix(tcfeed): finish a pair the run left half-open by @ralyodio in #127
• feat(tcfeed): make the budget a backstop, not a pace by @ralyodio in #128
• feat(tcfeed): do not offer a scanner to a repository that has one by @ralyodio in #129
• fix(auth): persist PKCE verifier storage by @rissrice2105-agent in #131
• feat(tcfeed): sign off every commit so a DCO check cannot block the ask by @ralyodio in #132
• feat(tcfeed): keep repositories nobody has starred out of the table by @ralyodio in #133
• feat(tcfeed): resolve the tarball hash alongside the version pin by @ralyodio in #134
• feat(tcfeed): say that the workflow verifies the hash, not just the pin by @ralyodio in #135
• feat(scan): Node.js SAST coverage — ecosystem rules, template engines… by @ralyodio in #137
• fix(tcfeed): stop telling --refresh it changed nothing by @ralyodio in #136
• feat(tcfeed): offer a version that asks for no write access at all by @ralyodio in #138
• feat(tcfeed): make the ask short enough to read, and true by @ralyodio in #139
• feat(tcfeed): stop asking repositories that have already said no to strangers by @ralyodio in #140
• fix(scan): stop reading C pointer casts as ReDoS by @ralyodio in #141
• fix(desktop): repair the Chromium sandbox on Ubuntu 24.04+ by @ralyodio in #142

Full Changelog: v0.11.0...v0.11.1