Code Polishy 0.33.0

• Update the Trivy scanner and its security assessments independently of Code
  Polishy through publisher-signed scanner packages. scanner-update previews
  an exact HTTPS package and --apply records its complete signed manifest in
  the repository lock. Scanner images, assessments, evidence and reassessment
  deadlines are authenticated by the publisher key carried in the release.
• Preserve compatible scanner selections across Code Polishy upgrades. Reject
  incompatible publishers or execution contracts, and prevent a scanner update
  from overwriting a concurrent release or scanner selection. Expired
  assessments block security acceptance while update and recovery remain
  available.
• Publish scanner packages through the protected scanner publication workflow,
  with installed scanner checks on Linux amd64 and arm64 before publication.
  Reports and reusable gate evidence identify the selected scanner manifest.
• Assess CVE-2026-78661 for the exact Trivy 0.76.1 scanner images after inspecting
  both Linux architectures. The affected HTML parser is absent from both
  executables; the authenticated assessment retains the finding visibly.
• Migration: after upgrading to this release, explicitly preview and apply a
  published scanner package with scanner-update --manifest URL --sha256 DIGEST
  and then the same command with --apply. Artifact-security checks require
  this selection; the bundled bootstrap fixture is not a default selection.

Native archives for Code Polishy 0.33.0.

Source revision: 2c90297
Publication index SHA-256: 01e174a4894e54f83e617e2554e1016a40111f2606cfd86e9782f38b71f54deb
OCI image: ghcr.io/riteofstring/code-polishy:v0.33.0@sha256:3bbf7dafd91bf06a0f79b311cc753dd1aa441a550e8484317d1df941db2f635e

scanner-v1.0.0

Signed scanner manifest; execution and security policy remain owned by Code Polishy.

Code Polishy 0.32.2

• Document finding a release index digest by hashing the immutable release's
  index over HTTPS; GitHub CLI is no longer needed to adopt, upgrade or
  release.
• Report every packed file that fails bundled-dependency verification as its
  own architecture.importCoverage finding; failures in several files were
  merged into one. An unresolved relative declaration import now names the
  consumer configurations that cannot resolve it, counts the other unresolved
  imports in that file, and suggests the explicit extension NodeNext requires
  when the target is packed, instead of reporting it as a missing artifact.

Native archives for Code Polishy 0.32.2.

Source revision: 422d2ca
Publication index SHA-256: 61d197f7299ef727b194b4d4706b9a27e2c9b4a05e0240455f79246a953ceea4
OCI image: ghcr.io/riteofstring/code-polishy:v0.32.2@sha256:b250203449e0704fd9e88467bd41754a3fbaac9373425733343c732b338185e8

Code Polishy 0.32.1

• Fix merge-gate aborting during artifact-security scanner self-scanning by
  matching the planned scanner image command names and order to execution.
• Allow exact scope.bundledDependencies declarations for packages inlined from
  devDependencies. A declaration authorizes the owning package's source
  imports of the listed names and names the package's packed .tgz, whose
  shipped JavaScript and public declarations are statically inspected for
  visible imports of those names. Leaked imports, missing or unreadable archives
  and artifacts, and contradictory manifest declarations fail. An empty result
  is not proof of runtime independence; validate shipped behavior with the
  package's own packed-consumer tests. Upgrade the locked release before using
  the new configuration.

Native archives for Code Polishy 0.32.1.

Source revision: 75ae89a
Publication index SHA-256: 6644183885b6fe8eeba48ca1a0ef6d51dcc57c593b4e80dcaa42a67940b60b68
OCI image: ghcr.io/riteofstring/code-polishy:v0.32.1@sha256:f86db57a14afd14c9262c866768a72b3ca5c6ea1bcb77e1a2866ab0a24f2c515

Code Polishy 0.32.0

• Remove the 12-item limit on AGENTS.md project principles. The section remains
  limited to 5 KiB, with at most 400 UTF-8 bytes per principle.

Native archives for Code Polishy 0.32.0.

Source revision: 084e44a
Publication index SHA-256: a3ca55574c7c13a5a9c0d7a8e7d232694ae41ff6b0fd99ef6ba23816837a0eaf
OCI image: ghcr.io/riteofstring/code-polishy:v0.32.0@sha256:9a55d596ef4f538b521478013ddfa617ed17e5e7fd4431dd5224d09a6369d636

Code Polishy 0.31.10

• Use GitHub immutable releases for future publications, with automatically
  signed records binding the release tag, source commit and asset digests.
  Document how to obtain a verified index digest and authenticate downloads
  with GitHub CLI. Existing releases through 0.31.9 remain unattested.

Native archives for Code Polishy 0.31.10.

Source revision: d0ffaad
Publication index SHA-256: 8cc1f34693b167b56faf1647ac908c6eef46407d8eb8b28355444289d4a9da14
OCI image: ghcr.io/riteofstring/code-polishy:v0.31.10@sha256:40fd936d2ed265ca62e3f758be8786f5c4cce2994d9ea76895a6e4bdab3756ad

Code Polishy 0.31.9

• List the declared modules when --module names an unknown module, in every
  command that accepts one.
• Name the JSON pointer and target of a stale scope.pythonContracts entry in
  its diagnostic, including in plans written by older releases. Record each
  diagnostic's line and subject in upgrade plans and the upgrade plan terminal
  output once the outgoing release has this change. The plan is where to read an
  incoming release's new findings before cutover.
• Show how many advisories each fix covers in the VULNERABLE PACKAGES table
  instead of listing every advisory ID. The JSON report keeps the full list.
• Name the reported fixed versions and the assessment workflow in vulnerability
  remedies.
• Accept --display-limit all to list every finding in the human report.
• Add check --git-changes to the task-completion step in the agent workflow, so
  lint findings surface before a merge gate.
• Document how to find a release's index URL and digest, and that the published
  digest detects corruption only.
• Allow exact, expiring risk-accepted assessments for High findings, in
  dependencies and in declared container artifacts through the container
  ecosystem. Critical, unknown-severity and known-exploited findings stay
  ineligible, and OpenVEX remains the only container non-exposure surface.
• Require a person's approval for every risk-accepted assessment, named in the
  new approvedBy field. Existing Low and Moderate acceptances without it still
  load, but they stop applying and report
  policy.vulnerabilityAssessmentApproval until someone approves them.
• Report high and critical findings that passed under an assessment on an
  always-visible ASSESSED HIGH OR CRITICAL line.
• Identify container vulnerabilities by declared target name. Existing container
  findings get new fingerprints, so open ones appear as new errors in the next
  upgrade plan.
• Check the CISA Known Exploited Vulnerabilities catalog in the focused
  artifact-security command, not only in supply-chain.
• Match container assessments to the exact vulnerability ID reported by Trivy.
  Vendor bulletins that cover multiple vulnerabilities no longer act as aliases
  or merge distinct findings in the package summary.
• Update the optional JavaScript provider's transitive source-map-js dependency
  to the aged 1.2.2 fix and remove its expired vulnerability assessment.
• Assess minimatch's globparts amplification advisory against the exact resolved
  implementations and disabled optimization paths, with expiring non-exposure
  records for both JavaScript dependency graphs.

Native archives for Code Polishy 0.31.9.

Source revision: a68d03d
Publication index SHA-256: b4722be9e63bf8833f5a443b9beb2d707f79f37fa29b1124c55821d178459a97
OCI image: ghcr.io/riteofstring/code-polishy:v0.31.9@sha256:1b7026f1d3e6ef87ad42e5621e5739838776685ec050d41ae654e3a16a63319e

Code Polishy 0.31.8

• Recognize pytest hook implementations as framework callbacks. Resolved
  pytest.hookimpl decorators are preserved in any form, including import
  aliases, wrappers and plugin classes, as are module-level pytest_* functions
  in conftest.py. Exact pytest.hookimpl decorator contracts remain valid but
  are no longer required.
• Classify conftest.py at any depth as test infrastructure. Root files no longer
  need tests.paths, and an existing declaration remains valid. A repository
  that kept conftest.py in a production module must now declare its test
  ownership in tests.ownership.
• Reject stale scope.pythonContracts declarations that built-in evidence made
  appear resolved. Autouse fixtures, pytestmark and daemon_threads no longer
  count as a contract's match, so a stale declaration they previously hid now
  fails with its existing diagnostic.

Native archives for Code Polishy 0.31.8.

Source revision: 7487d9b
Publication index SHA-256: e0c537d6b2d97281889565ab3d4a6752a56f2a92d077fb89e69d2f28f1b95ea7
OCI image: ghcr.io/riteofstring/code-polishy:v0.31.8@sha256:2b68f61bed05caa25fe6a77fc7019848f5c60371a1d57ee0471a8229c14355b2

Code Polishy 0.31.7

• Run artifact scans on rootless Docker daemons. The scanner uses 0:0, the
  calling user inside the daemon's namespace, for its cache, input and output
  mounts while keeping its container restrictions.
• Honor DOCKER_HOST, DOCKER_CONTEXT, DOCKER_CONFIG, DOCKER_TLS_VERIFY and
  DOCKER_CERT_PATH for Docker commands. Refuse remote endpoints before contacting
  them, because scans bind-mount private local files.
• Name the failing phase, Docker daemon and mode, scanner user and private mounts
  in artifact operational failures, with a remedy specific to the failure.
• Allow one vulnerability assessment to list advisories for the same package,
  version and scope. Each advisory is still matched, reported and enforced
  separately. Consumers must upgrade their lock before declaring the field.
• Explain how to re-review an assessment after a severity increase instead of
  directing its removal.
• Add a VULNERABLE PACKAGES table to human reports, and carry reported fixes
  from OSV and Trivy in vulnerability.fixedVersions.
• Document script-free installation with Python Git sources through a reviewed,
  hash-constrained build step.

Native archives for Code Polishy 0.31.7.

Source revision: ea34c55
Publication index SHA-256: 1516473051570c0ec5ecd6697dd531ab4e46ee97a8be60fcb1427ef7b94cada7
OCI image: ghcr.io/riteofstring/code-polishy:v0.31.7@sha256:e6d9096e399131a0d068ef298ff57bcfae520e8d7c26075bb499a6e2e48eaa03

Code Polishy 0.31.6

• Support published Python library compatibility constraints in runtime and
  optional metadata through exact supplyChain.pythonLibraries manifest paths.
  Require matching exact development-group pins covering dependency extras and
  environment markers, and check version membership with the pinned PEP 440
  parser, including prereleases and local version suffixes.
• Use the same tested development pins for external Python dependency contracts,
  retaining exact lock and installed-distribution evidence with library ranges.
• Preserve distinct Python registry constraints through inventory and retain
  frozen lock verification for dependency resolution. Development requirements,
  build requirements, tool pins and resolved dependency audits remain enforced.
• Preserve Python dependency groups, extras and markers in dependency review,
  and identify published compatibility changes as package API changes even when
  the lock is unchanged.
• Document library adoption and clean-wheel minimum-version verification.
  Consumers must upgrade their Code Polishy lock before declaring
  supplyChain.pythonLibraries; existing configurations retain exact-pin policy.
• Authorize command producers to receive the private artifact output path and
  override inherited output settings so generated artifacts stay within the
  private evidence directory. Contributed by
  Jeff Musgrave in
  #18.
• Assess CVE-2026-116587 for the pinned scanner's isolated execution paths with
  an exact OpenVEX statement and source-backed review. Preserve the observed
  finding in the accepted-findings report.

Native archives for Code Polishy 0.31.6.

Source revision: 190a0d3
Publication index SHA-256: ce046df26c7f471aaef62c4ca3d0176168c01501c776aeb4c1c3757dc2a06171
OCI image: ghcr.io/riteofstring/code-polishy:v0.31.6@sha256:7ed64bf87911f069ab3215ab044d611ddec0b391db03bcb7e52ef4eb7941094b