Code Polishy 0.31.9

• List the declared modules when --module names an unknown module, in every
  command that accepts one.
• Name the JSON pointer and target of a stale scope.pythonContracts entry in
  its diagnostic, including in plans written by older releases. Record each
  diagnostic's line and subject in upgrade plans and the upgrade plan terminal
  output once the outgoing release has this change. The plan is where to read an
  incoming release's new findings before cutover.
• Show how many advisories each fix covers in the VULNERABLE PACKAGES table
  instead of listing every advisory ID. The JSON report keeps the full list.
• Name the reported fixed versions and the assessment workflow in vulnerability
  remedies.
• Accept --display-limit all to list every finding in the human report.
• Add check --git-changes to the task-completion step in the agent workflow, so
  lint findings surface before a merge gate.
• Document how to find a release's index URL and digest, and that the published
  digest detects corruption only.
• Allow exact, expiring risk-accepted assessments for High findings, in
  dependencies and in declared container artifacts through the container
  ecosystem. Critical, unknown-severity and known-exploited findings stay
  ineligible, and OpenVEX remains the only container non-exposure surface.
• Require a person's approval for every risk-accepted assessment, named in the
  new approvedBy field. Existing Low and Moderate acceptances without it still
  load, but they stop applying and report
  policy.vulnerabilityAssessmentApproval until someone approves them.
• Report high and critical findings that passed under an assessment on an
  always-visible ASSESSED HIGH OR CRITICAL line.
• Identify container vulnerabilities by declared target name. Existing container
  findings get new fingerprints, so open ones appear as new errors in the next
  upgrade plan.
• Check the CISA Known Exploited Vulnerabilities catalog in the focused
  artifact-security command, not only in supply-chain.
• Match container assessments to the exact vulnerability ID reported by Trivy.
  Vendor bulletins that cover multiple vulnerabilities no longer act as aliases
  or merge distinct findings in the package summary.
• Update the optional JavaScript provider's transitive source-map-js dependency
  to the aged 1.2.2 fix and remove its expired vulnerability assessment.
• Assess minimatch's globparts amplification advisory against the exact resolved
  implementations and disabled optimization paths, with expiring non-exposure
  records for both JavaScript dependency graphs.

Native archives for Code Polishy 0.31.9.

Source revision: a68d03d
Publication index SHA-256: b4722be9e63bf8833f5a443b9beb2d707f79f37fa29b1124c55821d178459a97
OCI image: ghcr.io/riteofstring/code-polishy:v0.31.9@sha256:1b7026f1d3e6ef87ad42e5621e5739838776685ec050d41ae654e3a16a63319e