PenX v0.4.8

Availability: PenX v0.4.7 Windows installer and portable ZIP are published, with SHA-256 checksums. Source archives generated automatically by GitHub are not ready-to-run Windows applications.

Which Windows download should I choose?

✅ Recommended: Windows Installer

PenX-Setup-x64.exe — best for most Windows 10/11 (64-bit) users.

• Installs PenX with a Start menu entry and an uninstall option.
• Saves your configuration, scan history and reports separately in %LOCALAPPDATA%\PenX so app updates do not overwrite them.
• Supports Check for Updates inside PenX. Installing an update always requires your confirmation.

📦 Alternative: Portable (no installation)

PenX-Windows-x64.zip — for users who prefer a portable folder.

• Download and extract the entire ZIP, then run PenX\PenX.exe.
• Keep the _internal folder and other extracted files with the executable.
• No Windows installer needed; you update manually by downloading a newer ZIP.
• Existing portable configuration and reports remain in your portable directory.

Not sure? Choose PenX-Setup-x64.exe. Both downloads contain the same PenX app version.

Important: Do not choose GitHub's automatically generated Source code (zip) if you want a ready-to-run Windows app. Neither download bundles third-party scanners (such as Nmap/Npcap) or a local AI model; PenX can guide scanner setup with your consent.

You can verify either download using SHA256SUMS.txt from the same release. See the Windows installation and migration guide before switching from the portable version to the installer.

---

What's Changed

• Refactor follow-ups: published v0.4.7 docs, model-client isolation and static coverage by @spk-c in #15
• Maintenance: add safe dry-run cleanup for merged GitHub branches by @spk-c in #16
• Fix PowerShell 5.1 merged-branch cleanup array enumeration by @spk-c in #17
• Issue #13: isolate local LLM POST transport and research progress from terminal by @spk-c in #18
• fix: eliminate false positives from legacy import inventory (#14) by @spk-c in #19
• fix: release HTTP connections after LLM model discovery by @spk-c in #20
• fix: reject malformed LLM SSE frames and redact port metadata by @spk-c in #21
• fix: fail closed on malformed NVD and CISA KEV API data by @spk-c in #22
• fix: avoid live scanner timeout crash after early output EOF by @spk-c in #23
• fix: close HTTP responses in HTML research fetcher by @spk-c in #24
• fix: prevent typed reasoning blocks from becoming LLM output by @spk-c in #25
• fix: fail closed on invalid scanner adapter return values by @spk-c in #26
• fix: exclude failed scanner evidence and cap model tool dispatch by @spk-c in #27
• fix: deduplicate CVE source requests within each assessment by @spk-c in #28
• fix: fail closed on malformed Censys services in passive recon by @spk-c in #29
• fix: reject malformed host ports and bracketed IPv6 targets by @spk-c in #30
• quality: audit all Python modules and exercise SQLite v2 restore/Windows scanner processes by @spk-c in #31
• fix: reject report staging symlinks and external renderer files by @spk-c in #32
• fix: use consistent SQLite read snapshots for session reports by @spk-c in #33
• fix: serialize concurrent report publishing and deletion per session by @spk-c in #34
• fix: read evaluation and distillation exports from one SQLite snapshot by @spk-c in #35
• fix: serialize concurrent evaluator imports before duplicate checks by @spk-c in #36
• fix: pin a consistent SQLite snapshot for training-data exports by @spk-c in #37
• fix: serialize finding deletion with correction, fix and evaluation writes by @spk-c in #38
• fix: bounded SQLite BUSY retries for safe session writer-lock acquisition by @spk-c in #39
• fix: address SQL, scanner, storage and report audit findings by @spk-c in #41
• fix(security): gate model web search, bound page downloads and isolate malformed NVD data by @spk-c in #40
• release: prepare v0.4.8 for audit-fix Windows release by @spk-c in #42

Full Changelog: v0.4.7...v0.4.8