PenX v0.4.9

Availability: PenX v0.4.7 Windows installer and portable ZIP are published, with SHA-256 checksums. Source archives generated automatically by GitHub are not ready-to-run Windows applications.

Which Windows download should I choose?

✅ Recommended: Windows Installer

PenX-Setup-x64.exe — best for most Windows 10/11 (64-bit) users.

• Installs PenX with a Start menu entry and an uninstall option.
• Saves your configuration, scan history and reports separately in %LOCALAPPDATA%\PenX so app updates do not overwrite them.
• Supports Check for Updates inside PenX. Installing an update always requires your confirmation.

📦 Alternative: Portable (no installation)

PenX-Windows-x64.zip — for users who prefer a portable folder.

• Download and extract the entire ZIP, then run PenX\PenX.exe.
• Keep the _internal folder and other extracted files with the executable.
• No Windows installer needed; you update manually by downloading a newer ZIP.
• Existing portable configuration and reports remain in your portable directory.

Not sure? Choose PenX-Setup-x64.exe. Both downloads contain the same PenX app version.

Important: Do not choose GitHub's automatically generated Source code (zip) if you want a ready-to-run Windows app. Neither download bundles third-party scanners (such as Nmap/Npcap) or a local AI model; PenX can guide scanner setup with your consent.

You can verify either download using SHA256SUMS.txt from the same release. See the Windows installation and migration guide before switching from the portable version to the installer.

---

What's Changed

• ci(release): one-shot v0.4.8 tag and tagged Windows release dispatch by @spk-c in #43
• ci(release): use authenticated Git push for audited v0.4.8 tag creation by @spk-c in #44
• docs(release): publish 0.4.8 download links, Scoop checksum and remove one-shot trigger by @spk-c in #45
• docs: clarify v0.4.8 field acceptance and closed tracking issues by @spk-c in #46
• fix: robust release metadata checks and fail-closed web target parsing by @spk-c in #47
• fix: reject alternative local-IP page URLs and invalid LLM endpoint configuration by @spk-c in #48
• fix(scanners): prevent empty output from being marked as evidence by @spk-c in #49
• fix(research): preserve valid search results while bounding untrusted provider output by @spk-c in #50
• fix(advisories): always close WordPress GitHub API responses by @spk-c in #51
• fix(scan-diff): reject invalid Nmap ports and avoid false port changes by @spk-c in #52
• fix(cve): fail closed on malformed CVSS and EPSS priority scores by @spk-c in #53
• fix(risk): preserve reviewed scores and techniques on partial override edits by @spk-c in #54
• fix(parsers): prevent reviewer or sample text from setting final risk level by @spk-c in #55
• fix(recovery): prevent partial scan and AI assessment backup files by @spk-c in #56
• fix(audit): eliminate cache and inventory stat/read races by @spk-c in #57
• fix(audit): prevent DNS rebinding in public HTTPS research by @spk-c in #58
• docs(audit): reconcile fixed findings and remaining Windows acceptance gates by @spk-c in #59
• fix(scanners): do not classify malformed Subfinder/Katana output as successful discovery by @spk-c in #60
• fix(trends): reject impossible and non-public Shodan IPs in scan diffs by @spk-c in #61
• fix(research): block multicast addresses at HTTPS URL and DNS socket checks by @spk-c in #62
• fix(vendor): prevent Debian tracker snapshot stat/read race by @spk-c in #63
• fix(reports): use fsynced exclusive publisher for JSON and SARIF by @spk-c in #64
• fix(ffuf): enforce wordlist byte limit on an opened non-symlink file by @spk-c in #65
• fix(reports): redact IPv6 literals from JSON/SARIF exports by @spk-c in #67
• fix(nvd): strictly validate CVE IDs and keep good candidates despite bad links by @spk-c in #66
• fix(analysis): bound scanner/search tool context returned to local LLM by @spk-c in #68
• fix(verification): prevent duplicate source annotations on repeated assessments by @spk-c in #69
• fix(osv): reject malformed external vulnerability identifiers by @spk-c in #70
• fix(llm): apply structured report budgets before JSON/schema traversal by @spk-c in #71
• fix(advisories): validate GitHub GHSA identities and linked advisory URLs by @spk-c in #72
• fix(priority): stale EPSS scores must not survive unsuccessful refreshes by @spk-c in #73
• fix(sources): refresh NVD and CISA KEV status caches after 24 hours by @spk-c in #74
• fix(nvd): enforce concrete CPE versions even when range bounds exist by @spk-c in #76
• fix(sources): expire in-memory NVD cache and isolate KEV membership sets by @spk-c in #75
• fix(reports): prevent manifest stat/read and symlink swap races by @spk-c in #77
• fix(analysis): cap reviewer evidence across many scanner sections by @spk-c in #78
• docs: remove REFACTOR_ACCEPTANCE.md by @spk-c in #79
• chore: clean stale docs, track remaining work, prune verified merged branches by @spk-c in #83
• release: prepare PenX v0.4.9 with CI-gated tagged Windows publication by @spk-c in #84

Full Changelog: v0.4.8...v0.4.9