v0.10.1

pinprick v0.10.1

Fixes

• grant workflows:write to bump-cargo-tools token
• flag pip git+URL refs that track a branch
• don't flag multi-stage FROM or FROM scratch
• surface config-parse errors instead of swallowing them
• serialize audited-action cache through serde
• match ignore.actions on path boundaries
• sanitize control characters in terminal output
• close runtime-fetch detection bypasses
• harden the HTTP client (timeouts, body cap, secondary limits)
• correct advisory matching and enrichment error handling
• match advisories by package and parse GitHub range syntax
• isolate per-file failures, handle quoted refs and CRLF
• config case-insensitivity, safe fallback, version-token comments
• guard cache paths and warn on malformed bundled JSON

Performance

• skip vendored dependency dirs when scanning action source
• fetch action source files concurrently

Documentation

• add score/completions pages, splash landing, custom 404
• update Claude co-author trailer to Opus 4.8
• trim verbose comments to their kernel

Other

• isolate per-test HOME and make clean tests deterministic
• cover network paths with a wiremock seam

---

Full Changelog: v0.10.0...v0.10.1