v0.3.2

0.3.2 (2026-10-18)

Fixes

• config: treat benchmark folders as test code (d15d407)
• deep: look up assignments, functions, and call sites by key, not by scan (37fe38f)
• deep: look up assignments, functions, and call sites by key, not by scan (52691c8)
• go: leave test paths out of Capslock evidence (ba7c9b3)
• go: skip a go.mod folder that has no Go files (aa40d51)
• go: skip a go.mod folder that has no Go files (3ab9bb0)
• scan: show examples from more than one folder (#40) (78abc76)

v0.3.1

0.3.1 (2026-10-17)

Fixes

• deep: read the argument facts of each call, not of each line (fde300c)
• deep: read the argument facts of each call, not of each line (bc7030c)
• deps: bump the crates group across 1 directory with 3 updates (77773f2)
• deps: bump the crates group across 1 directory with 3 updates (063b20f)
• doctor: fail when a protected folder cannot be read (e0daf61)
• doctor: fail when a protected folder cannot be read (cd1d9c7)

v0.3.0

0.3.0 (2026-10-17)

Features

• javascript: read bun.lock (80c302f)
• javascript: read bun.lock (7e333d8)

v0.2.1

0.2.1 (2026-10-16)

Fixes

• deep: class untrusted input by the input arguments, not by options (d6b14c9)
• deep: class untrusted input by the input arguments, not by options (f8ee81b)
• doctor: check the configured rule folders and each file in a protected folder (990eebf)
• doctor: check the configured rule folders and each file in a protected folder (e647503)

v0.2.0

0.2.0 (2026-10-16)

Features

• action: write the report as an opt-in pull request comment (9b5a2ae)
• agent: read skill frontmatter, open code options, deny rules, and unknown install programs (a6235ea)
• ci: report script injection, head checkouts, and weaker action pins as risks (320dfd3)
• ci: report script injection, head checkouts, and weaker action pins as risks (d7cc1f2)
• deep: find privileged calls through aliases, constants, and global objects, and skip local shadows (2137e2f)
• deep: find the input class of each privileged call in own code (4bb33e5)
• deep: skip module members that a rule marks as inert (37746d9)
• doctor: check that code owners and branch rules protect the lock (283abfa)
• doctor: check that code owners and branch rules protect the lock (7441667)
• enforce deny rules on every power, trust only base rules, and report analysis gaps (d010110)
• find privileged calls by identity, not only by spelling (85596a1)
• javascript: report a module load whose name is not a literal as an analysis gap (b249894)
• report test code and unreadable module loads (bf0da67)
• report: list analysis gaps in every format and let a policy block new gaps (e58c3ca)
• report: put the result and the needed approval at the top of the report (0c18357)
• review: report changed risks and approve them in the lock (0f4d951)
• review: report changed risks and approve them in the lock (0d093e7)
• scan: report the powers of tests and fixtures as test code (9c443e9)

Fixes

• deep: class a command by its command arguments, not by its options or callback (a6a6da3)
• deep: class a command by its command arguments, not by its options or callback (ad727c1)
• deep: keep object and class methods from hiding a global call with the same name (9e36cc1)
• deep: keep object and class methods from hiding a global call with the same name (69f1540)
• deep: make risks only at sinks, not at each call into a package (58b4b82)
• deep: make risks only at sinks, not at each call into a package (c9eb892)
• packs: match fully qualified Java sockets and asyncio subprocesses (095b13f)
• review: block a denied power also when the report makes it a note (85966ec)
• scan: read custom rules from the merge base in a diff (fff0587)

Documentation

• add the benchmark results and the comparison with capslock-git-diff (371db5d)
• describe CI and agent risks, and the new surface powers (c5c790f)
• describe risks, their input classes, and their approval (8aef62d)
• describe the result summary, vigilante doctor, and the pull request comment (69a7d5f)
• split a long sentence in the CI risk record (a650b88)

v0.1.1

0.1.1 (2026-10-16)

Fixes

• deps: update zip to 9.0.3, because 9.0.0 to 9.0.2 are yanked (7ce70b3)

v0.1.0

0.1.0 (2026-10-15)

Features

• action: cache downloaded packages between runs (2b7e6f5)
• action: install Go and Capslock for repositories with Go modules (a796ca1)
• action: run vigilante from a GitHub Action (db8cc9a)
• agent: find powers in Claude, MCP, and Codex config (c6a17c3)
• agent: report only allow rules that run any code or read open content (602d50c)
• build: find install hooks and git hooks (a2cfe33)
• build: skip hooks that only run plain local commands (b2be0eb)
• ci: find new powers in GitHub workflows (5b4080c)
• ci: scope actions to all workflows and trust configured owners (32d329d)
• cli: add scan, lock, diff, and check commands (0cc79a5)
• code: add the ast-grep engine and 7 language packs (8260388)
• code: apply rule file globs and skip native in generated protobuf Go (64f9aa4)
• code: find file access, system state changes, and system calls in every pack (3a8ceb3)
• config: read vigilante.toml and find package-root scopes (d2dee14)
• config: skip test project folders such as App.Tests (6cec0de)
• csharp: dispatch calls through the class hierarchy (0ff9248)
• csharp: follow calls through own code and NuGet packages (8b1654c)
• deep: report a power reached through another own scope as a note (9b6eb44)
• go: block only on exec, network, and native in Go (4361576)
• go: block only on powers that a package reaches through its own code (5f5a368)
• go: find Go capabilities through dependencies with Capslock (8b397b8)
• java: dispatch calls through the class hierarchy (6dcfd16)
• java: follow calls through own code and Maven and Gradle packages (83b16e3)
• javascript: follow calls through own code and npm packages (b52d9f9)
• javascript: read pnpm-lock.yaml and load packages in parallel (d3dbb0c)
• javascript: read yarn.lock from yarn 1 and yarn 2 or later (a65302e)
• javascript: resolve calls with the TypeScript checker (ffb17c7)
• lock: write and read vigilante.lock (fdb230e)
• model: add every capability that Capslock reports (2854bfa)
• python: follow calls through own code and Python packages (42b4623)
• python: resolve calls with Pyright through scip-python (c2facbe)
• report the new powers that a pull request gives to code, CI, builds, and AI agents (40ee615)
• report: render Markdown, JSON, and SARIF reports (77402d5)
• resolve calls by type in JavaScript, TypeScript, Python, Rust, Java, and C# (98f33fa)
• review: compare base and head powers against the lock (8863bab)
• review: note new packages on Go call paths and show call paths in reports (dd26555)
• ruby: follow calls through own code and gems (cb4d8dc)
• rust: follow calls through own code and Cargo packages (71fb0f6)
• rust: resolve calls with rust-analyzer in a build with no network (9f955fb)
• tree: read files at a git commit and in a directory (5e452e2)

Fixes

• action: verify archives from the main branch build at the commit of the version tag (931b9b6)
• agent: see risky commands behind options and command wrappers (4d4d30e)
• build: check the scripts that npm runs before and after a script (2165578)
• ci: read GitHub expressions inside YAML flow lists (38a03db)
• ci: read secret names only inside GitHub expressions (5ea30ad)
• cli: name a folder that is not a git repository (f61f90e)
• cli: use singular nouns in the lock summary (943e19b)
• container: download the image inside the time limit of the build (2b4458c)
• container: download the image inside the time limit of the build (5127db4)
• container: keep the container alive past the deadline of its steps (a0d2099)
• container: keep the container alive past the deadline of its steps (75cb052)
• csharp: pass the Rust 1.99 clippy question_mark lint (c8c4a2e)
• deep: keep top-level code out of calls by method name (e20ea9f)
• deep: stop a type check at type_check_seconds and resolve calls by name (6b40eb1)
• deps: update rustls to 0.23.46 for four TLS advisories (055dc1b)
• docs: load the README logo from the repository (ad625c9)
• java: list a pom.xml that is not valid instead of stopping (d273b75)
• packs: count only okhttp clients and calls as Java network (54cff3c)
• packs: leave marker trait impls and wasm_bindgen imports out of Rust native (d00d0f5)
• packs: match nested use trees in the Rust exec and network rules (9035bcd)
• packs: match the module name in Python...