v1.1.3: five more AI providers

Versyka's model retirement calendar now covers 14 providers. This release makes the Action recognise their model IDs in your code:

• Gateway prefixes xai/, deepseek/, perplexity/ and fireworks_ai/
• Vertex AI paths (projects/.../publishers/.../models/..., publishers/.../models/...), @001 versions and publisher/...-maas open models

Existing model IDs are matched exactly as before. Workflows on versyka/versyka-action@v1 get this automatically.

v1.1.2: security hardening

Security hardening. No change to inputs, outputs or what gets flagged. Workflows on versyka/versyka-action@v1 get this automatically.

Fixed

• Report table cells now escape backslashes as well as |, so a model ID or path can't break the Markdown of the job summary or pull request comment (CodeQL js/incomplete-sanitization).
• Each file is size-checked and read through one open file descriptor, so it can't change between the check and the read (CodeQL js/file-system-race).

Project

• SECURITY.md: report vulnerabilities privately (GitHub's private reporting is on).
• CodeQL scans every push and pull request.
• New CI cases: Bedrock IDs get Bedrock's own dates (v1.1.0), and a model named in a comment isn't counted (v1.1.1).
• OpenSSF Best Practices passing badge.

v1.1.1

Fewer false alarms: a model named in ordinary text is no longer reported as a call to it.

• "GPT-4, Claude and Gemini" in a sentence, sample text or a comment doesn't flag gpt-4.
• A capitalised name still counts when it's written as a value: quoted (model = "GPT-4") or after = (MODEL=GPT-4 in an .env file).
• Lowercase model IDs are matched exactly as before.

Same rule as the Versyka dashboard. @v1 now points here, so workflows using versyka/versyka-action@v1 get it automatically.

v1.1.0

Model retirements from hosting platforms. The retirement list now includes Amazon Bedrock and Groq, alongside OpenAI, Anthropic, Google Gemini, Mistral and Cohere.

• Bedrock model IDs such as anthropic.claude-3-haiku-20240307-v1:0 and meta.llama3-70b-instruct-v1:0 are matched in their own form, so Bedrock's own retirement dates apply (they can differ from the model maker's). Anthropic's own IDs keep Anthropic's dates.
• Azure and Together AI retirements are listed on the calendar for reference only: Azure code calls your own deployment names, and Together's model names are also Hugging Face names people run locally. They are never matched in your code.
• When two sources list one model ID, the later date is used, so a model that still works somewhere is never reported as retired.
• SDK checks cover 100+ API vendors on npm and PyPI.

versyka/versyka-action@v1 now points to this release; no workflow changes needed.

v1.0.0

First release: flags retired and retiring AI models (OpenAI, Anthropic, Google Gemini, Mistral, Cohere) and outdated API SDKs in pull requests, with dates, replacements and file:line.