Release notes: Vibgrate CLI 2026.1020.1 — fail CI on exploit likelihood with --fail-on-epss

[vibgrate-team]

What's new in 2026.1020.1

Shipped 20 Oct 2026. Full release: https://github.com/vibgrate/cli/releases/tag/v2026.1020.1 · Changelog: https://vibgrate.com/changelog/cli/2026.1020.1

Gate CI on exploit likelihood, not just severity

The headline is a new flag: vg scan --fail-on-epss <threshold>. When any advisory's EPSS score (the probability it's exploited in the wild) meets or beats your threshold, the scan exits 2, so you can fail a build on the vulnerabilities that actually matter rather than every scary-looking CVSS number. Scan docs: https://vibgrate.com/cli/docs/scan-command

vg scan --fail-on-epss 0.1     # fail when any advisory has >=10% exploit probability

Smaller things you'll notice

• Better SBOMs: vg sbom export now marks development and optional dependencies correctly. Docs: https://vibgrate.com/cli/docs/sbom-command
• Clearer config: if several config files set different driftBudget values, vg now warns and tells you which file said what.
• Honest HTML reports: vg report --format html shows unmeasured DriftScores as n/a instead of a misleading number.
• Safer fixes: vg fix leaves an advisory open and restores your manifest and lockfile if an upgrade fails for any reason.
• Tighter review server: vg serve --review rejects invalid document IDs and paths.
• Faster builds: vg build now reads each project directory once for lockfile checks and source discovery.
• Security: the worker pool moves to tinypool 2.1.2, closing two critical advisories. Worth updating for this alone.

Try it

npm install -g @vibgrate/cli
vg --version                 # expect 2026.1020.1
vg scan

No-install try: npx @vibgrate/cli scan

Benchmarks (honest)

Two-arm benchmark vs 2026.1014.1 on the pinned corpus (236 metrics compared). Extraction held steady (19 languages, 27,156 definitions, 19,978 call edges, locate accuracy 0.94, dependency detection 0.96), and startup median stayed at ~789 ms. Four small regressions, published rather than hidden: token reduction vs baseline agent 0.26 → 0.26 (−1.1%), tasks passed on both arms 37 → 36, comparable-task rate 0.97 → 0.95, and median tool calls per task with vg 6 → 7. Details: https://vibgrate.com/cli/benchmarks

Discuss

• Tried --fail-on-epss? Tell us what threshold you settled on and why. We'd love real-world numbers.
• Anything feel different after updating that shouldn't? Reply here and we'll take a look.
• Docs gaps? Grab a good first issue or reply here.
• Roadmap thread: Public roadmap: make vibgrate/cli easy to discover, try, and contribute to #144

— maintainers (vibgrate-team)