Release notes: Vibgrate CLI 2026.1027.1 — accurate Maven SBOM scopes and a safer --drift-worsening

[vibgrate-team]

What's new in 2026.1027.1

Shipped 27 Oct 2026. Full release: https://github.com/vibgrate/cli/releases/tag/v2026.1027.1 · Changelog: https://vibgrate.com/changelog/cli/2026.1027.1

A small, focused release: two fixes that make your SBOMs and your CI gates tell the truth.

Maven SBOMs that know test from runtime

vg sbom export now reads Maven pom.xml scopes properly. Dependencies with <scope>test</scope> are marked as development dependencies, and <optional>true</optional> ones are marked optional. If you ship SBOMs to customers or feed them into a policy engine, your runtime surface for Java projects should now look noticeably leaner and more accurate. Thanks to everyone who reported this one.

vg sbom export --format cyclonedx --out sbom.cdx.json

SBOM docs: https://vibgrate.com/cli/docs/sbom-command

--drift-worsening no longer trips without a baseline

Running vg scan --drift-worsening on a first run (no --baseline yet) used to fail the scan. Now it does the sensible thing: the DriftScore is still measured, the comparison is skipped, and the JUnit case is skipped rather than failed. That makes it safe to switch the flag on in CI before your first baseline exists.

Scan docs: https://vibgrate.com/cli/docs/scan-command

Try it

npm install -g @vibgrate/cli
vg --version                 # expect 2026.1027.1
vg scan

No-install try: npx @vibgrate/cli scan

Benchmarks (honest)

Two-arm benchmark vs 2026.1023.1 on the pinned corpus (236 metrics compared). Extraction held steady (19 languages, 27,259 definitions, 20,136 call edges, locate accuracy 0.95, dependency detection 0.96), and CLI startup median dropped from 553 ms to 532 ms. Two regressions, published rather than hidden: token reduction vs baseline agent 0.26 → 0.24 (−5.8%), and total agent tokens with vg on comparable tasks 613,437 → 641,483 (+4.6%). Details: https://vibgrate.com/cli/benchmarks

Discuss

• Exporting SBOMs for Maven projects? Tell us whether the dev/optional split now matches what you expect.
• Using --drift-worsening in CI? We'd love to hear how you manage baselines.
• Docs gaps? Grab a good first issue or reply here.
• Roadmap thread: Public roadmap: make vibgrate/cli easy to discover, try, and contribute to #144

— maintainers (vibgrate-team)