Skip to content

v2026.1005.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 05 Oct 08:42
· 41 commits to main since this release
v2026.1005.1
0449c37
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Vibgrate CLI 2026.1005.1

Released 2026-10-05

This release of the Vibgrate CLI introduces several new features and fixes that enhance the scanning and reporting capabilities. Key improvements include better handling of vulnerabilities and license findings, as well as enhanced documentation for SBOM exports.

What changed

New

  • vg scan --baseline now records findings that match the baseline, including a detailed JSON output.
  • vg scan --vulns --format json now includes additional fields like epss, epssPercentile, and kev when available.
  • vg scan --vulns --offline --package-manifest documents the local manifest shape and ensures consistent findings order.
  • vg scan --junit <file> generates a deterministic JUnit XML report alongside other formats.
  • DOCS.md now lists various command messages and the next command for each.

Improved

  • vg sbom export documentation now clarifies how resolved versions are identified.
  • vg scan --vulns --format sarif now writes one result per package and advisory, improving clarity.

Fixed

  • vg scan and vg report correctly indicate when a vulnerability has a fix available.
  • Direct Go modules without a v version are now handled correctly in the code graph.
  • License findings in JSON and SARIF now include the repository path of the manifest when recorded.

Security

  • Sensitive information is now redacted from registry and upload error messages.

Benchmarks

Two-arm benchmark of this release against 2026.1003.3, interleaved on one runner against the pinned corpus (236 metrics compared).

Metric Previous This release
Languages with extraction 19 count 19 count
Definitions extracted (corpus total) 26499 count 26499 count
Call edges extracted (corpus total) 18833 count 18833 count
Locate accuracy (top-1) 0.94 ratio 0.94 ratio
Dependency detection (authored manifest truth) 0.96 ratio 0.96 ratio
CLI startup (--version, median) 727.30 ms 729.70 ms

2 regression(s) — published, not omitted:

  • Agent tokens with vg (comparable tasks, total): 578766 → 636808 (10.0%)
  • Tool calls per task with vg (median, comparable tasks): 6 → 7 (16.7%)

Full report and methodology: https://vibgrate.com/cli/benchmarks

Install or update

npm install -g @vibgrate/cli
vg

Full changelog: https://vibgrate.com/changelog/cli/2026.1005.1

Assets 2
Loading