Skip to content

v2026.1020.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 20 Oct 09:31
· 25 commits to main since this release
v2026.1020.1
9c527f9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Vibgrate CLI 2026.1020.1

Released 2026-10-20

This release of the Vibgrate CLI includes important security updates, new features for advisory scoring, and several performance improvements. Additionally, there are changes to configuration handling and various bug fixes to enhance overall reliability.

What changed

New

  • vg scan --fail-on-epss <threshold> now exits 2 when any advisory's EPSS score meets or exceeds the specified threshold.

Improved

  • vg sbom export now correctly marks development and optional dependencies in the SBOM.

Changed

  • When multiple config files set different driftBudget values, vg prints a warning with details about each file.
  • vg review --base documentation now clarifies how review policies are read from the specified ref.

Fixed

  • vg report --format html now correctly displays unmeasured DriftScores as n/a.
  • vg serve --review now properly rejects invalid document IDs and paths.
  • vg fix now leaves an advisory open if the upgrade fails for any reason and restores the manifest and lockfile.

Performance

  • vg build now reads each project directory only once, optimizing lockfile checks and source discovery.

Security

  • The worker pool now uses tinypool 2.1.2, closing two critical advisories.

Benchmarks

Two-arm benchmark of this release against 2026.1014.1, interleaved on one runner against the pinned corpus (236 metrics compared).

Metric Previous This release
Languages with extraction 19 count 19 count
Definitions extracted (corpus total) 27156 count 27156 count
Call edges extracted (corpus total) 19978 count 19978 count
Locate accuracy (top-1) 0.94 ratio 0.94 ratio
Dependency detection (authored manifest truth) 0.96 ratio 0.96 ratio
CLI startup (--version, median) 789 ms 789.30 ms

4 regression(s) — published, not omitted:

  • Token reduction vs baseline agent (equal success): 0.26 → 0.26 (-1.1%)
  • Tasks passed on both arms: 37 → 36 (-2.7%)
  • Comparable-task rate (both arms passed / total): 0.97 → 0.95 (-2.7%)
  • Tool calls per task with vg (median, comparable tasks): 6 → 7 (16.7%)

Full report and methodology: https://vibgrate.com/cli/benchmarks

Install or update

npm install -g @vibgrate/cli
vg

Full changelog: https://vibgrate.com/changelog/cli/2026.1020.1

Assets 2
Loading