v2026.1023.1

Vibgrate CLI 2026.1023.1

Released 2026-10-23

This release of Vibgrate CLI includes several important fixes and improvements, particularly around dependency handling and security updates. Users should review the changes related to the vg sbom export command and the new GitHub Action feature for enhanced scanning capabilities.

What changed

New

• The GitHub Action accepts fail-on-epss, allowing users to set a probability threshold for failure.

Improved

• Documentation now clarifies network usage for vg ask steps and evidence handling on air-gapped machines.

Fixed

• vg sbom export correctly marks optional dependencies in Cargo.toml and Poetry files.
• vg build now correctly maps directories outside the working directory as their own projects.
• The code map retains Java call and dependency-injection edges for generic types.
• vg build follows YAML anchors and aliases in GitHub Actions workflow files.

Security

• vg serve now installs a patched Model Context Protocol library, addressing two high-severity advisories.

Benchmarks

Two-arm benchmark of this release against 2026.1020.1, interleaved on one runner against the pinned corpus (236 metrics compared).

Metric	Previous	This release
Languages with extraction	19 count	19 count
Definitions extracted (corpus total)	27227 count	27227 count
Call edges extracted (corpus total)	20087 count	20089 count
Locate accuracy (top-1)	0.94 ratio	0.94 ratio
Dependency detection (authored manifest truth)	0.96 ratio	0.96 ratio
CLI startup (--version, median)	496.10 ms	493.50 ms

4 regression(s) — published, not omitted:

• Token reduction vs baseline agent (equal success): 0.26 → 0.26 (-1.1%)
• Tasks passed on both arms: 37 → 36 (-2.7%)
• Comparable-task rate (both arms passed / total): 0.97 → 0.95 (-2.7%)
• Tool calls per task with vg (median, comparable tasks): 6 → 7 (16.7%)

Full report and methodology: https://vibgrate.com/cli/benchmarks

Install or update

npm install -g @vibgrate/cli
vg

Full changelog: https://vibgrate.com/changelog/cli/2026.1023.1