sif v2026.6.9

what's changed

• chore: clean up lint exclusions deferred in #98 (ece5b2b)
• fix(templates): guard tar extraction against path traversal (4fc0df5)
• Merge pull request #100 from vmfunc/cleanup/lint-exclusions-post-98 (8918be4)
• chore: bump copyright headers to 2026 (648fa8d)
• Merge pull request #105 from vmfunc/chore/copyright-2026 (1a1ff44)
• feat: add security header analysis scan (7efd62c)
• fix: data races and a progress divide-by-zero (af01678)
• chore: drop the unused worker pool (50c9933)
• chore: drop decorative emoji and redundant comments (9326465)
• docs: fix broken -all example and document -sh (94b99ad)
• Merge pull request #106 from vmfunc/feat/security-headers (3c070a6)
• feat: show release notes via patch notes (5e10c18)
• feat: ship a man page (f7ef71e)
• Merge pull request #107 from vmfunc/feat/patchnotes (75e953c)
• Merge pull request #108 from vmfunc/feat/manpage (4c650e2)
• refactor: dedupe url scheme stripping (133224c)
• fix(js): give supabase requests a real timeout (eb33321)
• Merge pull request #109 from vmfunc/refactor/url-helper (1231ca3)
• Merge pull request #110 from vmfunc/fix/supabase-timeout (76e8893)
• feat: stamp and surface the build version (661480a)
• test: hermetic e2e integration suite (ce3075a)
• Merge pull request #111 from vmfunc/feat/version (05fa35d)
• fix(frameworks): require a real signature match, fix cve version matching (29d94e5)
• Merge pull request #112 from vmfunc/test/e2e-integration (7f0e4cd)
• Merge pull request #113 from vmfunc/fix/frameworks-confidence (83ac92a)

install

homebrew / linuxbrew

# coming soon

debian / ubuntu

sudo dpkg -i sif_2026.6.9_amd64.deb

go install

go install github.com/dropalldatabases/sif/cmd/sif@v2026.6.9

binary download - grab the right archive from below.

verification

sha256sum -c checksums-sha256.txt