1.4.1 (2026-08-11)
1.4.0 (2026-08-11)
- support folder scans (721026d)
1.3.9 (2026-07-29)
- keep domain structural smell positives (a8b5a62)
- retune precision for monorepo false positives (7422df9)
- satisfy precision retune lint checks (d55e5ec)
1.3.8 (2026-07-28)
- credit typescript null narrowing (be628a4)
- focus integer overflow on allocation risk (712ac16)
- make boolean naming precision contract based (b1da7ca)
- narrow boundary input detection (31c1bc4)
- remove unused boolean expression parameter (8f0b1af)
- retune naming and return precision (43813e4)
- retune quality precision false positives (c61b831)
- skip validation throws in control-flow rule (280ccdd)
1.3.7 (2026-07-28)
- narrow defensive precision broadening (3a237f0)
- reduce defensive false positives (81388fd)
- reduce defensive precision false positives (#85) (4ce5e1d)
1.3.6 (2026-07-28)
- report retry-mitigated sequence debt (8c7a6d5)
- retune defensive precision followups (a9367ae)
- retune defensive precision followups (#83) (ef6111a)
- treat allocators as command style (4d7dfa9)
1.3.5 (2026-07-28)
- cover remaining precision retunes (1fd6f2b)
- retune precision false positives (6a09863)
- retune precision false positives (#81) (a63ff23)
- split defensive sequence collision signal (c734e9a)
1.3.4 (2026-07-28)
1.3.3 (2026-07-28)
- reduce high-volume precision false positives (cb19b29)
- reduce high-volume precision false positives (#77) (4cdd646)
1.3.2 (2026-07-28)
- add next and nest framework precision coverage (220826e)
- harden react false positive handling (2fde7bb)
- harden React false positive handling (#75) (752bd41)
1.3.1 (2026-07-28)
- harden hidden mutation precision (8f77a74)
- harden UI false positive precision (b46dfe7)
- react hook hidden mutation noise (#73) (3fa1b1c)
- reduce hidden mutation noise for React hooks (c4f61c9)
- satisfy lint for false positive hardening (62643da)
1.3.0 (2026-07-27)
- add abstraction quality checks (fc5a7ec)
- add change safety diff detectors (ebc2f80)
- add change safety PR summary metrics (5b10ecd)
- add delivery governance checks (eb1b803)
- add local quality precision rules (dd75b79)
- add local quality precision rules (00c493e)
- add observability and operations checks (3e8713c)
- add operability, design, and delivery governance checks (#70) (a52199a)
- add opt-in recommended check defaults (1680b21)
- add opt-in recommended check defaults (#66) (67510e3)
- add production readiness rule families (d58e8eb)
- Add production reliability and data-readiness checks across languages (#67) (c243ead)
- add refused bequest smell detection (053cb1a)
- add refused bequest smell detection (#72) (4423aa4)
- add structural smell quality rules (eefd8bd)
- change safety testability refactors (#69) (9081ad3)
- deepen code smell and maintainability precision checks (#71) (d554347)
- deepen reliability parity checks (fc8d769)
- expand production readiness language coverage (588bf19)
- scaffold change safety checks (0b313d9)
- dogfood production readiness coverage (1110f4f)
- restore change testability detectors (88f6df0)
- satisfy strict lint for change safety (311716c)
- satisfy strict lint for operability governance (abc9fd1)
1.2.2 (2026-07-25)
- parse pnpm lockfile package entries (11acbd6)
- reduce AI quality false positives (fd5d103)
- reduce AI quality false positives (dc61f7e)
- reduce AI quality false positives (#64) (b80b5c3)
- resolve TypeScript pnpm imports (154adc3)
- resolve TypeScript pnpm imports (#63) (4d3cc59)
- satisfy import resolver lint (fcec2dc)
1.2.1 (2026-07-23)
- bound TypeScript semantic analysis to scan corpus (f473e6e)
- bound TypeScript semantic analysis to scan corpus (#61) (685cf99)
1.2.0 (2026-07-21)
- add agent-native repository guardrails (86f7142)
1.1.2 (2026-07-17)
- (checks) design-cross-language-boundaries (#55) (91afc88)
- design: add configurable architecture boundaries (f6bdb33)
- design: add configurable architecture boundaries (#53) (ea5cd93)
- design: satisfy strict lint (f8c6471)
1.1.1 (2026-07-17)
- mcp: preserve session across stream disconnects (a7c5ed2)
- report: include version in all output formats (c8c1ae3)
1.1.0 (2026-07-17)
- cpp: add tooling and security analysis (b93d681)
- cpp: expand checks across all categories (29ea77e)
- cpp: expand coverage with tooling, security, and dependency analysis (#50) (16e8146)
1.0.0 (2026-07-16)
- promote performance rules to their own opt-in check section (#41)
- the performance rules' ids renamed from quality.* to performance.* (quality.n-plus-one-query -> performance.n-plus-one-query, quality.go.alloc-in-loop -> performance.go.alloc-in-loop, quality.sync-io-in-request-path -> performance.sync-io-in-request-path, quality.unbounded-goroutines-in-loop -> performance.unbounded-goroutines-in-loop, plus the typescript/javascript mirrors and quality.python.sync-io-in-async). Their detect_* toggles moved from quality_rules to performance_rules, and the section is opt-in: set checks.performance: true to keep running these rules, and update any waivers or baselines that reference the old ids.
- 30% faster scans, enforceable AI-readiness score, and doc-truth rules (#44) (718dd08)
- context: add AI-and-human-readiness rules and broaden README drift (6caac9a)
- context: AI-readiness gate, doc-truth rules, and 30% faster scans (1f4f130)
- context: AI-readiness gate, doc-truth rules, and 30% faster scans (re-land #44) (#46) (75b3f02)
- context: enforceable legibility threshold and recalibrated score components (604dd52)
- context: persist repo_legibility score history with report flag (e54f643)
- parsers: wire the Python tree-sitter grammar and upgrade Python N+1 detection (07a0b24)
- performance: add AI-assisted semantic performance lens (eabd7fe)
- performance: add diff-only loop-nesting complexity regression rule (2e8bcef)
- performance: add framework-aware rules for Django, SQLAlchemy, React, and Express (b49ce7b)
- performance: add loop-hygiene, concurrency, and memory-pressure rules (54bfca9)
- performance: add measured budgets and benchmark regression gates (2c5e4ba)
- performance: publish a performance_score artifact with history and report flag (5c5a738)
- promote performance rules to their own opt-in check section (ede8b37)
- promote performance rules to their own opt-in check section (#41) (81a575b)
- suggest enabling the performance section in scan output (81d9d46)
- quality: hash clone tokens once and roll the window hash (bbf5b69)
- quality: route AI check reads through the shared scan corpus (b271cfb)
- runner: count lines by scanning bytes instead of allocating (17a4593)
0.8.3 (2026-07-16)
- ci: pin cosign to the v2 line so release signing keeps the .sig/.pem contract (9ee93c4)
- ci: pin cosign to v2 line to unbreak release signing (#39) (218f078)
0.8.2 (2026-07-16)
- quality: keep exec error in coverage-command failure chain (0666e42)
- security: surface invalid secret patterns instead of silently dropping them (5445fde)
0.8.1 (2026-07-03)
- release: disable PyPI attestations for reusable-workflow publish (28a147d)
0.8.0 (2026-07-03)
- packaging: publish codeguard to npm and PyPI (6a03f0e)
- packaging: publish codeguard to npm and PyPI (#29) (bf39a7a)
0.7.0 (2026-07-02)
- cli: add What's New banner and task-grouped menu (c1df999)
- cli: What's New banner and task-grouped menu (#21) (45e56f7)
- execute checks-improvement plan tiers 1-6 (733862f)
- parsers: tree-sitter TypeScript engine behind parsers.treesitter flag (5d09161)
- ci: extract version from var Number in homebrew validation (01d7a24)
- ci: extract version from var Number in homebrew validation (#23) (ec21f3b)
- version: make Number a var so ldflags injection works (6b1ccad)
- scan: parse/read files once, parallelize sections, scope cache (d181a4f)
- scan: parse/read files once, parallelize sections, scope cache (#24) (c79d9ec)
0.6.1 (2026-07-01)
- security: harden untrusted-input handling and wire lint cleanup (34c7f87)
0.6.0 (2026-06-30)
- security: hardcoded secret/credential detection + git-history scan (f2f6c61)
- security: hardcoded secret/credential detection + git-history scan (#17) (c1afab7)
- security: anchor Slack webhook regex to satisfy CodeQL (52de05a)
0.5.0 (2026-06-19)
- mcp server features (2efd47c)
- mcp: HTTP transport, Devin pack, verified fix, sampling/roots (#15) (44de1bb)
- mcp: HTTP transport, Devin pack, verified fix, sampling/roots, streaming (0bfab1d)
0.4.0 (2026-06-18)
- add OWASP-aware security metadata, trust-policy enforcement (#10) (358d4ba)
- feat: add OWASP-aware security metadata, trust-policy enforcement, and quality-check cleanup (9111a58)
- fix cd push security updates (685a3ff)
0.3.0 (2026-06-17)
- add supply chain policies, semantic review, and AI change risk (9b2dc1f)
- add supply chain policies, semantic review, and AI change risk (#8) (3ae9728)
0.2.0 (2026-06-16)
- add contracts check family for API/contract drift detection (1406bd5)
- feat(inital release) (b6620e3)
- inital release: initial release (f7cc9cd)
- parsers,security: deepen pure-Go parsers and add Go/Python taint analysis (9f42f4a)
- typescript: cross-module taint analysis with function summaries (d8fc21c)