Skip to content

changelog.md

Latest commit

 

History

History
184 lines (133 loc) · 8.87 KB

changelog.md

File metadata and controls

184 lines (133 loc) · 8.87 KB
Raw

Changelog

[0.5.15] - 26/10/2026

  • Added --secrets-scope current|history|all to findings repo and scans results, with current as the default. Use --history-run to retrieve a specific history scan, including when no snapshot scan exists.
  • Added scans start-scan --types historical_secrets --json to start a history scan and return its run ID, and scans status --repo … --run … to track its progress. Requested history features report an explicit error when the backend does not support them.
  • Secret results now preserve historical commit, file, line, containing branch/tag references, scan time, and only_in_history when a snapshot comparison is available. Native verification and cached live-validation verdicts remain separate; unavailable validation does not imply revocation.
  • SCA results now include dependency paths, direct introducers, manifest locations, known lockfiles, declaration evidence, and resolution provenance when supplied by the backend. Fixed versions and vulnerable ranges are preserved, including nested advisory fix fields. Dependency-path readiness is exposed independently of AI reachability verification.
  • Added the history options and scan-status tool to MCP. Programmatic fetchers, field projection, JSON, SARIF, and CSV exports preserve the new evidence; CSV includes JSON-encoded package and metadata columns.
  • Updated the normalized results schema to 1.1. SCA finding IDs include package, version, and manifest context; historical finding IDs distinguish commits and repeated occurrences. Consumers that persist finding IDs should account for these corrections.
  • Documented the history trigger → poll → retrieve workflow, SCA remediation evidence, backend compatibility requirements, and npm as this repository's distribution channel. Existing scan artifacts remain readable; richer evidence requires a subsequent scan.
  • Added deterministic contract tests and opt-in live history tests. Live scan-result tests use bounded concurrency, and organization discovery tests support accounts connected to multiple organizations.

[0.5.14] - 15/10/2026

  • Increased file limits on code review to 40 files

[0.5.13] - 13/10/2026

  • Security: --base / --base-commit values (including from the MCP codeant_review_local tool) are resolved without a shell, and option-like values are rejected, so they can no longer run commands or pass options to git
  • Security: symlinks that point outside the repository, and files reached through them, are no longer read into review or secrets payloads. In 0.5.12, --base / --base-commit sent a committed symlink's target contents

[0.5.12] - 13/10/2026

  • review / secrets with --base or --base-commit now include staged, unstaged, and untracked files (respecting .gitignore), not just commits. Previously review --all --base main silently skipped new files
  • With --base / --base-commit, file content is read from the working tree so it matches the reviewed diff
  • Help text, the README, and the MCP codeant_review_local parameters describe what --base / --base-commit include and that they take precedence over the other scope flags; the README gains a review section and corrects the secrets scope options

[0.5.11] - 05/10/2026

  • codeant login shows every status check with the HTTP response, login status, or request error, while masking the token in request diagnostics

[0.5.10] - 03/10/2026

  • MCP: parallel codeant_scans_results calls no longer swallow other tool responses, leak findings onto the protocol stream, or hang the server
  • MCP: codeant_login returns the sign-in link right away and finishes in the background (call it again to confirm); a missing browser launcher no longer crashes the server
  • MCP: the saved token is read on every request, so codeant login / codeant logout in a terminal take effect without restarting the server
  • MCP: codeant_review_local reports failures (for example, no git repository) as errors instead of an empty issue list
  • MCP: smaller results — compact JSON, slim and paged codeant_scans_repos, codeant_pentest_history, and cloud scan history, paged CSPM findings without compliance mappings, smaller default page sizes, and a size limit (CODEANT_MCP_MAX_RESULT_CHARS, default 80000) that refuses oversized results with a hint
  • MCP: the server sends instructions that tell agents how to discover, page, and recover authentication (including force: true when a configured token is rejected)
  • MCP: concurrent codeant_login calls share one sign-in; codeant_cloud_scan_history pages with offset
  • MCP: removed pull request tool parameters that no provider applied (defaultBranch, codeant_pr_comments addressed, codeant_comments_search includeAddressed and createdAfter) and corrected the codeant_pr_get, codeant_pr_comments, codeant_comments_search, and codeant_api_get descriptions
  • MCPB: added Dashboard URL and Disable telemetry settings, and listed codeant_scans_overrides
  • The Azure DevOps "org URL not found" error now names AZURE_DEVOPS_ORG_URL instead of a command that does not exist

[0.5.9] - 02/10/2026

  • Added duplicate_code to scans results / findings repo
  • Dismissed and false-positive flags are kept on IaC and dead-code findings, and shown as metadata.dismissed / metadata.false_positive
  • Added scans overrides (and the codeant_scans_overrides MCP tool) for user false-positive, confidence, and severity overrides
  • scans dismissed accepts every analysis type and no longer drops SCA dismissals
  • SCA severity is read from the advisory rating instead of defaulting to medium
  • Extra dead-code file paths no longer end in the result file name
  • Removed a debug dump of full scan responses to stderr
  • Fixed numeric options with defaults (scans results --limit, scans history --limit, PR comment --limit) being parsed in the wrong radix; numeric options now reject non-integers, negative values, zero counts, and values above the documented maximum
  • The dismissal comment (metadata.comment_for_dismiss) and secrets with a FALSE_POSITIVE confidence are reported in metadata

[0.5.8] - 02/10/2026

  • findings antipatterns and VM/container findings cloud list are paged (--limit, --offset, --all), so large organizations and scans no longer fail with a 502

[0.5.7] - 28/09/2026

  • Login tokens are prefixed with cli___ so CLI logins show up as CLI on the IDE users page

[0.5.6] - 09/09/2026

  • Run secrets protection in a pre-commit hook with --staged instead of a pre-push hook.

[0.5.4] - 27/08/2026

  • Stop silently falling back to app.codeant.ai for login on a custom/self-hosted base URL
  • Added set-dashboard-url, get-dashboard-url, and remove-dashboard-url commands to explicitly configure the login dashboard URL

[0.5.3] - 24/08/2026

  • Improved consistency between interactive and headless local reviews
  • Added shared multi-file planning and verification before returning findings
  • Increased local review coverage to 15 files, processed in batches of up to five

[0.5.2] - 07/08/2026

  • Use the configured CodeAnt dashboard URL during login

[0.5.1] - 31/05/2026

  • AI code review increasing coverage

[0.4.12] - 19/05/2026

  • Settings added

[0.4.10] - 04/05/2026

  • Scans filtering added

[0.4.9] - 29/05/2026

  • Login Url

[0.4.8] - 29/05/2026

  • Start scan

[0.4.7] - 22/05/2026

  • Scans center

[0.4.6] - 17/04/2026

  • Secrets false positive

[0.4.5] - 13/04/2026

  • Selected commits review

[0.4.4] - 09/04/2026

  • Secrets location in hooks

[0.4.3] - 06/04/2026

  • Interactive terminal for pre-push

[0.4.2] - 06/04/2026

  • Dynamic config

[0.4.1] - 06/04/2026

  • CLI path

[0.4.0] - 04/04/2026

  • Set api key

[0.3.9] - 04/04/2026

  • Secrets bypass

[0.3.8] - 03/04/2026

  • Graceful handling of review

[0.3.7] - 03/04/2026

  • Pre-push hook

[0.3.6] - 02/04/2026

  • new login approach

[0.3.5] - 01/04/2026

  • Local secret detection

[0.3.4] - 25/03/2026

  • Telemetry opt-out flag

[0.3.3] - 25/03/2026

  • Bug fixes

[0.3.2] - 23/03/2026

  • Add resolve conversation feature for all SCM providers (GitHub, GitLab, Bitbucket, Azure DevOps)
  • Add codeant pr resolve CLI command

[0.3.1] - 23/03/2026

  • Bug fixes

[0.3.0] - 23/03/2026

  • Token optimization

[0.2.9] - 23/03/2026

  • Updated url

[0.2.8] - 23/03/2026

  • Updated url

[0.2.7] - 22/03/2026

  • Analytics tracking

[0.2.6] - 21/03/2026

  • API Key mapping

[0.2.5] - 21/03/2026

  • Secrets matching better

[0.2.4] - 21/03/2026

  • Deprecation of some features

[0.2.3] - 21/03/2026

  • Better CodeAnt review matching

[0.2.2] - 20/03/2026

  • Headless mode

[0.2.1] - 20/03/2026

  • Per-file parallel agentic review

[0.2.0] - 19/03/2026

  • Add SCM integration layer with support for GitHub, GitLab, Bitbucket, and Azure DevOps

[0.1.9] - 19/03/2026

  • Bug fixes

[0.1.8] - 19/03/2026

  • Bug fixes

[0.1.7] - 19/03/2026

  • Bug fixes

[0.1.6] - 19/03/2026

  • CLI UI Improvements
  • More review trigger options