v1.17.5

Changelog

• 0727106 Merge pull request #747 from safedep/fix/maven-pomxml-transient-fetch-retry
• 23b07a0 fix: render lockfile poisoning findings for non-http(s) resolved URLs (#746)

v1.17.4

Changelog

• 21e6a4b Merge pull request #740 from safedep/claude/keen-ride-v3ujz
• ed5b09d Merge pull request #744 from safedep/fix/cargo-purl-malware-ecosystem
• d4f819f feat: ide extension scanning support for vet (#742)
• 5273423 fix: map cargo PURL to canonical ecosystem so malware is detected

v1.17.3

Changelog

• 2abb468 Honor default package version from insights (#735)
• d449149 Merge pull request #729 from safedep/fix/aggregate-lockfile-poisoning-warnings
• d8879a2 Revert "fix: aggregate lockfile poisoning warnings per package+URL"
• 7961727 feat: add pagination support for cloud key list command
• b3bf79f feat: add pagination support for cloud key list command
• 1e6bb13 feat: migrate commands to cleaner error message (#733)
• 39594d7 fix: aggregate lockfile poisoning threats by URL in markdown report
• 11690c4 fix: aggregate lockfile poisoning warnings per package+URL
• 0a6c894 fix: better error message when auth fails (#731)
• add61ab fix: consolidate lockfile poisoning output by URL in console and markdown
• c50de12 fix: use PowerShell Expand-Archive on Windows for npm install
• b28bc4b fix: use PowerShell Expand-Archive on Windows for npm install
• c3b4636 show name convention message

v1.17.2

Changelog

• 0072ad7 Fix: vscode user (global) mcp path
• 5e1a806 Merge pull request #727 from safedep/feat/antigravity-support
• db40c9e antigravity extensions
• 7cc8f42 feat: detect nonstandard claude MCP server config (#728)
• 6186d55 feat: vscode and antigravity support in endpoint scan
• e8e0162 fix(reporter): suppress --report-markdown hint when markdown report is already enabled (#726)
• cc7734a fix: tests

v1.17.1

Changelog

• 5c3895f use npm-release environment for release (#723)

v1.17.0

Changelog

• 2b32226 feat(reporter):Implement adaptive foreground colors for terminal theme visibility (#715)
• 288bba0 Merge pull request #708 from safedep/update/install/readme
• 4dfb114 feat: emojiless (#720)
• 6435f81 feat: vet endpoint scan (#719)
• 1e6df77 fix(lfp): don't flag npm aliased deps as lockfile poisoning (#713)
• 787faa6 fix(readers): support windows-style exclude patterns (#710)
• 1da9e89 fix(reporter): fail fast on invalid defectdojo product id (#711)
• 19fa98e fix: agent skills discovery and syncing (#722)
• 6d3bc22 update npm install command to install globally

v1.16.2

Changelog

• 499013d fix: resolve apt 404 errors in goreleaser CI on ubuntu-latest (24.04) (#706)

v1.16.0

Changelog

• c7e82d1 feat: Add support for GHA pinning (#701)

v1.15.0

Changelog

• 1620cb6 Merge pull request #694 from safedep/chore/deps-update-20260304
• 56a0e56 Merge pull request #696 from safedep/chore/update-ph-analytics-key
• 15c7611 chore: Add AIBOM signatures (#693)
• f021ebd chore: Dependency update
• 086907f chore: Misc fix
• 602be3a chore: Rotate PH analytics public token
• 6346306 feat: take into account malysis exclusions in reporting (#695)
• 0d6fa73 fix: Compatibility with containerd pkg
• 142fdfd fix: Linter fixes
• fe1efd1 fix: Linter fixes
• 7cd30fc fix: Update ent to master
• cffd47b fix: Use protojson for OSV schema serializer
• 784f7ff fix: cdx treat bom ref as identifier rather than pkg (#699)

v1.14.0

Changelog

• ed1239c Merge pull request #690 from safedep/chore/enable-insights-v2-as-default
• 0bd9c54 chore: Enable insights v2 as default
• d264803 feat: Add XBOM Support (#687)
• 5f95283 fix: AI discovery output rendering (#692)
• 7eca825 fix: Typescript signature matching (#691)