[alxxjohn]

🤖 I have created a release beep boop

1.11.0 (2026-11-01)

Features

• agent-config and workflow-security rules, CI exit policy, repo-aware init, faster TS and diff scans (#192) (145eb0d)
• ci: add GitHub Actions workflow-security rules (c082b50)
• cli: add -fail-on, -min-confidence and -quiet; gate the banner on TTY/CI/NO_COLOR (a9b149a)
• cli: add "did you mean" suggestions and validate flags before scan output (cce068e)
• doctor: probe govulncheck, check entrypoints and target languages (e3581ef)
• init: detect the repository and write a small config; scan without one (3377568)
• MCP finding filters, did-you-mean errors, gitignore-aware walk, concurrent quality passes, security precision (#193) (9b001b4)
• mcp: summary-first, filtered, paginated findings for scan and validate_patch (668c56a)
• prompts: govern Claude settings, MCP servers and hidden Unicode in agent config (a2243bb)
• scan: honour .gitignore in the file walk (f71df06)
• security: honor justified gosec directives for shell-execution (f7f8423)
• security: show govulncheck stderr in failure diagnostics (fcf1880)

Bug Fixes

• action: make the sticky PR comment actually post (b2c9020)
• cache: keep security-secrets diagnostics on findings-cache hits (d7c3b9d)
• cache: key per-file findings on the cross-file inputs they read (5bed0ad)
• prompts: govern only config files under mcp/ directories (87f3fcc)
• rules: retire dead quality.mixed-abstraction-levels; require emission sites (M6) (bd3c736)
• runner: fail scans whose target path is missing or unreadable (00a6a48)
• runner: fail the scan when a check section panics (35349a5)
• runner: report identical findings from overlapping targets once (76405d6)
• runner: stop callers mutating the shared corpus listing; make suppressed order total (062b01d)
• security: close Python taint gaps for request data, imported sinks (5593e90)
• security: grade provider-prefixed keys at high confidence (2efe169)
• security: match insecure-deserialization on masked source (ae38101)
• security: stop scanArgLiterals panicking on a lone-quote argument (a6b1615)
• security: stop the secret name heuristic spanning concatenation (26b4212)
• stop codeguard silently passing on broken scans (high-priority review fixes) (#189) (4104604)

Performance Improvements

• diff: batch and memoize base-ref reads in diff mode (04a7efb)
• quality: compute TS/JS module-scope flags in a single pass (310df11)
• quality: cut self-scan time ~46% by fixing three profiled hot paths (#191) (7660755)
• quality: gate the style-profile regexes behind literal pre-checks (4852024)
• quality: replace the clone tokenizer regex with a byte lexer (1e24245)
• quality: run whole-target passes concurrently and parallelize their per-file loops (9170132)
• runner: memoize C-like parses and inline suppressions per scan (e3095fe)
• scan: derive scan concurrency from GOMAXPROCS and parallelise serial passes (b68b7e4)

---

This PR was generated with Release Please. See documentation.