v1.13.0

What's Changed

• Raise the blocking-rules poll timeout to outlast reachability triage by @Ibrahimrahhal in #158
• Add corgea mcp install for agent MCP configs by @Ibrahimrahhal in #163

Full Changelog: v1.12.0...v1.13.0

v1.12.0

What's Changed

• Fix cargo-audit: upgrade h2 and git2 by @Ibrahimrahhal in #162
• Report a dirty worktree only when git status does by @Ibrahimrahhal in #161
• Fix ETXTBSY flake in container-engine image tests by @Ibrahimrahhal in #164
• Scan incrementally by default: diff against the last scan locally and send the file list by @Ibrahimrahhal in #160

Full Changelog: v1.11.1...v1.12.0

v1.11.1

What's Changed

• Point the agent skill at --help instead of a second copy of the docs by @leenk7991 in #152
• Add --ignore-dirty-worktree to reuse recent scans of dirty worktrees by @Ibrahimrahhal in #159

Full Changelog: v1.11.0...v1.11.1

v1.11.0

What's Changed

• Stop waiting forever on scans that already ended by @leenk7991 in #144
• COR-1766: report dirty worktree state with corgea scan uploads by @leenk7991 in #150
• Write the scan report and SBOM before the blocking-rule gates exit by @Ibrahimrahhal in #156
• Add corgea scan --include-image to scan fully built container images by @Ibrahimrahhal in #153
• Add --skip-if-commit-scanned-recently to reuse a recent scan of the commit by @Ibrahimrahhal in #157

Full Changelog: v1.10.0...v1.11.0

v1.10.0

What's Changed

• COR-1549: decide vuln-api token-send by endpoint trust, not by whether it is the default by @juangaitanv in #135
• chore: remove sync workflows that can no longer run by @leenk7991 in #141
• COR-1258: generate CycloneDX SBOMs alongside scan reports by @juangaitanv in #142
• COR-1258: inactive Maven profile sections no longer leak into the base dependency graph by @juangaitanv in #145
• fix(cli): resolve list/wait projects by repo URL, not directory name (COR-1577) by @juangaitanv in #137
• fix(cli): harden project resolution (stacked on #137) by @juangaitanv in #138
• fix(cli): fail closed on mid-pagination 404 in project resolution by @juangaitanv in #146
• test: add hermetic CLI end-to-end coverage by @juangaitanv in #143
• Add code quality issue listing to the CLI by @Ibrahimrahhal in #130
• Add --block-on to select which blocking rules gate a CI scan by @Ibrahimrahhal in #149
• COR-1633: POL-02: wait for blocking rules by @leenk7991 in #147

Full Changelog: v1.9.3...v1.10.0

v1.9.3

What's Changed

• Add canonical dependency finding catalog by @juangaitanv in #132
• Add Codex skills sync on release by @leenk7991 in #133
• Document --fail-on malicious in the agent skill by @juangaitanv in #136
• Fix Linux release binaries requiring GLIBC_2.39, bump to 1.9.3 by @Ibrahimrahhal in #139
• Add --wait to corgea upload and print scan page URL when not waiting by @Ibrahimrahhal in #131

Full Changelog: v1.9.2...v1.9.3

v1.9.2

What's Changed

• Fix the rust-tests CI gate: clippy 1.97 question_mark + cargo-audit (quick-xml/crossbeam) by @juangaitanv in #127
• COR-1647: corgea scan --fail-on malicious gate + SCA classification by @juangaitanv in #125
• COR-1576: Improve CLI wrapper/help UX (wrapper --version passthrough, gate progress) by @juangaitanv in #121
• COR-1646: distinct malicious verdict at install time (npm/pip) by @juangaitanv in #126
• Add corgea advisories check: pre-install package advisory queries for agents by @juangaitanv in #129
• feat(COR-1639): surface scan git SHA in list output by @leenk7991 in #123
• Shrink release binary with size-tuned profile by @juangaitanv in #98
• Update to v1.9.2 by @yhoztak in #134

Full Changelog: v1.9.1...v1.9.2

v1.9.1

Highlights

🛡️ Install Gate (Beta) — vet dependencies before they hit disk. New in this release and under active refinement; flags and verdicts may change between releases. Prefix any pip / npm / yarn / pnpm / uv install with corgea to screen every package it would install — named and transitive — against Corgea's vulnerability API before anything lands. Known-vulnerable or malicious versions block the install (exit 1) and print the safe fixed in version; a clean set runs the underlying command untouched. No token needed for baseline public-CVE checks; corgea login upgrades to authenticated fail-closed enforcement. A recency gate (default 14 days, configurable) also blocks freshly published packages to catch typosquats before advisory feeds catch up.

corgea npm install lodash@4.17.20   # blocks: known-vulnerable (CVE-2025-13465), exits 1
corgea pip install requests         # resolves, checks the verdict, then runs pip

What's Changed

Install Gate

• Install gate, Phase 0: vuln-api contract + test harness by @juangaitanv in #110
• Install gate, Phase 1: core gate — corgea pip|npm install <named targets> by @juangaitanv in #111
• Install gate, Phase 2: gate the full would-install set (tree pass) by @juangaitanv in #112
• Install gate, Phase 3: uv/yarn/pnpm wrappers + --json machine output by @juangaitanv in #114
• Install gate, Phase 3: org guarantee — authenticated fail-closed mode by @juangaitanv in #115
• Install gate: move recency gate from flags to a config toggle by @juangaitanv in #119

Scanning

• Add --exclude flag to scan command for glob-based file exclusion by @Ibrahimrahhal in #86
• Fix false "Project not found" errors by fetching scan issues by project_name instead of scan_id (COR-1493) by @Ibrahimrahhal in #117

Maintenance

• CI: bump actions/checkout v4 → v6 across workflows by @juangaitanv in #116

Full Changelog: v1.9.0...v1.9.1

v1.9.0

What's Changed

• Add ./harness quality contract + CI coverage gate by @juangaitanv in #92
• Fix flaky Linux wheel CI maturin download by @juangaitanv in #97
• Add corgea deps offline inventory (scan/graph/explain/diff/sbom/policy) by @juangaitanv in #93
• Add corgea skill install command by @Ibrahimrahhal in #95

Full Changelog: 1.8.8...v1.9.0

1.8.8

What's Changed

• Bump openssl from 0.10.73 to 0.10.78 by @dependabot[bot] in #87
• Bump openssl from 0.10.78 to 0.10.79 by @dependabot[bot] in #88
• Bump openssl from 0.10.79 to 0.10.80 by @dependabot[bot] in #90
• Retry on network error by @yhoztak in #94

Full Changelog: v1.8.7...1.8.8