릴리스 타임라인

v2.2.5

2026-08-20

최신

OpenGrep Reliability

• Timed-out taint batches are never replayed recursivelyeach bounded batch runs once; if it reaches its execution limit, Oryon records the affected rules and targets and continues with the remaining partitions instead of repeating the same work until the workspace deadline is exhausted.
• Completed rule partitions remain availablelater search and taint batches still receive execution time after a localized taint timeout, while the affected coverage remains explicitly incomplete.
• Protected TSD payloads are recognized before parsingfiles whose contents begin with the exact %TSD-Header-###% protection marker are classified as non-source input rather than being sent repeatedly to every compatible OpenGrep rule.
• Generated .NET output is excludedobj/ trees are classified as build output, preventing generated C# files from adding parser noise and redundant rule work while authored .cs files remain in scope.

Compatibility

• No rules, public settings, timeout values, WebAPI payloads, dashboard behavior, dependency analysis or AI enrichment behavior changed in this patch.

v2.2.4

2026-08-17

Dependency Coverage

• Resolved dependency graphs for manifest-only projectsMaven parents and BOMs, version properties, supported Python requirement graphs and other OSV-Scalibr formats now contribute exact package versions instead of leaving most declarations unqueryable.
• Transitive packages are assessedresolved package graphs are merged into the existing Oryon dependency pipeline, while authoritative lockfile occurrences and the current OSV cache remain intact.
• Large real-world improvementsvalidation increased exact OSV assessment from 5 to 136 packages in Spring Petclinic and from 1 to 38 packages in Django.

Reliability and Distribution

• Safe complementary resolverthe platform-specific OSV-Scanner runtime is downloaded once into extension-owned storage, verified against a pinned SHA-256 digest and reused without increasing VSIX size.
• Built-in parser fallback remains availabledownload, network or individual graph-resolution failures cannot remove dependencies already recovered by Oryon's existing parsers.
• Invalid empty inventories are rejecteda resolver failure can no longer be accepted as a successful zero-dependency result; valid graphs from other manifests remain usable.

Compatibility

• No public settings, WebAPI payloads, dashboard contracts or AI enrichment behavior changed in this patch.

v2.2.3

2026-08-16

Dependency Reliability

• Valid OSV repository ranges are acceptedvulnerability details may contain repository-level GIT ranges without a package identity alongside their ecosystem-specific records, without invalidating the dependency scan.
• One incompatible OSV detail no longer discards the scanif a detail cannot be cached safely, Oryon preserves the valid package-vulnerability association returned by OSV and continues processing the remaining dependencies.

Detection Precision

• Three high-volume low-confidence rules leave productionbroad C comparison, C null-dereference and generic unquoted-template-attribute heuristics remain available in full/shadow profiles but no longer appear as production vulnerabilities.
• 12,951 suspicious signals removed from the reliability corpusthe affected rules were responsible for false positives in ordinary C assignments and assertions, guarded pointer access, and valid Ember/Handlebars component syntax.
• The C comparison audit remains narrowed outside productionits matcher is constrained to statement-shaped comparisons while a flow-aware replacement is evaluated.

Coverage Accuracy

• Language coverage follows actual rule compatibilitysource files are grouped into disjoint execution rails using declared language and path applicability, so a file is no longer reported as omitted merely because the current rule family cannot parse it.
• No targets or shared rules are lostevery admitted file remains in the general scan, shared JavaScript/TypeScript rules run for both languages, and each source target appears only once across the language rails.
• Slow-rule coverage is preservedthe 27 effective rules implicated by recent production diagnostics completed successfully when isolated, so no valid detector was removed solely because of a transient combined-scan timeout.

Compatibility

• No public settings, WebAPI payloads, dashboard contracts or AI enrichment behavior changed in this patch.

v2.2.2

2026-08-14

Dependency Coverage

• More package manifests are recognizeddependency discovery now supports uv.lock, Gemfile, gemspecs, Package.swift, project.clj and mix.lock, expanding coverage for Python, Ruby, Swift, Clojure and Elixir projects.
• Lockfiles remain authoritativewhen a resolved lockfile exists beside its manifest, Oryon uses the resolved versions and avoids duplicate or speculative package results.
• More accurate coverage reportingunresolved and non-versioned dependencies are retained as coverage information without being sent to OSV as false concrete versions, including Go module entries that cannot be resolved safely.

Scan Reliability and Performance

• JavaScript compatibility failures are isolatedif reversible JavaScript or TypeScript staging cannot prepare one file, the rest of the scan continues and the affected target is reported explicitly.
• Slow security rules are boundedexpensive Go, PHP and Ansible matchers were constrained to their relevant syntax and contexts, reducing avoidable OpenGrep work without increasing production timeouts.

Detection Precision

• Code-quality and low-confidence audit signals are informationalPython maintainability, correctness and Django custom-expression review findings now retain visibility as INFO instead of being presented as medium-severity vulnerabilities.
• SQLAlchemy detection requires SQLAlchemy contextgeneric database .execute() calls are no longer attributed to SQLAlchemy unless the file actually imports that framework.
• Translation catalogs no longer trigger Trojan Source noiselegitimate bidirectional control characters in gettext .po files are excluded while the same detector remains active on source code and configuration files.
• Pinned Django validation improvedthe reference scan decreased from 1,506 to 1,352 signals and from 110 to 34 high-severity findings, with the removed results limited to confirmed SQLAlchemy and localization false positives.

Compatibility

• No public settings, WebAPI payloads, dashboard contracts or AI enrichment behavior changed in this patch.

v2.2.1

2026-08-12

Scan Reliability

• Localized OpenGrep failures no longer discard completed workif the Windows planner fails on one target batch after the same rules have already run successfully, Oryon isolates the affected files while retaining confirmed findings from every completed batch.
• Completed phases remain availablean isolated parser or engine failure in a later phase no longer removes findings and coverage already confirmed by earlier phases.
• More useful engine diagnosticsfailure logs now identify whether the planner, generated planner artifacts or OpenGrep core failed and retain bounded process diagnostics for support investigation.

Dashboard Synchronization

• PostgreSQL-incompatible text is sanitized before uploadembedded NUL characters in code findings, dependency details and AI guidance are escaped recursively, preventing one malformed value from interrupting dashboard synchronization.
• No API contract changesthe synchronization hardening preserves the existing findings, dependency and enrichment payload formats.

v2.2.0

2026-08-11

Scan Observability and Support

• Admin-only scan diagnosticscompleted, failed and cancelled workspace scans now send operational telemetry to the Oryon backend for centralized reliability analysis.
• Detailed execution metricsreports include scanner duration and throughput, file and ruleset coverage, result accounting, dependency coverage, AI-stage status and dashboard synchronization outcomes.
• Complete diagnostic logsscan logs are captured independently from the visible VS Code log level and delivered in a structured format that can be searched, filtered and copied by authorized support administrators.
• Reliable deliveryreports are idempotent per scan run and use a bounded persistent queue when the backend is temporarily unavailable, with automatic retry after authentication is restored.

Privacy and Compatibility

• Defense-in-depth redactioncredentials, source snippets, prompts, AI responses and private absolute workspace paths are removed before telemetry leaves the extension; the backend performs an additional sanitization pass.
• Scanning remains independenttelemetry failures never block local results or dashboard synchronization, and no existing finding, dependency or enrichment payload contract has changed.

v2.1.1

2026-08-10

Scan Performance and Reliability

• Dependency discovery reuses the workspace manifestdependency scanning no longer performs a second recursive walk after code-target discovery, avoiding thousands of per-path ignore checks on large repositories.
• Batched ignore filteringfallback dependency discovery evaluates ignored paths in directory batches and remains conservative if ignore matching fails, so optimization cannot hide a real manifest.
• Rule-aware OpenGrep planningadaptive partitioning now measures logical rule/file work instead of configuration/file work, preventing configurations containing many rules from being underestimated.
• Bounded timeout handlingproduction preserves confirmed coverage without automatically replaying timed-out targets; diagnostic replay remains explicitly opt-in and cannot silently extend the workspace deadline.

Source Coverage and Detection Precision

• Ruby entry points analyzed explicitlyextensionless Gemfile and Rakefile inputs are staged as Ruby with their original result paths restored, without enabling unknown-extension parsing globally.
• Ruby tooling cache excluded.ruby-lsp is classified as generated tooling state and excluded from source and dependency discovery.
• Flex scanner compatibilityconventional named definitions are supported by the reversible parser view; incompatible .l dialects are omitted only from structural SAST with an explicit coverage gap, while analysis of the remaining workspace continues.
• Generated-code false positive reducedgenerated JavaScript identifiers validated through regular-expression conditions are no longer reported as unvalidated code-injection inputs.

Compatibility

• No public settings, WebAPI payloads, dashboard contracts, AI enrichment behavior or dependency-result schemas changed in this patch.

v2.1.0

2026-08-04

Third-Party Security Packs Integration

• Vendored Security PacksIntegrated, reviewed, and enabled high-quality third-party security rule packs:
• Trail of BitsExtended security rule packs for multi-language vulnerability detection.
• ElttamCurated security rule packs targeting web and infrastructure patterns.
• ApiiroMalicious-code and supply-chain risk detection pack.
• 0xdeaSpecialized C/C++ security rule pack.
• Profile SelectorRegistered external packs in profileSelector.ts for production security and audit profiles.

JavaScript & TypeScript Detector Generalization

• Generalized Security RulesAdded high-precision, project-agnostic security rules for JS and TS covering:
• Path traversal prefix confinement (startsWith without separator bound).
• Shell execution risk (command string wrappers via sh -c).
• IP allowlist bypasses (partial substring match via includes).
• Dynamic SQL identifier escaping and interpolation.
• Protocol-relative and relative URL resolution SSRF risks.
• Prototype pollution, mass assignment, XSS, and SSRF.
• Modern JS/TS Parser Compatibility StagingReversible parser staging for modern syntax (e.g. #field in object private field checks in Acorn/OpenGrep), preserving exact line/column coordinates while ensuring 100% AST parsing coverage.

High-Workload Scan Reliability & Performance

• Adaptive Workspace PartitioningHigh-workload scans are partitioned dynamically to prevent engine timeouts.
• Dynamic Taint Batching & SplittingTaint batches scale by target workload and split timed-out batches automatically for maximum coverage.
• Parser Failure & Dockerfile Exception IsolationLocalized parser diagnostics and Dockerfile parser exceptions are attributed back to their exact files without discarding confirmed findings.

Rule Bounding & Quarantine

• Pathological Rule BoundingQuarantined unbounded Lambda XSS and Lambda PostgreSQL taint rules.
• Framework Scan LimitsBounded AngularJS element taint analysis and TypeScript framework taint scans to maintain deterministic execution.

Validation & Release Gate

• 100% Gate VerificationAll 4,134 rules and 1,008 JS/TS unit fixtures pass npm run ruleset:gate cleanly with zero configuration errors.
• Fail-Closed Benchmark HarnessBenchmark evaluations now fail closed on partial coverage, preventing incomplete scans from publishing misleading metrics.

v2.0.6

2026-08-01

Real-world Scan Reliability

• Localized OpenGrep failures no longer discard confirmed coverageparser failures, attributable internal errors, stack overflows and targets omitted by the engine are isolated to the affected files. Confirmed findings from unaffected files remain available and the scan is explicitly reported as partial.
• More resilient C and C++ analysisC-family rule configurations run in isolated phases so one pathological rule/configuration cannot invalidate every C/C++ result in the workspace.
• Rules run only where applicableproduction planning now respects each configuration's declared languages and paths.include scopes, while parser-independent packs use dedicated target lanes instead of being applied to unrelated source files.
• Generated and vendored sources handled conservativelyrepositories can mark files with linguist-generated or linguist-vendored; those trusted attributes are honored, while unavailable or invalid Git metadata never excludes source code.
• Unsupported grammar coverage is honestLisp plus OCamllex/Menhir grammar sources remain eligible for global secret checks but are no longer presented as structurally analyzed by OpenGrep 1.25.

Detection Correctness

• Rule severities preservedthe direct OpenGrep planner/core path restores a rule's declared severity when the engine omits it, preventing valid ERROR, WARNING or INFO findings from falling back incorrectly to MEDIUM.
• Java SpEL matcher hardenedSpring expression parsing detection no longer triggers an internal matcher failure on incompatible metavariables.
• GitHub Actions matchers hardenedcurl/eval and remote-script pipeline detection no longer attempts to parse every run: block as Bash, avoiding failures on PowerShell, Ruby and GitHub expression syntax while retaining vulnerable matches.

Validation

• Large real-world reliability campaign60 fixed repositories covering 408,108 tracked files were exercised across languages and repository sizes. Fifty-seven produced deterministic findings; failures fell from 30 in the previous campaign to three known OpenGrep edge cases.
• Dependency reliability telemetrya dedicated benchmark records manifest coverage, ecosystems, package/version counts, vulnerabilities, cache behavior, progress and failures without changing the production API contract.
• Expanded regression protectionautomated coverage now verifies localized partial results, rule scoping, C-family isolation, generated/vendor attributes, severity restoration and the corrected Java and GitHub Actions rules.

Known Engine Limits

• OpenGrep 1.25 can still fail completely on three observed extreme cases: a very large OFBiz language phase, a valid Prometheus Flex definition rejected during preprocessing, and a Linux parser warning that cannot yet be localized safely. Other unsupported or partially parsed files remain visible as incomplete coverage rather than being reported as fully scanned.

v2.0.5

2026-07-28

Workspace Deadline Hotfix

• Realistic workspace scan budgetOpenGrep now receives five minutes per block of 500 admitted files, replacing the previous two-minute base and one-minute increments.
• Bounded large-repository executionthe global code-analysis deadline grows from 5 minutes for up to 500 files to 30 minutes for 2,501 files or more.
• Existing safeguards remain unchangedthe five-second per-rule/file timeout, process-tree cancellation and explicit incomplete-coverage reporting continue to prevent stalled scans from being presented as complete.

v2.0.4

2026-07-28

Large-workspace Scan Reliability Hotfix

• Confirmed findings survive localized failuresparser errors, per-rule timeouts and an exhausted workspace deadline now exclude only unconfirmed files and phases. Findings already confirmed by OpenGrep remain publishable with an explicit incomplete-coverage warning.
• Large-workspace deadlines scale safelythe code-analysis budget grows with the admitted target count up to a bounded 20 minutes, instead of forcing every repository through a fixed five-minute cap.
• Staged parser diagnostics map to original filesdiagnostics emitted against compatibility-staged paths are attributed back to their exact workspace files, preventing one parser failure from invalidating unrelated targets.
• WebAPI-compatible dependency uploadslarge vulnerability sets are split by both item count and payload size, with independent idempotency keys, bounded retries and aggregated upload accounting.
• Honest incomplete statusscans that retain confirmed partial results are clearly marked as incomplete and never claim full code coverage.

Known Engine Limit

• OpenGrep 1.25 can still time out on pathological rules or fail to parse modern syntax. Affected targets are reported as unconfirmed; Oryon does not claim complete coverage for them.

v2.0.3

2026-07-28

Large-workspace and Parser Reliability

• Production targets are narrower and deterministicexplicit test/fixture trees, generated documentation archives and clear JSON Lines datasets no longer enter full semantic SAST. Runtime source keeps full analysis, while applicable text still receives secret scanning.
• Solidity parser compatibilityexecutable assembly ("memory-safe") qualifiers are staged reversibly without changing source coordinates, removing false parser failures on modern contracts.
• Scala and Terraform rule failures fixedthe JDBC SQL-injection rule and SSM logging rule no longer trigger OpenGrep internal matching/parsing errors; their vulnerable and safe fixtures remain covered.
• Honest partial completionany code, dependency or AI enrichment gap is shown as partial in the public scan status. A synchronized partial scan is no longer described as fully completed.
• Release secret exclusion hardenedevery .env variant is excluded explicitly from the VSIX, in addition to source, evaluation data and rule fixtures.

Dependency and AI Accuracy

• Invalid manifests are isolatedone malformed dependency manifest no longer discards valid results from the rest of the workspace. The skipped manifest is reported explicitly as partial coverage and is never treated as assessed.
• Accurate pyproject.toml parsingonly PEP 621, build-system, optional/dependency-group and Poetry dependency tables are read. Project URLs, scripts, licenses and tool settings can no longer become false OSV package queries.
• Faster bounded enrichmentthe per-request AI deadline is 30 seconds. Timed-out inputs use a 15-minute negative cache, preventing immediate rescans from paying the same failed latency while preserving the original finding.

Known Engine Limit

• OpenGrep 1.25 can still exhaust the fixed five-minute workspace deadline on pathological C/C++ taint rules or very large polyglot repositories. Oryon fails closed and publishes no partial findings in that case; increasing the timeout is not used to hide the limitation.

v2.0.2

2026-07-27

Scan Reliability Hotfix

• Localized parser failures no longer discard an entire workspace scanfiles that OpenGrep cannot parse are identified exactly and reported as partial coverage, while confirmed files continue through the normal scan flow. Unknown engine errors, timeouts, invalid rules, skipped rules, and skipped paths still fail closed.
• TypeScript compatibility staging correctedoverload and declaration rewrites now preserve valid separators and fall back to the original source when a reversible transformation cannot be validated.
• Independent detector phasescode and dependency analysis preserve the successful phase when the other one fails, and expose the failed phase explicitly instead of losing all usable findings. A scan still fails when both detector phases fail.
• Reliable ignore handling without Gitworkspace exclusions continue to honor nested .gitignore files, directory rules, and negations when the Git executable is unavailable.

Dependency and Detection Coverage

• Composer projects without a lockfile are no longer silently missedexact versions in composer.json are assessed, ranges and platform requirements remain explicitly unverified, and coverage is reported honestly as partial.
• Faster workspace discoverydependency lockfiles and candidate source files are inspected with bounded concurrency without changing inclusion semantics.
• Additional Java XXE coveragea new generalized SAX rule detects incomplete external-entity hardening when external DTD loading remains enabled.
• Expanded regression coverageparser isolation, partial-result accounting, phase failures, Composer manifests, ignore fallbacks, and real scanner compatibility paths are covered by automated tests.

v2.0.1

2026-07-27

Windows OpenGrep Startup Hotfix

• Windows runtime bootstrap fixedOpenGrep now preserves the real Windows shell profile while its bundled launcher resolves and extracts the 1.25.0 runtime, preventing {CACHE_DIR} expansion failures before a scan starts.
• Runtime cache alignmentOryon validates the runtime in the actual Local AppData location used by the Windows launcher and safely removes only the obsolete extension-managed extraction left by version 2.0.0.
• Resilient OSV detail downloadstransient DNS, connection, timeout, rate-limit, and server failures now receive bounded retries with improved nested network diagnostics; exhausted or malformed responses still fail closed and are never cached as complete.
• Faster AI enrichmentdependency advisories are enriched once and reused across affected packages, code and dependency requests share a continuous bounded queue, and persistent cache entries can be reused safely across equivalent findings.
• Smaller, more reliable AI responsesscanner-owned locations, snippets, diffs, versions, upgrade paths, compatibility data, and OSV references are materialized locally, reducing model latency and schema retries without changing dashboard payloads.
• Cleaner scan completion statusinternal benchmark qualifications, secret-only text accounting, and heuristic-parser labels remain available in diagnostics and scan metadata without being exposed as public warnings; users are warned only about actual unscanned targets or dependency coverage gaps.
• Regression coverage addedautomated tests verify the Windows runtime lifecycle plus successful and exhausted OSV network retries without incomplete-cache publication.
• Documentation aligned with 2.0.1public and engineering guides now describe the current OpenGrep runtime, fail-closed scan flow, ruleset defaults, optional triage, compact AI contracts, caches, platform support and known dependency-upload limit; retired benchmark and product notes are explicitly marked as historical.

v2.0.0

2026-07-26

Major SAST Engine Upgrade

• OpenGrep 1.25 runtimeupgraded the bundled scanner on Linux, macOS, and Windows, with pinned checksums and atomic runtime installation.
• Intrafile dataflow enabledproduction scans now track tainted values across functions and methods within the same file. Cross-file dataflow is not claimed by this release.
• Strict scan integrityengine errors, global timeouts, skipped rules, skipped paths, missing targets, or incomplete execution now fail the scan instead of publishing partial results.
• Bounded executionseparate per-rule and overall deadlines, process-tree cancellation, deterministic batching, and tightly limited recovery prevent pathological rules from stalling complete scans.
• Faster rule loading and executioncompacted rule configurations, cached ruleset metadata, safer target planning, and controlled parallelism substantially reduce repeated scanner overhead.

Broader Detection Coverage

• Expanded language coveragesubstantially extended security rules for JavaScript, TypeScript, Python, Java, Go, PHP, Ruby, Rust, C, C++, C#, Apex, Swift, Solidity, Scala, Clojure, and Elixir.
• Framework and vulnerability coverageadded focused detection for injection, XSS, path traversal, SSRF, XXE, unsafe deserialization, command execution, authorization, JWT, cryptography, secrets, prototype pollution, ReDoS, and insecure configuration.
• AI and agent securityadded checks for LLM SDKs, MCP servers, agent configuration, prompt injection boundaries, unsafe tool execution, exposed AI credentials, and risky automation hooks.
• Infrastructure and delivery formatsexpanded coverage for Terraform, Kubernetes, Docker, GitHub Actions, OpenAPI, Nginx, CI configuration, templates, and generic secrets.
• Updated community foundationsynchronized the Semgrep Community Rules base and added pinned, licensed third-party rule packs with provenance and release validation.

Dependency Scanning Performance

• Persistent dependency cachelockfile parsing, package/version queries, negative results, and vulnerability details are reused safely with content-based invalidation and bounded LRU storage.
• More efficient OSV accesspackages are deduplicated before querying, batches run with controlled concurrency, and each vulnerability detail is downloaded only once.
• Fail-safe cache handlingcorrupt caches are rebuilt automatically, while failed, cancelled, malformed, or incomplete network responses are never stored as successful results.
• Clear coverage reportingunsupported or non-exact dependencies are reported explicitly instead of being silently treated as assessed.

AI Pipeline Improvements

• AI triage is now optional and disabled by defaultdetector findings proceed directly to enrichment unless oryon.ai.triageEnabled is enabled.
• Faster enrichmentconcurrent processing, in-flight request deduplication, scan-level session reuse, persistent caching, progress reporting, and circuit-breaker protection reduce repeated latency.
• Fail-open enrichmentauthentication, provider, timeout, schema, or subscription failures preserve the original detector findings.

Production Ruleset and Result Changes

• All useful categories retainedproduction_security now includes security, correctness, good-practice, maintainability, performance, portability, AI, and other actionable checks, excluding only an explicitly audited denylist.
• Informational findings includedINFO is now a supported severity and the default display threshold. Workspace scans retain and synchronize every severity.
• More source files in scopescripts, bin, and environment files are no longer excluded by default, while generated output, vendored dependencies, caches, and ignored repository files remain filtered.
• Expected finding-volume changeversion 2.0 can report more findings than 1.x because informational and non-security quality rules are retained and AI triage is opt-in.

Parser, Workspace, and Packaging Reliability

• Modern syntax compatibilityreversible staging handles parser edge cases across TypeScript, JavaScript, C/C++, Apex, Bash, Clojure, Ruby, Rust, Swift, and generated scanner sources while restoring original result locations.
• Deterministic workspace phaseslanguage, template, and generic security phases account for every selected rule and admitted file under one global scan deadline.
• Parallel code and dependency analysisboth detector phases run concurrently while preserving complete-result publication semantics.
• Lean release packagingrule fixtures, evaluation corpora, local environment files, and development-only assets remain excluded from the VSIX.

v1.0.11

2026-07-10

Project Linking & Dashboard Sync Reliability

• Automatic sync resume after linkingwhen a local scan cannot be uploaded because a project still needs to be selected or created, linking the project now resumes that upload without running the scanner again.
• Explicit upload outcomesdashboard synchronization now distinguishes project selection, authentication, subscription, network, permission, repository mismatch, partial sync, and successful sync states instead of collapsing them into an undefined result.
• Workspace-safe project cachecached project mappings are now scoped by backend, company, and repository to prevent a project ID from leaking across Oryon workspaces.
• Repository binding validationthe project picker only offers unbound projects or projects already linked to the current repository, and caches the selection only after the backend confirms the binding.
• Clearer clean-scan statusa scan with no findings now explains whether it was synchronized or remains available locally pending dashboard sync.
• Regression coverage expandedadded coverage for clean scan → failed link → manual project creation → automatic upload without rescanning, plus cache isolation and structured failure classification.

v1.0.10

2026-05-06

Hotfix

• OAuth bridge compatibility fixeddeeplinks generated by older dashboard bridge pages with HTML-escaped query separators are parsed correctly, so automatic Google/SSO/Magic Link callbacks keep their code and state parameters.

v1.0.9

2026-05-06

Hotfix

• Google OAuth deeplink state handling hardened againthe extension now binds against the state embedded in the opened OAuth URL and mirrors pending OAuth state hashes to global storage files, keeping automatic login working across VS Code/WSL hosts while preserving phishing callback rejection.

v1.0.8

2026-05-06

Hotfix

• Google OAuth automatic deeplink fixed for multi-window VS Code/WSL setupspending OAuth states are remembered across extension hosts, so callbacks delivered to a sibling VS Code window can still complete automatically while unsolicited or mismatched links remain rejected.

v1.0.7

2026-05-06

Hotfix

• Google OAuth deeplink completion restoredcallbacks are registered before the browser opens, so fast vscode:// returns complete automatically while still requiring the backend-issued state.

v1.0.6

2026-05-01

Security Hardening

• Trusted backend origin enforcementworkspace-controlled backend URLs are ignored for authentication, and production only accepts trusted Oryon origins.
• Deep-link session bindingGoogle OAuth, generic SSO, Enterprise SSO, and Magic Link callbacks now require a matching local pending login flow before tokens are exchanged or stored.
• CSV export formula protectionexported CSV cells are neutralized against spreadsheet formula injection across result and findings exports.
• AI triage context hardeningheuristic callee context now avoids comment/string/receiver-call poisoning so unrelated helpers are not mislabeled as actual callees.

v1.0.5

2026-03-23

Scan Reliability Hotfixes

• OpenGrep macOS heavy-ruleset fixinteractive scans on macOS and Windows now compact large rule-config selections into a temporary directory proactively, avoiding unstable runs with hundreds of direct --config=... flags.
• Dependency scanner OSV SwiftPM fixdependencies from Package.resolved are no longer sent to OSV with the unsupported SwiftPM ecosystem, preventing one unsupported package manager from poisoning an entire vulnerability batch.
• OSV bad-batch isolationwhen OSV rejects a dependency batch with 400, the scanner now recursively splits the batch to isolate only the invalid dependency instead of dropping the whole set.
• Regression coverage expandedadded dedicated tests for Darwin heavy-ruleset OpenGrep compaction, unsupported SwiftPM OSV skipping, and resilient OSV batch isolation.

v1.0.4

2026-03-23

Ruleset Parsing & CWE Taxonomy

• CWE taxonomy load fixOryon Results no longer fails to build the rule-to-CWE index when bundled rule fixtures contain multi-document YAML.
• Rule config parsing alignedthe results taxonomy loader and ruleset inventory now share the same rule-config parser, ignore .test.* fixtures, and accept multi-document rule files safely.
• Regression coverage addeddedicated tests now lock the .test.yaml exclusion behavior and multi-document rule parsing across taxonomy and ruleset inventory paths.

v1.0.3

2026-03-17

Oryon Results Filters & Layout

• Faceted results filteringOryon Results now filters mixed scan output by source (All, Code, Dependencies), language, and CWE so teams can isolate the exact slice they need.
• Consistent dropdown UXLanguage, CWE, and Sort now use the same custom dropdown pattern and responsive toolbar layout, avoiding overlapping controls in narrower panels.
• Filtered export parityJSON/CSV exports now respect the currently filtered result set instead of always exporting the full dataset.
• Dependency detail overflow fixtechnical advisory content now wraps correctly in the details panel, with horizontal scrolling limited to code/diff blocks instead of the whole card.

Oryon Hub Scan Tracker

• Stage-based tracker redesignreplaced the old scan pill with a compact staged tracker in the Hub covering Collect, Scan, AI Triage, Enrichment, Sync, and Done.
• Clearer AI separationthe previous combined AI phase is now split into AI Triage and Enrichment so users can tell what the pipeline is doing.
• More stable progress semanticstracker percentages are now normalized for display so they do not start at a false 100%, regress between AI phases, or lose short-lived stages due to throttling.
• Terminal states cleaned upcompletion, cancellation, and failure states now stay visible briefly with explicit final status before the tracker clears.

v1.0.2

2026-03-14

AI Triage & Billing Flow

• Deterministic triage expansionstronger structural proofs now auto-drop additional safe cases across path confinement, typed deserialization, template auto-escaping, secure cookie flags, and constant/trust-boundary scenarios.
• Billing block handling unifiedupload and project-link flows now surface backend 402 subscription limits consistently, including upgrade links and enriched local exceptions.
• Dashboard sync flow simplifiedlocal scans no longer pre-emptively stop sync status handling based on stale quota checks in the extension UI.

Windows Scan Reliability

• OpenGrep Windows arg-limit fixoversized interactive ruleset selections now compact into a temporary config directory before execution, preventing ENAMETOOLONG failures on Windows workspaces with large active rulesets.
• Planner behavior preservedcompacted rule execution still keeps heavy-ruleset planning and concurrency limits aligned with the original selected config count.
• Regression coverage expandedadded dedicated tests for compacted Windows config execution and planner stability under heavy rulesets.

Project Linking & Dashboard Handoff

• Dashboard project creation link hardenedthe extension now builds the dashboard /projects/new URL from an explicit helper so name and repo_hash always survive handoff intact.
• Clearer follow-up guidance after web handoffwhen project creation is deferred to the dashboard, the extension now tells the user to rerun Oryon: Link Project or launch a new scan after finishing the web flow.
• Regression coverage added for dashboard handoffadded a dedicated unit test to lock the generated dashboard creation URL contract.

v1.0.1

2026-03-13

AI Triage Evidence Engine

• Structured evidence IRtriage now extracts reusable evidence blocks and deterministic drop hypotheses before model escalation.
• Proof-first 2-pass reviewPass A promotes semantic-safe candidates with stronger proof ranking, while Pass B acts as an explicit verifier with adaptive batching and safer split behavior.
• Broader language-aware reasoningexpanded support for multiline helpers, overwrite patterns, path proofs, command proofs and output-encoding checks.
• Telemetry and regression coverage expandedadded richer family stats, prefilter/triage counters, and dedicated unit suites for evidence and semantic candidate handling.

Scan Profiles & Deterministic Prefilter

• Production ruleset profilesinteractive scans can switch between production_security and full, with production_security as the default for cleaner actionable results.
• Deterministic prefilter redesignfindings are now filtered through structural and semantic proofs with blocker tracking instead of path-only heuristics.
• OpenGrep planning hardeninglarge repositories are bucketed with explicit argument-budget awareness to keep scans stable and predictable.
• Ruleset/profile controls exposedthe new scan profile setting is available directly in extension configuration.

Benchmark & Evaluation Tooling

• Cross-repo ground-truth workflowadded dataset import, materialization and local-registration utilities for OWASP Benchmark, Juliet and Vul4J.
• Official cohort runnerheadless evaluation can now execute reproducible benchmark cohorts across multiple repositories with stronger per-run telemetry.
• Reporting and scoring refreshbenchmark reports and scorers now support repo-specific ground truth, normalized local commits and larger cohorts.
• Evaluation docs expandeddocumented the official cohort workflow, repo feedback loop, ruleset profiles and the new prefilter strategy.

Shared False Positives

• Fingerprint alignment fixfalse-positive suppression fingerprints now match the API contract, preventing restore/filter mismatches for shared suppressions.

Packaging & Distribution

• VSIX cleanuprelease packages no longer include local build env files, eval configs, test stubs, backup assets or unused logo variants, trimming the universal artifact without changing runtime behavior.

v1.0.0

2026-03-10

AI Triage Maturity & Precision

• Semantic false-positive reviewPass A now detects semantic-safe patterns before escalation, while Pass B keeps the final conservative decision.
• Helper-aware context injectionneutral findings can include nearby helper blocks and mitigation code so AI decisions are grounded in local project behavior.
• Stronger guardrailsadded visible-secondary-risk vetoes, command execution locality hardening, Kotlin safe-flow coverage, and stricter conservative keeps for ambiguous code.
• Deterministic cache reuserepeated exact contexts are deduplicated and persisted for headless evaluation and repeated scans, reducing latency and model spend.
• Headless evaluation workflowadded benchmark/report tooling and semantic triage counters so triage quality can be measured and tuned systematically.

Scan Reliability & Noise Reduction

• Monolithic OpenGrep execution restoredlarge mixed repositories now prefer a stable all-in-one scan plan again where it performs better than fragmented execution.
• Unsupported-flag resiliencethe scanner now strips incompatible optional OpenGrep flags instead of failing scans on older binaries.
• .gitignore supportworkspace scans, single-file scans and dependency lockfile discovery now skip files ignored by the repository itself.
• Stronger finding identitycode findings now carry snippet hashes and stronger IDs to avoid collisions between same-rule findings on the same line.

Authentication & Onboarding

• First-login onboarding supportthe extension now handles backend onboarding_required responses instead of failing generic login flows.
• Unified login coverageGoogle, SSO, Enterprise SSO and Magic Link flows all preserve onboarding continuation when identity is valid but workspace setup is pending.
• Embedded onboarding UIusers can complete independent, create_company, or join_company directly from the login webview.

Oryon Hub & Project Workflows

• More visible project linkingunlinked repositories now show a highlighted CTA banner in the Hub, plus explicit link/unlink controls.
• Dashboard shortcutadded direct Open dashboard access from the Hub footer.
• Manage false positiveslinked repositories can restore shared false positives directly from the Hub.
• Workspace actions cleaned upscan, results, workspace switching and project actions are now wired consistently through the Hub webview.

Shared False Positives

• Red action in resultscode vulnerabilities now expose a False positive button next to Open issue.
• Confirmation before suppressionfalse positives require explicit confirmation before being hidden.
• Shared suppression cacheonce marked, a finding is filtered before triage, enrichment, upload, diagnostics and results for the exact repository.
• Restore flowshared false positives can be restored from the Hub without leaving VS Code.

Developer Experience

• OpenAPI sync refreshedgenerated API types now include onboarding and finding-suppression contracts.
• Expanded unit coverageadded tests for onboarding-preserving auth flows and stronger fingerprint generation.

v0.5.0

2026-02-27

AI Triage 2-Pass Engine (Major)

• Two-pass AI triage pipeline(rewrote/deleted on 1.0.0): introduced a dedicated Pass A candidate phase and Pass B reviewer phase for false-positive reduction with explicit keep/drop reasoning.
• Family-aware triage routing(rewrote/deleted on 1.0.0): findings are grouped into security families (sql_nosql_injection, xss_template, command_exec, auth_access, crypto_secrets, path_file, deserialization_ssrf_xxe, misc) before model evaluation.
• Structured schema validation for model outputtriage responses are normalized and validated to guarantee stable id/decision/reason contracts.
• Fail-safe behaviorwhen triage cannot issue a reliable decision (provider issues, invalid payloads, timeouts), findings default to keep.

Triage Decision Quality & Safety(rewrot/changed on 1.0.0)

• LLM-first final decisioningtriage no longer performs forced heuristic drop actions in the AI stage; heuristics are now used as contextual hints only.
• High-severity guardrailsCRITICAL (and HIGH outside generated assets) remain protected from aggressive dropping.
• Risk-language guardraildrop reasons that indicate explicit exploitability/risk are automatically converted to keep for analyst safety.
• Improved reason quality policyprompts now enforce concrete evidence-based rationale format with local anchors from snippet/context.
• Consistency metricsadded and stabilized triage counters (passADropCandidates, passBDropConfirmed, passBVetoedToKeep, forcedDrops) for clear runtime diagnostics.

Project Context Intelligence (Framework-Agnostic)

• Project mitigation context indexingtriage now scans the repository for local security helper definitions and injects relevant related definitions per finding.
• Broader language/template support in context extractionexpanded source/template recognition to better cover mixed modern stacks and heterogeneous codebases.
• Safer route-helper inferenceroute helper shortcuts are now constrained by framework context to reduce framework-specific false assumptions.

Streaming AI Pipeline (Latency & Cost)

• Streaming orchestration addedenrichment starts as soon as triage emits kept batches, without waiting for full triage completion.
• Code pipeline decouplingtriage and enrichment now operate as separate services with controlled concurrency and deterministic ordering.
• Selective enrichmentonly keep findings proceed to AI enrichment, reducing unnecessary token usage and end-to-end latency.

Sidebar & Settings UX

• New triage strategy setting in sidebarusers can select conservative, balanced, or aggressive directly in configuration UI.
• Persistent strategy preferencetriage strategy selection is now persisted globally across sessions/workspaces.
• Status messaging updatesscan lifecycle now explicitly reports triage phase and AI pipeline progression.

Scan/Schema Hardening

• Default exclusions tightenedimproved workspace scan noise filtering for generated/minified assets and bulky frontend artifact paths.
• Built-in excludes always enforceduser-defined excludes now extend defaults rather than replacing them.
• Enrichment schema resiliencenormalized AI payload edge cases (e.g., impact arrays, unknown complexity values) to avoid enrichment failures.
• Cache version bumpsenrichment and triage persistent cache keys were updated to ensure clean rollout of new behavior.

Test Coverage & Documentation

• New triage unit suitesadded dedicated tests for family routing, prefiltering, streaming triage/enrichment pipeline, guardrails, and stats consistency.
• Architecture docs for triage flowadded internal design reference for the two-pass AI triage model.

v0.4.5

2026-02-23

Dependency Update Intelligence (Security + Upgrade Strategy)

• Update classification addeddependency vulnerabilities now include structured update strategy metadata (recommended_version, update_kind, security_context, major_jump_count, requires_intermediate, upgrade_path, analysis_confidence).
• Large-jump detectionwhen the fixed target implies a major version gap, the extension flags staged migration risk and recommends intermediate upgrade steps.
• Deterministic + AI update notesvulnerabilities now include actionable update notes (summary, security_changes, breaking_changes, migration_steps, sources, confidence) synthesized from OSV/advisory context and enrichment output.

Target Compatibility Analysis (Multidomain)

• Target-aware compatibility impactsfindings and dependency vulnerabilities now include compatibility impacts against configured targets (browser, runtime, framework, toolchain).
• JS browser compatibility surfacedbrowser-targeted incompatibilities are now reported with explicit unsupported-version context when available.
• Config-driven behaviorcompatibility analysis is controlled via settings and remains informational (it does not alter finding severity).

UI & Data Contract for Dependency Insights

• Results UI expansiondependency cards now render update strategy, update notes, and target compatibility sections in the extension results view.
• Upload payload enrichmentdependency bulk upload now sends top-level dependency update fields and keeps backward-compatible mirrors in enriched_json.
• OpenAPI syncextension API types were regenerated to align with dependency vulnerability contract updates.

Project Linking UX (Enterprise)

• Explicit link/unlink workflowadded Oryon: Link Project and Oryon: Unlink Project commands to manage workspace-to-project binding directly, without hidden cancellation flows.
• Action-based project pickerproject selection now exposes explicit actions to select existing, create from extension, or open dashboard project creation with prefilled name and repo_hash.
• No more ESC-dependent create pathcreating or linking a project is now discoverable and intentional from the picker itself.
• Workspace-safe unlinkingunlink removes only local workspace mapping and never deletes remote projects.
• Sidebar visibilitysidebar now shows live project link status and dynamically toggles action between Link project and Unlink project.
• Project-link refresh lifecycleproject link state refreshes after auth/profile sync, workspace switch, and successful uploads.

Reliability & Test Coverage

• Project cache metadata extensionlocal project mapping now stores optional project name alongside project ID for better UX context.
• Cleaner ensure flowensureProject now uses structured picker actions and clearer terminal states (selected, created, dashboard, cancelled).
• Unit coverage addedtests now validate project picker action outcomes (select, create, open_dashboard, cancel) and support regression safety for enterprise linking flow.

v0.4.4

2026-02-23

Results View Fixes

• Dependency card expansion fixopening one dependency card no longer expands other cards that shared the same advisory ID.
• Details hydration fixopening a finding detail now reliably loads content without requiring Expand all.
• Markdown rendering hardeningfixed mixed markdown/code rendering so placeholder tokens like @@CODE_BLOCK_X@@ are replaced correctly.
• Cleaner rule identifierslong internal rule paths are normalized for display in cards and logs.

AI Enrichment Reliability

• Ephemeral key request deduplicationconcurrent enrichment paths now reuse the same in-flight key request instead of issuing duplicates.
• Schema tolerance improvementsAI enrichment now accepts nullable cwe/owasp and normalizes reference types such as CVE/GHSA.
• Circuit-breaker behavior tuningtimeout/schema issues no longer aggressively trip breaker flow; timeout logging is cleaner and less noisy.

Logging & Diagnostics

• Readable output formatintroduced pretty log format with structured sections, key ordering, truncation/sampling for large payloads, and compact timestamps.
• Configurable format/levelnew settings oryon.logFormat (pretty/json) and oryon.logLevel (debug/info/warn/error).
• Rule sanitization warning fixremoved false-positive sanitize warnings when a configured ruleset path points to a file (e.g. rules/template.yaml).

Cache

• Persistent cache resetenrichment cache storage key bumped from ORYON_ENRICHMENT_CACHE_V4 to ORYON_ENRICHMENT_CACHE_V5.

v0.4.3

2026-02-23

Immediate Local Results + Background Sync (Scan UX)

• Local-first completionworkspace scan now publishes normalized/enriched findings to the UI immediately after enrichment, without waiting for backend upload.
• Upload decoupled from renderdashboard sync now runs in background after local publish, so users can inspect results while sync is still running.
• Run isolation with anti-race guardsscan lifecycle now uses a runId guard to prevent stale callbacks (enrichment/upload from old runs) from overriding active scan status.
• Clearer end statesresults now differentiate between:
• local-ready (Results ready locally ...)
• syncing (Syncing results to dashboard ...)
• synced (Synced to dashboard ...)
• local-only fallback when upload is unavailable/fails.

High-Fidelity Progress Orchestration (Pipeline)

• Structured progress eventsadded across scanner/enrichment/upload layers to report real work instead of generic status text:
• code scan chunk progress (OpenGrep)
• dependency scan stage progress (lockfile discovery/parsing/OSV querying)
• AI enrichment progress (code + dependency streams, cache hits, retries, timeouts, processed totals)
• upload sync progress (project resolution, scan creation, findings chunks, dependency upload).
• Throttled status dispatch(UI-safe cadence) to avoid status spam and unnecessary render pressure while preserving responsive progress.
• Unified status fan-outprogress now consistently feeds VS Code progress notification + results status + sidebar status.

Results Webview Performance & Responsiveness

• Message protocol split
• type: "data" sends dataset only
• type: "ui" sends status/busy/counts/meta only
• optional type: "toast" for non-blocking UX feedback.
• Reduced unnecessary rerendersstatus-only updates no longer force full dataset rerender.
• Background preparation workeradded views/results/worker.js to offload heavy filter/sort/tree model preparation from main thread.
• Best-effort fallbackif worker cannot run, panel automatically falls back to synchronous in-thread preparation.

Expand-All UX Improvements (Non-Blocking)

• No more blocking alertsreplaced window.alert with in-panel toast notifications.
• Filtered-scope expansionExpand all now applies to the currently filtered dataset (not the full raw list).
• Configurable safety capadded oryon.results.maxExpandAll setting (default 40) to control mass expansion limits.
• Runtime config propagationresults panel receives cap dynamically via webview meta payload.

Security/Infrastructure

• Webview CSP updateadded worker-src policy in results view to safely enable web workers for background processing.
• GCM decryption hardeningAiKeyIssuer now enforces a 16-byte AES-GCM authentication tag and passes explicit authTagLength to createDecipheriv, reducing false-positive security findings and tightening crypto validation.

Tests

• New unit coverage for enrichment progressadded monotonic progress assertions to ensure done never regresses and final state reaches done=total.

v0.4.2

2026-02-22

Authentication Provider Parity (Auth)

• 4 Explicit Login Methods in IDEthe login view now exposes dedicated actions for Google, Microsoft SSO, Magic Link, and Enterprise SSO.
• Backend Flow Alignmentextension auth manager now implements explicit sso_url/sso_callback, enterprise_url/enterprise_callback, and magic_link/magic_link_exchange flows, matching WebAPI capabilities.
• SSO Deep-Link Routing FixURI callback handling now correctly routes provider=sso to the SSO callback exchange path instead of defaulting to the Google callback path.
• Clearer Login UX Statesunified button pending/error/success handling in the login webview with provider-specific startup guidance.

Session Refresh Reliability (Auth)

• Cross-Window Session Syncauth now syncs the latest stored session from SecretStorage before access-token checks and refresh attempts.
• Stale Refresh Token Mitigationrefresh flow now retries once with the newest persisted refresh_token when a 401 occurs, reducing false logout scenarios caused by token rotation races.
• Improved Refresh Diagnosticsauth.refresh logs now include backend status and error.code metadata for faster root-cause analysis.

v0.4.1

2026-02-22

Reliability & Security (Critical Security Fixes & Performance Improvements)

• Refresh Token Rotation Supportauth refresh now persists rotated refresh_token values returned by backend, avoiding stale-token loops after tenant/session renewals.
• Concurrent Refresh Coverageexpanded auth unit tests to assert refresh payload correctness and token rotation across consecutive refresh cycles.
• Scan Lifecycle Guardadded a workspace scan in-progress lock to prevent overlapping full scans and race-prone UI states.
• Clearer Results Statusesresults view now reflects explicit completed/cancelled/failed states during workspace scan flow.
• Fast Fix Boundary Validation"Apply Fix" now validates target files against the active workspace root (including realpath checks) and blocks out-of-workspace patch attempts.
• AI Pipeline Safeguardstuned enrichment defaults (timeouts/retries) and circuit-breaker tripping behavior for repeated service pressure and parse-time failures.
• Large Result Set Stabilityresults rendering now auto-disables server-side Shiki highlighting when finding volume exceeds a safe threshold.

Packaging & UI Hardening (Build)

• Binary Integrity Checkspackage download script now validates SHA-256 checksums for OpenGrep binaries and fails fast on mismatch.
• Safer Sidebar Renderingreplaced dynamic innerHTML composition in key sidebar/tooltip/action paths with explicit DOM builders.
• Dependencies Updatedbumped axios to ^1.13.5 and diff to ^5.2.2.

Documentation [Docs]

• Architecture Deep Diveadded a full technical architecture guide for the extension (docs/engineering/extension-architecture-deep-dive.md).

v0.4.0

2026-02-18

UI/UX Overhaul (Major)

• Unified Results Experienceremoved the old split between results tree + external summary panel. Findings now live in one richer results webview.
• Full Sidebar Refreshredesigned structure, cards, controls, spacing, labels, and state model to align with the new dashboard-style UX.
• Complete Visual Redesignrebuilt the results shell for list/tree modes with cleaner hierarchy, modernized sorting controls, and better interaction flow.
• VS Code Theme Compatibilitymigrated styling to VS Code design tokens and semantic variables, making the extension compatible with dark, light, and custom themes.
• Live Theme Syncauto, dark, and light apply instantly across webviews without reload.
• Better Readabilityricher markdown rendering (headings, lists, fenced code, inline code), cleaner remediation blocks, and improved advisory structure.
• Multi-Engine Highlightingadded Shiki tokenized rendering with Highlight.js fallback and improved language inference from file path/snippet context.
• Overflow/Clipping Fixesfixed clipping in snippets, code boxes, and diffs; improved wrapping/scroll behavior for long lines.
• Logo Assets Updateadded alternative wide logo variants for dark/light contexts.

Scanning, Ingestion & Data Consistency

• Robust State Handlingimproved scan lifecycle transitions in sidebar/results, including cancellation handling and post-scan trend refresh hooks.
• Pre-Upload Normalizationadded validation and dedup normalization for SAST findings and SCA dependency vulnerabilities.
• Accepted/Rejected Trackingbulk upload now tracks submitted/accepted/rejected counts and duplicate responses.
• Partial Success Feedbackusers now get clearer feedback when backend accepts only part of a batch.
• Local vs Backend Checkslogs explicit warnings when local finding totals differ from backend persisted totals.
• Lockfile Noise Reductionexcluded .ruby-lsp from lockfile discovery to avoid unstable SCA variance across scans.
• Better Vulnerability MappingOSV detail retrieval now resolves unique vuln IDs first, then maps back to all dependency associations.
• Status Copy Normalizationstandardized project resolution/upload progress messages in English.

Developer Experience & Tooling (Build)

• One-Shot Dev Bundleadded bundle:dev (esbuild --once) for faster local compile cycles.
• New Utility Scriptsadded compile and check script aliases.
• Launch Integrationadded preLaunchTask compile + workspace tasks to improve extension-host startup reliability.
• Architecture Alignmentupdated docs to reflect the unified results architecture and new sidebar/results behavior.

Removed / Deprecated (Cleanup)

• Removed resultsPaneldeleted deprecated panel implementation and old panel assets.
• Removed openPanel Flowremoved obsolete commands, labels, and action hooks tied to the legacy panel.

v0.3.9

2026-02-16

UI/UX Refinements & Stability (Major)

• Modern SidebarRedesigned the sidebar with a cleaner, more professional look. Buttons are now flatter and more compact, and summary cards use a dense grid layout to maximize space.
• Theme SelectionAdded a new "Theme" setting in the sidebar, allowing users to explicitly choose between 'Auto', 'Dark', and 'Light' modes for the results view.
• Live Scanning ToggleAdded a direct toggle for "Real-time analysis" in the sidebar settings, making it easier to enable/disable automatic scanning on type.
• Dynamic Theme SwitchingChanging the theme now updates the UI instantly without requiring a window reload.
• Scan StabilityFixed a critical issue where the scan status could get stuck on "Collecting..." or "Enriching..." if the scan was cancelled or interrupted.
• Tree View ImprovementsFixed a layout issue where the tree view would progressively shrink in width. Added text truncation for long filenames and optimized nested padding for a better hierarchy visualization.
• LocalizationAdded full Spanish translations for all new sidebar settings and controls.

v0.3.8

2026-02-16

Performance & Stability (Critical)

• 400% Faster AI EnrichmentOptimized the enrichment pipeline by increasing concurrency to 8 threads and implementing smarter request staggering.
• Zero TimeoutsImplemented intelligent context limiting (4k chars) to prevent large code lines from hanging the AI engine.
• Resilient Circuit BreakerThe enrichment process no longer aborts on transient network issues or rate limits, ensuring complete results even under heavy load.
• Transparent CachingUpgraded cache storage to V4, automatically resetting old caches to ensure all users benefit from the new optimization logic immediately.

v0.3.7

2026-02-14

Authentication (Enterprise SSO)

• Smart LoginThe "Login with Email" form now automatically detects if a domain has Enterprise SSO enabled.
• Enterprise OIDC BrokerAdded support for enterprise identity providers (Okta, Auth0, Microsoft Entra) via a secure OIDC broker flow.
• Deep Link SSOIntegrated enterprise SSO callbacks into the deep link handler for seamless VS Code redirection.
• UI EnhancementsUpdated login view labels and instructions to support the new enterprise flow.

v0.3.6

2026-02-13

Authentication (Magic Link)

• Passwordless LoginReplaced email/password login with Magic Link authentication.
• IDE Deep LinkOpening the Magic Link email completes the login via vscode://... automatically, with manual code fallback.
• API Contract UpdatesUpdated generated API types for the new magic link endpoints.

v0.3.5

2026-02-13

Workspaces & Multi-Org (Major)

• Switch WorkspaceAdded Oryon: Switch Workspace to let users select the active company/workspace without editing settings manually.
• Tenant-Aware SessionSwitching workspace refreshes tokens and updates the extension state to match the selected tenant context.
• Entitlements by WorkspacePlan limits and feature gating (AI, quotas) are now evaluated against the active workspace, aligning with the B2B model.
• API Contract UpdatesExtended TypeScript API types to match the new /me/companies and /me/switch_company responses and limits payloads.
• TestsAdded unit coverage for multi-workspace authentication and entitlements normalization.

v0.3.4

2026-02-10

Subscription Entitlements (Major)

• Plan-Aware UXThe extension now loads /api/v1/billing/limits and keeps plan limits in sync after login, profile refresh, scans, and blocked uploads.
• Feature GatingAI enrichment is automatically skipped when the active subscription does not include AI features.
• Quota EnforcementUpload and project-creation flows now detect backend 402 payment_required responses and show a clear upgrade path to pricing.
• Sidebar VisibilityAdded live plan information in the sidebar (plan, AI availability, project usage, monthly scan usage).
• Safer Upload Floworyon.project.allowCreate is respected again, instead of forcing auto-create behavior.

v0.3.3

2026-02-10

UI & UX Experience (Enhanced)

• Cyber-Premium BridgeCompletely redesigned the OAuth bridge page with a modern dark theme, smooth animations, and better guidance.
• Multi-IDE SupportAdded automatic deep link support for Cursor, VS Code Insiders, and other forks by dynamically detecting the IDE's URI scheme.

v0.3.2

2026-02-10

Authentication Experience (Fix)

• Automatic Login FixResolved a critical race condition where the manual authorization code InputBox blocked the automatic deep link flow from completing.
• Improved UXThe extension now automatically detects when a deep link login is successful and dismisses the manual input box, providing a seamless "one-click" login experience.
• Enhanced URI HandlingImproved deep link processing to ensure reliably resolving authentication flows without manual intervention.

v0.3.1

2026-02-03

Authentication Experience (Major)

• Deep Link LoginImplemented automatic login via Deep Linking. After authenticating with Google in the browser, users are automatically redirected back to VS Code (vscode://) and logged in instantly, eliminating the need to manually copy and paste authorization codes.
• Robust FallbackAdded a manual code entry fallback that automatically appears if the deep link redirection fails or is blocked by the browser.

Dependency Vulnerability Scanning (Major Feature)

v0.3.0

2026-01-29

Dependency Vulnerability Scanning (Major Feature)

• Automatic DetectionNew feature that automatically detects vulnerable dependencies in your project using the [OSV (Open Source Vulnerabilities)](https://osv.dev/) database.
• 10+ Ecosystems Supportednpm, PyPI, Maven, Go, RubyGems, Cargo, NuGet, Composer, Pub, SwiftPM, and more.
• Comprehensive Lockfile SupportParses package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, Pipfile.lock, poetry.lock, Gemfile.lock, Cargo.lock, go.mod, pom.xml, build.gradle, .csproj, pubspec.lock, Package.resolved, and more.
• Parallel ScanningDependency analysis runs in parallel with code scanning for faster results.
• Sidebar StatsThe sidebar now displays dependency vulnerability statistics including total dependencies scanned and vulnerable packages count.
• Backend SyncDependency vulnerabilities are synced to the Oryon dashboard alongside code findings.

AI-Powered Dependency Analysis

• Expert Security AnalysisProfessional-grade AI enrichment for dependencies providing realistic exploitation examples and technical breakdown.
• Structured InsightsAI extracts and displays Cause, Impact, Risk, and Mitigation for each vulnerability.
• Full Backend IngestionAI insights are synchronized with the Oryon WebAPI for dashboard visibility.

GitHub Advisory-Style UI (Visual Overhaul)

• Two-Column LayoutMain content with metadata sidebar, inspired by GitHub's Advisory UI.
• Structured SectionsInformation organized as Summary → Technical Details → Impact → Mitigation → References.
• Markdown RenderingProper rendering of code blocks, inline code, lists, and headers within vulnerability details.
• Affected Versions TableComplete version table showing all affected ranges and their corresponding patched versions:
• | Affected | Patched |
• |----------|---------|
• | < 2.2.20 | 2.2.20 |
• | >= 3.0, < 3.1.18 | 3.1.18 |
• Severity BadgesColor-coded severity indicators matching GitHub's design language.
• Category BadgesVisual distinction between CODE vulnerabilities and DEP (dependency) vulnerabilities.

Technical Improvements

• Resilience & StabilityAdded idempotency support for scan uploads and improved reliability during bulk ingestion.
• CSP FixFixed sidebar logo not displaying by adding 'unsafe-inline' to Content Security Policy for style-src.
• Translation LabelsFixed dependency stats labels showing raw l10n keys instead of translated text.
• Code QualityRemoved all debug logging, fixed ESLint warnings, and ensured consistent brace styling throughout the codebase.
• WorkspaceScanResultExtended to include dependency vulnerability data and statistics.

v0.2.6

2026-01-23

Fixed

• UI Light ModeFixed legibility issues in the sidebar, results view, and login view when using VS Code's Light themes.
• Dynamic LogoThe branded logo now automatically switches between dark and light variants to match the active theme.

Added

• Scan Cancellationadded a "Stop" button to the workspace scan progress notification. Users can now instantly cancel a running scan, which cleanly kills the underlying analysis processes.

Changed

• Scan ExclusionsAdded default exclusions for sensitive files (e.g., .env, .env.*) and rule definitions to prevent accidental scanning or uploading of secrets and internal tools.

v0.2.5

2026-01-22

Changed

• Project Auto-CreationWhen a workspace is not linked to an Oryon project, the extension now asks for the project name and creates it automatically (no more manual project_id prompts). Creation is enabled by default via oryon.project.allowCreate = true.
• Upload Flow SimplificationIf project creation is cancelled, uploads stop immediately instead of deferring to dashboard flows.
• Backend URLDevelopment mode now respects the configured backend (dev override removed).

v0.2.4

2026-01-20

Added

• INFO Severity SupportAdded full support for INFO severity level in the extension core and UI. This allows for more granular filtering of findings.

Changed

• Rule Severity TuningDowngraded "Internationalization" and "Best Practice" rules from WARNING to INFO to reduce noise and help users focus on actual security issues.
• Backend URLUpdated the default backend URL to point to the new production domain (https://dashboard.oryontechnology.com).

v0.2.3

2026-01-12

Fixed

• Live Scanning Stability (Critical)Fixed a critical issue where the live scanner would spawn infinite opengrep processes when editing binary files (e.g., Z80 assembly) or unsupported file types. Now, the live scanner explicitly filters for supported languages only.
• CPU SpikesFixed CPU spikes during rapid typing by implementing immediate process cancellation (SIGKILL) for stale scans. If you continue typing, the previous scan is killed instantly to free up resources.
• PerformanceAdded a heuristic to skip live scanning for files with extremely long lines (>2000 chars), preventing the extension from hanging on minified files or large data dumps.

v0.2.2

2026-01-08

Fixed

• MacOS Stability (Critical)Implemented aggressive cleaning of .DS_Store and other system files from rule directories immediately before scanning. This resolves persistent "Exit Code 2" crashes when opengrep attempts to parse these files as configurations.

Debugging

• Diagnostic Run (Enhanced)When a scan crashes (Exit Code 2), the extension now automatically re-runs the failing file in "verbose mode" (without --quiet) to capture the full error message (e.g., config parsing errors, missing rules). This provides vastly better debugging information in the output logs.

v0.2.1

2025-12-30

Fixed

• macOS Gatekeeper:Automatically remove com.apple.quarantine attribute from bundled binaries to prevent "Exit Code 2" crashes on macOS.
• Smart Rule Loading:Fully mitigates crashes caused by .DS_Store or other toxic files in the rules directory by loading rules explicitly.

Improved

• User ExperienceThe Login window now automatically closes upon successful authentication, providing a smoother onboarding flow.

v0.2.0

2025-12-30

Performance (Major)

• Scanning SpeedReduced workspace scan times by up to 75%(e.g., from 90s to 24s).
• Smart Rule SelectionThe scanner now intelligently loads only the OpenGrep rules relevant to your project (e.g., Ruby rules for a Rails app), avoiding the overhead of thousands of irrelevant checks.
• Smart ConcurrencyImplemented p-limit and CPU-aware concurrency to maximize scan speed (using up to 8 threads) without freezing the UI.
• Persistent AI CacheAI enrichment results are now cached on disk. Re-scanning the same code is instant and costs 0 tokens.

Robustness

• Smart FixesImplemented a "fuzzy" patch application strategy. The "Apply Fix" feature is now much more resilient to whitespace differences, line endings (CRLF vs LF), and minor context mismatches.
• Build & DependenciesResolved TypeScript/ESM interoperability issues with p-limit and execa to ensure reliable builds across all platforms.
• CompatibilityLowered vscode engine requirement to ^1.93.0 to support Cursor and other VS Code forks.

Improved

• UI VisibilityThe extension version is now displayed in the sidebar footer for easier debugging.
• Process RecoveryAdded automatic retry logic for busy files (ETXTBSY) and robust handling for "toxic" files that crash the scanner.

v0.1.16

2025-12-30

Improved

• OpenGrep SpeedIncreased process concurrency from 3 to 6 batches, resulting in significantly faster workspace scans on modern multi-core machines.
• AI ReliabilityIncreased enrichment pipeline timeout from 4 to 15 minutes and parallel request limit from 3 to 12. This solves timeouts when enriching large finding sets (>200 findings) while keeping the user workflow intact.

v0.1.15

2025-12-30

Fixed

• Critical CompatibilityLowered vscode engine requirement to ^1.93.0 to support Cursor and other VS Code forks.
• Startup StabilityAdded automatic retry logic for ETXTBSY errors to prevent scan failures when the extension binary is still locked by the filesystem.

Improved

• PerformanceEnabled parallel batch execution (concurrency: 3) for the OpenGrep scanner to significantly speed up analysis on multi-core systems.
• RobustnessImplemented chunked execution (batch size 50) for OpenGrep scans to prevent crashes (exit code 2) on large workspaces or complex file structures.
• ResilienceAdded automatic failure recovery mechanism that detects if a scan chunk crashes, identifies the specific "toxic" file causing the crash, and seamlessly continues scanning the rest of the workspace.
• DiagnosticsEnhanced logging for scanner process errors, capturing full stderr, stdout, and exitCode for precise debugging.

v0.1.14

2025-12-29

Fixed

• Fixed OpenGrep scan failing on large build directories (e.g., .next, dist) by updating default exclude patterns.
• Fixed glob pattern construction for file scanning to avoid invalid nested braces.
• Added extensive default excludes for images, binaries, and temporary files to improve scan performance and stability.

v0.1.13

2025-12-29

Fixed

• CriticalImproved error handling for OpenGrep exit code 2 (fatal errors)
• Added detailed error messages explaining common causes of scan failures
• Enhanced logging to show file counts, command length, and first few files being scanned

Improved

• PerformanceExpanded file exclusion patterns to include:
• Turbopack build artifacts (.turbo/, .turbopack/)
• Source maps (**/*.map)
• Minified files (/*.min.js, /*.min.css)
• Nuxt output directory (.output/**)
• DiagnosticsAdded detailed logging when collecting workspace files
• User ExperienceBetter error messages that explain why scans fail and how to fix them

Added

• File count and command length validation before scanning

v0.1.12

2025-12-26

Changed

• Added proprietary license configuration for Open VSX Registry compliance
• Updated package.json license field to "Proprietary"
• Added LICENSE file with copyright information

v0.1.11

2025-12-22

Fixed

• Removed all non-YAML test files from rules directory (only rule definitions remain)
• Reduced package from 2,653 to 1,962 files
• Reduced package size from 226.5MB to 226MB
• Faster Marketplace validation (no false positive secrets in test files)

v0.1.10

2025-12-22

Fixed

• Excluded Semgrep rule test files from VSIX package to avoid false positive secret detection in VS Code Marketplace
• Reduced package size from 4,011 to 2,653 files while maintaining full detection capability

v0.1.9

2025-12-22

Added

• MajorBundled 2,025 Semgrep security rules (18MB) directly in the extension
• Offline SupportExtension now works 100% offline for security scanning
• No SSL IssuesEliminates SSL certificate problems in corporate networks

Fixed

• Made time_to_fix_minutes optional in AI schema with default value of 15 minutes
• Removed invalid configuration files from rules directory

Improved

• No internet connection required for security scans
• Faster scans (no download time)
• More reliable in restricted network environments

v0.1.8

2025-12-22

Improved

• PerformanceExpanded file exclusion patterns to skip non-analyzable files (images, documents, multimedia, compressed files, fonts, binaries, databases, logs)
• Scan SpeedAdded exclusions for lock files, framework build directories (.next, .nuxt), and common cache folders (target, __pycache__, vendor)
• AccuracyReduced false positives by not scanning binary and non-code files

v0.1.7

2025-12-22

Fixed

• CriticalAdded scan subcommand to OpenGrep execution to fix exit code 2 error on Windows
• CriticalChanged --config format from two separate arguments to --config=value format for better compatibility
• Improved error logging to include full command, stderr, and exit code for easier debugging

Known Issues

• In corporate networks with SSL interception (e.g., EY, Deloitte), OpenGrep may fail to download rules from semgrep.dev due to certificate verification errors.
• WorkaroundSet environment variables before launching VS Code:
• `cmd
• set REQUESTS_CA_BUNDLE=
• set SSL_CERT_FILE=
• `

v0.1.6

2025-12-17

General

• - Architectural RefactorModularized the extension by introducing specialized services (ScanService, EnrichmentService, UploadService, FindingsManager) to replace the monolithic "God Object" pattern in extension.ts.
• - AI Schema ValidationImplemented strict Zod schema validation for AI responses (src/ai/schema.ts), ensuring robust and type-safe data enrichment.
• - Centralized Error HandlingImproved error message extraction and logging consistency.
• - PerformanceOptimized memory usage by better state management in FindingsManager.

v0.1.5

2025-12-11

General

• - Multi-Platform SupportAdded bundled OpenGrep binaries for Windows (x64), Linux (x64, ARM64), and macOS (Intel, Apple Silicon). The extension now works out-of-the-box on all major platforms.
• - Robust ExecutionImproved binary execution logic to handle permission restrictions more gracefully.
• - Windows CompatibilityFixed path resolution and binary execution specifically for Windows environments.

v0.1.4

2025-12-11

General

• - Bundled EngineOpenGrep is now included directly in the extension. No external installation required for Linux (x64/ARM64) and macOS (x64/ARM64).
• - Engine UpdateUpgraded bundled OpenGrep to v1.12.1 for improved detection capabilities.
• - DocumentationComplete overhaul of the User Guide (README.md).

v0.1.2

2025-12-10

General

• - Better severity normalization for OpenGrep results (handles WARNING/ERROR aliases and alternate severity fields).
• - Updated branding assets to PNG logos in the login and sidebar views.
• - Production builds now optionally obfuscate the bundle for publishing.

v0.1.0

2025-01-08

General

• - Initial public preview of the Oryon extension.
• - OpenGrep runner for single files and workspaces with live diagnostics.
• - Authentication lifecycle (login, refresh, whoami, logout) backed by SecretStorage.
• - AI enrichment pipeline with ephemeral key issuance and concurrency-limited requests.
• - Bulk uploader with idempotent chunking and exponential backoff.
• - Results webview with filtering, AI context, and JSON/CSV export.
• - English and Spanish localization plus JSON output logging.