@codacy/verity-cli 0.35.5 → 0.36.1-experimental.32d0f43

package/CHANGELOG.md

@@ -64,6 +64,90 @@ installs are untouched.
   which is the ordinary case for someone whose first Verity install *is* the
   plugin.
 
+## [0.36.1] — 2026-11-13
+
+### 🔎 Reviews at a commit and a push cover more, and say what they did not read
+
+- **A `git push` or a `git commit` with a pipe or a redirection is reviewed.**
+  For example, `git push 2>&1 | tail -5`. Before, Verity could not find the
+  target of such a command, and it allowed the command with no review.
+- **A change made only of large files is reviewed.** A file over the size
+  limit is not sent whole. The agent review now starts for such a change and
+  reads the diff of each file. Before, the change ended with no review and no
+  message.
+- **The result names each large file that Verity did not read in full.** When
+  the agent review received only a part of a file's diff, the notice says
+  "reviewed only in part" and gives the number of characters it received. When
+  nothing read the file, the notice says "NOT reviewed". A PASS then covers
+  only what was read, and says so.
+
+## [0.36.0] — 2026-11-12
+
+### 🧠 Curate your project's knowledge from the CLI
+
+- **`verity memory edit <node-id>`** changes a node's title, files, status or
+  body. Verity checks the change before it writes anything, and the change
+  reaches the service at once, with no review needed.
+- **`verity memory delete <node-id> --reason "…"`** removes a node that is wrong
+  or out of date, and **`verity memory restore <node-id>`** brings it back. The
+  reason stays on your machine.
+- **`verity memory ask "<question>"`** (also `recall`) answers from your
+  project's knowledge. It quotes the matching nodes with their ids. It runs on
+  your machine, with no model, and sends nothing.
+- **`verity memory dream`** shows a plan to merge near-identical nodes, retire
+  superseded ones and remove empty placeholders. `--apply` makes the changes,
+  `--revert <dream-id>` undoes them, and `--list` shows past runs. A node that
+  a person confirmed is never changed.
+- **`verity reflect` fixes:** an edited node now reaches the service, the title
+  comes from the first line, and paths written as globs, folders or in
+  backticks are scoped. A placeholder node that you removed stays removed.
+
+### 🎯 Findings outside your change no longer block it
+
+- **At a commit and a push, Verity now knows which lines your change wrote.**
+  The CLI sends line numbers, never extra code. A finding more than 3 lines
+  away from every changed line is marked pre-existing: it is still shown, but
+  it does not block.
+- **Your own problems still block.** A finding that a static tool reports keeps
+  its scope, and so does a problem that a removed line causes. A file that a
+  merge combined is reviewed as before. When the CLI cannot prove that the
+  line numbers fit the code it sent, the file is reviewed as before.
+
+### 🔒 What Verity sends, and where
+
+- **Includes security fixes.**
+- **The plugin README now lists every destination**: what Verity sends, where
+  it goes, and how long it is kept.
+- **The local scan runs offline**, with no telemetry and no update checks. For
+  Maven (`pom.xml`) projects, offline mode can miss some dependency findings.
+- **To find known malicious packages**, the CLI sends the names and versions
+  of the packages in a changed dependency file to OSV.dev, a vulnerability
+  database that Google runs. This includes the names of private packages. It
+  sends no code. The Privacy Notice names OSV.dev.
+- **The service now deletes raw telemetry on schedule**: metric points after 14
+  days and spans after 30 days. Daily totals are kept.
+
+### 🪟 Windows
+
+- **The hooks no longer open console windows**
+  ([codacy/verity#1](https://github.com/codacy/verity/issues/1)). Every
+  process that the CLI starts is hidden, and git commands run without a shell.
+  The browser for sign-in still opens normally.
+
+### ✂️ Fewer false blocks
+
+- **A null or missing field that only makes one request or one script run fail
+  no longer blocks as a critical input-sanitization finding.** It is reported
+  as its own finding, at its real severity. A null field that makes a check
+  fail open, and a wrong type that changes what a query or command does, still
+  count under the rule.
+
+### 📦 Dependencies
+
+- **`@codacy/analysis-cli` 0.25.0 → 0.29.0.** A fresh install now shows 0
+  `npm audit` findings (it showed 11 moderate). The local scan uses Trivy
+  0.74.
+
 ## [0.35.5] — 2026-11-11
 
 ### 🔬 Formal verification at push is on by default