v1.15.0

What's Changed

• Diff the baseline's stored file checksums when git cannot reach it by @Ibrahimrahhal in #174

Full Changelog: v1.14.2...v1.15.0

v1.14.2

What's Changed

• Find a report's files when its paths carry a base the CLI's do not by @Ibrahimrahhal in #173

Full Changelog: v1.14.1...v1.14.2

v1.14.1

What's Changed

• Retry 429 on every request, 502 on reads only by @Ibrahimrahhal in #172

Full Changelog: v1.14.0...v1.14.1

v1.14.0

What's Changed

• Upload corgea.yaml with third-party scan reports by @leenk7991 in #167
• Retry 502 Bad Gateway on every API call instead of failing the pipeline by @Ibrahimrahhal in #171

Full Changelog: v1.13.0...v1.14.0

v1.13.0

What's Changed

• Raise the blocking-rules poll timeout to outlast reachability triage by @Ibrahimrahhal in #158
• Add corgea mcp install for agent MCP configs by @Ibrahimrahhal in #163

Full Changelog: v1.12.0...v1.13.0

v1.12.0

What's Changed

• Fix cargo-audit: upgrade h2 and git2 by @Ibrahimrahhal in #162
• Report a dirty worktree only when git status does by @Ibrahimrahhal in #161
• Fix ETXTBSY flake in container-engine image tests by @Ibrahimrahhal in #164
• Scan incrementally by default: diff against the last scan locally and send the file list by @Ibrahimrahhal in #160

Full Changelog: v1.11.1...v1.12.0

v1.11.1

What's Changed

• Point the agent skill at --help instead of a second copy of the docs by @leenk7991 in #152
• Add --ignore-dirty-worktree to reuse recent scans of dirty worktrees by @Ibrahimrahhal in #159

Full Changelog: v1.11.0...v1.11.1

v1.11.0

What's Changed

• Stop waiting forever on scans that already ended by @leenk7991 in #144
• COR-1766: report dirty worktree state with corgea scan uploads by @leenk7991 in #150
• Write the scan report and SBOM before the blocking-rule gates exit by @Ibrahimrahhal in #156
• Add corgea scan --include-image to scan fully built container images by @Ibrahimrahhal in #153
• Add --skip-if-commit-scanned-recently to reuse a recent scan of the commit by @Ibrahimrahhal in #157

Full Changelog: v1.10.0...v1.11.0

v1.10.0

What's Changed

• COR-1549: decide vuln-api token-send by endpoint trust, not by whether it is the default by @juangaitanv in #135
• chore: remove sync workflows that can no longer run by @leenk7991 in #141
• COR-1258: generate CycloneDX SBOMs alongside scan reports by @juangaitanv in #142
• COR-1258: inactive Maven profile sections no longer leak into the base dependency graph by @juangaitanv in #145
• fix(cli): resolve list/wait projects by repo URL, not directory name (COR-1577) by @juangaitanv in #137
• fix(cli): harden project resolution (stacked on #137) by @juangaitanv in #138
• fix(cli): fail closed on mid-pagination 404 in project resolution by @juangaitanv in #146
• test: add hermetic CLI end-to-end coverage by @juangaitanv in #143
• Add code quality issue listing to the CLI by @Ibrahimrahhal in #130
• Add --block-on to select which blocking rules gate a CI scan by @Ibrahimrahhal in #149
• COR-1633: POL-02: wait for blocking rules by @leenk7991 in #147

Full Changelog: v1.9.3...v1.10.0

v1.9.3

What's Changed

• Add canonical dependency finding catalog by @juangaitanv in #132
• Add Codex skills sync on release by @leenk7991 in #133
• Document --fail-on malicious in the agent skill by @juangaitanv in #136
• Fix Linux release binaries requiring GLIBC_2.39, bump to 1.9.3 by @Ibrahimrahhal in #139
• Add --wait to corgea upload and print scan page URL when not waiting by @Ibrahimrahhal in #131

Full Changelog: v1.9.2...v1.9.3