v1.0.0

1.0.0 (2026-03-05)

Bug Fixes

• add bounded retry logic for LLM rate limit handling (#205) (6ecb786), closes #104
• Add comprehensive subprocess security guardrails (fixes #57) (#66) (454b80e)
• Add comprehensive YAML validation to prevent attacks (fixes #56) (#63) (31ecb3a)
• add repository checkout step to Claude Code Action workflow (17aa0cf)
• add uv.lock to recognized lockfiles (#143) (a98dc87), closes #137
• address P1 code quality issues from code review (#36) (5976332)
• address P1 code quality issues from code review (#37) (4be1d5e)
• address P1 code quality issues from code review (#38) (77f2300)
• assessors: FileSizeLimitsAssessor now respects .gitignore (#248) (eaaecc2), closes #245
• assessors: search recursively for OpenAPI specification files (#127) (e2a5778)
• assessors: support project-named directories and test-only repos in standard_layout check (#322) (2fbb733), closes #246 #305
• Check for all official commitlint config file formats (#308) (50588cf)
• ci: add permissions for leaderboard PR comment posting (#276) (33252e4)
• ci: use gh pr view for fork PR number lookup in coverage comment (#253) (1688362)
• cli: check .pre-commit-config.yaml for conventional commit (#310) (61c44d9)
• cli: Honor excluded_attributes from config file (#306) (ffda546), closes #302 #302
• cli: Use removesuffix instead of rstrip for .git URL stripping (#292) (6bd08cf)
• consider renovate for dependency_security check (#317) (35bfbbf)
• correct Assessment field name in demo command (#41) (b48622d), closes #12
• Correct datetime import pattern in RepomixService (#65) (517aa6e)
• correct GitHub repository link in site navigation (5492278)
• correct Liquid syntax in developer-guide (elif -> elsif) (75f3b1d)
• Correct pre-commit template path in PrecommitHooksFixer (#269) (c42a3c9)
• Create shared test fixtures and fix Assessment schema issues (#114) (46baa13)
• disable attestations for Test PyPI to avoid conflict (#155) (a33e3cd), closes pypa/#action-pypi-publish
• downgrade docker/metadata-action to v5 and fix shellcheck warnings (12f5509)
• enable Harbor task filtering for smoketest support (#222) (f780188)
• Enable workflow_dispatch for leaderboard update and regenerate data (#299) (091d9dd), closes #298
• exclude DEPLOYMENT.md and SETUP_SUMMARY.md from Jekyll build (9611207)
• Improve CLAUDE.md generation prompt and add prompt loading for future LLM integrations #283 (#284) (c0aeae4)
• Improve report metadata display with clean table format (ca361a4)
• leaderboard workflow and SSH URL support (#147) (de28cd0)
• make E2E test timeouts configurable and add sensitive directory test (#206) (27e87e5), closes #104 #192
• metadata: use Windows-compatible strftime token for human timestamp (#291) (faf536d)
• P0 security and logic bugs from code review (2af2346)
• Prevent API key exposure in environment and logs (fixes #55) (#64) (4d1d001)
• Prevent command injection in CommandFix.apply() (fixes #52) (#60) (49be28e)
• Prevent path traversal in LLM cache (fixes #53) (#61) (2bf052d)
• prevent unauthorized message for non-command comments (#262) (84c6f69)
• Prevent XSS in HTML reports (fixes #54) (#62) ([7c60c69](7c60c696176b818de0e3569e43...