v2.43.1

• Attestation commands now warn (instead of failing) when a CI-defaulted --commit cannot be resolved from the repository, allowing jobs without a checked-out repo to proceed without commit info.
• Commands that require commit info (attest pullrequest, attest jira) now emit a clear error when the commit cannot be resolved, rather than silently proceeding or panicking.
• Explicit --commit or --repo-root flags that cannot be resolved now produce a descriptive error pointing to the correct fix.

What's Changed

• fix(k8s): name artifacts by image reference when the runtime reports an image ID by @dangrondahl in #1204
• chore: replace interface{} with any and enforce it via lint by @dangrondahl in #1206
• fix(attest): don't fail when a CI-defaulted --commit has no repository by @mbevc1 in #1202
• fix(table output): sort tags so table output is deterministic by @dangrondahl in #1207

Full Changelog: v2.43.0...v2.43.1

v2.43.0

New features

• [Experimental] Added kosli evaluate policy command to evaluate a Rego policy against one or more trails server-side, with optional decision recording via --control, --flow, --trail, --name, and --fingerprint flags.
• Evaluation output now includes decision_attestation_id when the server records a decision.

Improvements

• Extracted shared runServerEvaluation helper so all server-side evaluation paths send identical requests and render identical output.
• Pre-flight checks on policy bundle size (file count and byte limit) now produce named, human-readable errors instead of opaque API rejections.

What's Changed

• feat(evaluate): kosli evaluate policy, evaluating and recording a decision in one request by @jumboduck in #1201

Full Changelog: v2.42.0...v2.43.0

v2.42.0

New features

• kosli snapshot s3: added --download-concurrency and --download-budget flags to control parallel downloads and peak temporary disk usage when fingerprinting S3 buckets.
• kosli attest sonar: --sonar-revision can now be used together with --pull-request; when provided, the command fails if the pull request's latest analysis is not of the specified revision.

Improvements

• kosli snapshot s3: S3 object keys are no longer used as local file names; each object is downloaded to a temporary file, hashed, and removed, so any valid S3 key can be fingerprinted on any OS.
• kosli get flow and kosli list flows: the Visibility field is no longer shown in table output (it is a legacy field with no effect on access).
• kosli list flows: fixed a panic when a flow has no tags.

What's Changed

• ci(kosli): attest SBOMs with the sbom type by @AlexKantor87 in #1186
• feat(snapshot s3): fingerprint S3 buckets from a virtual tree by @mbevc1 in #1180
• fix(ci): wait for staging to settle before picking a server image by @AlexKantor87 in #1190
• feat(snapshot s3): download objects in parallel within a count and byte budget by @mbevc1 in #1191
• feat: allow --sonar-revision with --pull-request to validate analysis commit by @mbevc1 in #1193
• chore(list-flows): drop the VISIBILITY column from the table output by @dangrondahl in #1187
• chore(get-flow): drop the Visibility row from the table output by @dangrondahl in #1188
• fix(snapshot k8s): do not abort the snapshot when a Running pod has an empty imageID by @dangrondahl in #1195
• test(fingerprint): cover OCI capture cleanliness against a fake registry by @mbevc1 in #1197

Full Changelog: v2.41.0...v2.42.0

v2.41.0

New features

• Added kosli attest sbom command (beta) to report a software bill of materials (CycloneDX JSON/XML or SPDX JSON/tag-value) to an artifact or trail in a Kosli flow. The SBOM file checksum, format, and a parsed summary are recorded; sbom_format and sbom_sha256 are automatically added as annotations.
• Added hidden --server-side flag to trail evaluation commands, enabling server-side policy evaluation (experimental, not yet a stable contract).

What's Changed

• feat(sbom): read CycloneDX and SPDX bills of materials by @AlexKantor87 in #1165
• feat(attest-sbom): add kosli attest sbom by @AlexKantor87 in #1168
• fix(sonar): never send the API token to a redirect target by @mbevc1 in #1170
• fix(snapshot azure): reject zip entries that would extract outside the temp dir by @mbevc1 in #1175
• fix(sbom): read the tool from a CycloneDX services entry by @AlexKantor87 in #1179
• fix(snapshot azure): stop a container spoofing its digest in logs mode by @mbevc1 in #1176
• chore: improve PR follwo-up reviews by @mbevc1 in #1181
• feat(evaluate): evaluate a trail server-side behind a hidden flag by @jumboduck in #1171
• fix: align review turns by @mbevc1 in #1185
• refactor(aws): compare the lambda package type with the SDK constant by @mbevc1 in #1184

Full Changelog: v2.40.1...v2.41.0

v2.40.1

Improvements

• Updated flag descriptions for --expires-at on create api-key and rotate api-key to clarify expiry behaviour (keys always expire; unset defaults to maximum allowed lifetime; dates beyond the maximum are capped).
• Updated --grace-period-hours flag description to clarify it defaults to the standard server-side grace period.
• Updated long descriptions for create api-key and rotate api-key to reflect expiry and grace period behaviour.

What's Changed

• docs(api-key): correct the --expires-at help text by @dangrondahl in #1164

Full Changelog: v2.40.0...v2.40.1

v2.40.0

Security notes

This release contains four security fixes. Two are credential-disclosure or code-execution issues reachable by anyone who controls input the CLI already trusts - a source repository, or the configuration of an Azure Web App being scanned. Two affect the integrity of recorded fingerprints. Upgrading is recommended.

Issue	Affected commands	Severity	Fix
Config file loaded from the current working directory	all commands	High	#1152
Azure credential sent to a registry named by an untrusted source	snapshot azure	High	#1153
.kosli_ignore could exclude itself from the fingerprint	all directory fingerprints	High (partial)	#1156
S3 object keys with .. segments and colliding keys	snapshot s3	Medium	#1155

Before upgrading, check for: a kosli.yml in any repository where the CLI runs (#1152 is a breaking change - the working directory is no longer searched); self-excluding .kosli_ignore files (#1156 changes their fingerprint); and S3 buckets with unusual object keys (#1155 may cause a snapshot to fail).

What's Changed

• fix: paginate PR commits and reviews by @mbevc1 in #1144
• docs: note 1MB JSON payload limit and upgrade x/crypto by @sami-alajrami in #1148
• feat(jira): add --jira-trailer flag to extract Jira issue key from git trailer by @vidhu-balad in #1109
• docs(security): state that the CLI has no bug bounty and point to the platform program by @AlexKantor87 in #1151
• fix(snapshot azure): only send Azure credentials to Azure Container Registry by @AlexKantor87 in #1153
• fix(config)!: stop loading the config file from the working directory by @pbeckham in #1152
• chore: condense Claude comments by @mbevc1 in #1158
• ci: upload Snyk Code SARIF to GitHub code scanning by @dangrondahl in #1159
• fix(fingerprint): prevent .kosli_ignore from excluding itself by @pbeckham in #1156
• fix(snapshot s3): reject object keys with ".." segments and never overwrite a downloaded object by @AlexKantor87 in #1155
• fix: improve Claude comments instructions by @mbevc1 in #1160
• fix: improve testing robustness by @mbevc1 in #1161

Full Changelog: v2.39.2...v2.40.0

v2.39.2

Improvements

• Fixed typos in help text for attest sonar command (corrected "overriden" to "overridden") and the --sonar-working-dir flag description.

What's Changed

• fix(docs): help typos by @mbevc1 in #1142
• ci(release): generate the full changelog, including What's Changed list by @mbevc1 in #1143

Full Changelog: v2.39.1...v2.39.2

v2.39.1

• Improved help text wording for attest jira, attest sonar, and snapshot azure-apps commands.
• Fixed doc generation: carets (^) in example titles are now rendered as backticks in Mintlify output.

What's Changed

• fix(docs): minor Mintify docs generation fixes by @mbevc1 in #1139
• chore(claude): prevent code comment proliferation by @mbevc1 in #1141
• fix(docker): build the image version from the workflow input, not git tags by @mbevc1 in #1140

Full Changelog: v2.39.0...v2.39.1

v2.39.0

New features

• attest sonar: added --sonar-branch flag to support attesting scans that ran on a non-main SonarQube branch; --sonar-branch and --pull-request are mutually exclusive.
• attest jira: Jira project keys specified with --jira-project-key are now trimmed of surrounding whitespace, so comma-separated lists like "ABC, DEF" are accepted without error.
• attest jira: When Jira returns a response indicating credentials were not accepted (e.g. an expired API token), a warning naming the username is printed and the affected issues are reported as "not confirmed" rather than silently as missing. The --assert failure message distinguishes between missing, unconfirmed, and mixed cases.

Improvements

• Added kosliIgnoreDesc to the long descriptions of allow artifact, assert artifact, and all attest subcommands (custom, decision, generic, jira, junit, override, pr-azure, pr-bitbucket, pr-github, pr-gitlab, snyk, sonar).
• attest sonar: improved error message when a scan revision is not found to indicate that only the main branch was searched and suggest passing --sonar-branch if the scan ran on another branch.
• attest jira: invalid project keys are now quoted in the error message for clarity (e.g. ["1AB" "AB-44"]).

What's Changed

• chore: bump Claude review model by @mbevc1 in #1108
• fix: formatting adjustments for docs and Makefile by @mbevc1 in #1107
• test(validation): expect schema-pattern wording for illegal names by @ToreMerkely in #1110
• chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 in the go-dependencies group by @dependabot[bot] in #1112
• chore(deps): bump anthropics/claude-code-action from 1.0.193 to 1.0.194 in the github-actions-dependencies group by @dependabot[bot] in #1113
• refactor(ci): make docker image smoke tests table-driven by @sami-alajrami in #1111
• perf: optimise regex patterns compilation by @mbevc1 in #1114
• fix(attest jira): accept --jira-project-key lists written with spaces by @mbevc1 in #1118
• fix(sonar): add --sonar-branch so attest sonar finds scans on non-main branches by @AlexKantor87 in #1119
• chore(deps): bump anthropics/claude-code-action from 1.0.194 to 1.0.195 in the github-actions-dependencies group by @dependabot[bot] in #1121
• chore(deps): bump github.com/open-policy-agent/opa from 1.19.0 to 1.19.1 in the go-dependencies group by @dependabot[bot] in #1120
• chore: add PR labelling by @mbevc1 in #1122
• chore(deps): bump github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager from 0.3.13 to 0.3.14 in the go-dependencies group by @dependabot[bot] in #1124
• chore(deps): bump anthropics/claude-code-action from 1.0.195 to 1.0.196 in the github-actions-dependencies group by @dependabot[bot] in #1126
• chore(deps): bump anthropics/claude-code-action from 1.0.196 to 1.0.199 in the github-actions-dependencies group by @dependabot[bot] in #1128
• chore(deps): bump the go-dependencies group with 9 updates by @dependabot[bot] in #1129
• fix(jira): differentiate rejected token from a missing issue by @mbevc1 in #1125
• chore(deps): bump anthropics/claude-code-action from 1.0.199 to 1.0.200 in the github-actions-dependencies group by @dependabot[bot] in #1131
• chore(deps): bump github.com/aws/smithy-go from 1.27.8 to 1.27.9 in the go-dependencies group by @dependabot[bot] in #1130
• docs: document .kosli_ignore support across commands that fingerprint directories by @sami-alajrami in #1134
• chore(deps): bump anthropics/claude-code-action from 1.0.200 to 1.0.206 in the github-actions-dependencies group by @dependabot[bot] in #1135
• fix(docker): report the real version and tree state in published images by @mbevc1 in #1137
• chore: bump Go version by @mbevc1 in #1136
• chore(deps): bump the go-dependencies group with 9 updates by @dependabot[bot] in #1138

Full Changelog: v2.38.0...v2.39.0

v2.38.0

New features

• create attestation-type: added --summary (repeatable NAME=EXPRESSION) and --summary-json (JSON array of {name, expression} entries) flags to define a named summary displayed for attestations of that type. The two flags are mutually exclusive.
• get attestation-type: summary entries are now shown in table output when an attestation type has a summary defined.

Bug fixes

• begin trail: omit description and user_data fields from the request payload when they are not set, preventing accidental overwrites of existing trail metadata.
• The docker image (ghcr.io/kosli-dev/cli:v2.38.0) now includes a /tmp writable dir which allows certain cases of the attest commands to be run with that image.

What's Changed

• fix(begin trail): stop clearing description and user_data on re-run by @JonJagger in #1104
• feat(attestation-type): custom attestation type summaries by @FayeSGW in #1099
• fix(docker): add writable /tmp to the scratch-based image by @sami-alajrami in #1105
• fix(attestation-type): reconcile --summary flags with the empty-value rule by @FayeSGW in #1106

Full Changelog: v2.37.0...v2.38.0