[duriantaco]

Summary

• Release Skylos 5.0.0 with all changes since 4.50.1.
• Replace the cancelled 4.51.0 release and keep package, lockfile, MCP metadata and release manifest versions consistent.
• Include the filesystem provenance fix for FP: SKY-D215 on literal keys in a nested function #1051 and relative evidence paths from fix(reporting): keep uploaded evidence paths relative to the scan root #1050.

Tests

• Version metadata, release-check and package-data tests: 12 passed locally.
• All five version fields and the runtime version resolve to 5.0.0.
• Full CI and distribution smoke checks must pass before publication.

---

5.0.0 (2026-10-23)

Features

• agents: add skylos agent recap, hook activity in skylos doctor, and a live README badge (#1012) (ba7a926)
• cicd: add skylos cicd agent-review for approved Cloud PR reviews, with GitHub OIDC, bounded source bundles and a generated trusted workflow (#1047) (0e4055c)
• quality: add idiom advice backed by source evidence for repeated imports, boolean branches, f-string conversions and handlers that only re-raise (SKY-L036–SKY-L039) (#1042) (fa1c9a3)
• security: add Dependabot execution and cooldown checks, decoded-secret exposure, workflow obfuscation and trusted-publishing advice (SKY-D360–SKY-D364) (#1043) (f806a0a)

Bug Fixes

• analyzer: require source evidence for exclusions and live references; track import bindings and match mock targets exactly (#1025) (f93ce5e), (#1048) (d3d9d21)
• dead-code: verify dynamic lookups, lazy exports, browser entrypoints, registration and import evidence before marking code as used (#1036) (55b81f3), (#1044) (8159626)
• security: resolve sink receivers from source bindings and classify filesystem reads, writes and exclusive creates using their actual open modes (#1030) (59aecb8), (#1033) (f7accea)
• security: trace filesystem paths through exact call sites and helper callers, preserving safe, untrusted, unknown and incomplete provenance (#1032) (d7ea15b), (#1039) (48c5f77)
• security: lock SKY-D215 regressions for nested path-table lookups: retain proven safe temporary paths while reporting unsafe values and mutations and preserving unknown caller evidence (#1052) (d2e0588)
• security: verify SQL, LLM and web input safety evidence; validate URL guards and bound XSS helper tracing (#1040) (58081f5), (#1045) (929e7b3)
• security: verify workflow credential exposure and actor authorization; follow GitHub Actions expressions, outputs and reachable triggers before reporting injection or cache risks (#1035) (07e80f4), (#1043) (f806a0a)
• secrets: preserve scalar values when reading pnpm lockfile streams (#1031) (34b5e20)
• dependencies: verify declared and transitive import providers and explicit package scopes without treating unrelated lockfile entries as declarations (#1041) (65994e3)
• performance: correct SKY-P401/SKY-P403 receiver and control-flow analysis (#1015) (7b5c5a3)
• quality: correct metrics and typing scope, and report code left unused by PR changes (#1016) (9d6255f)
• quality: reduce false positives using source and control-flow evidence for mutable defaults, resource lifetimes, test code and security context (#1013) (12ea15f), (#1018) (47d631c)
• quality: respect pytest collection and typing contexts, preserve boolean-call evidence and keep advice scoped to the relevant code (#1021) (5f4a478), (#1023) (2b0c305)
• quality: require source and policy evidence for annotation, parameter, metric and design advice (#1024) (7c2ce60), (#1027) (f43e565), (#1029) (2b15100)
• quality: keep SKY-L036–SKY-L039 style advice out of default displays and gates while retaining raw JSON records; --all-advice and explicit rule selection include it (#1046) (9a98c5e)
• reporting: combine complexity advice per function, preserve raw findings and count grouped advice consistently across reports, uploads and gates (#1019) (91ac1ed), (#1022) (5ecd621), (#1049) (1c80c7e)
• reporting: normalize nested evidence and definition paths for uploads, keep receiver proofs relative to the scanned project, and mask external evidence paths (#1050) (7999e8f)
• ci: fall back to a full scan when push history is unavailable and trigger releases after required checks finish (#1017) (851d8b7), (#1034) (2d9bda8)

Dependency Updates

• deps: update mcp to 1.30.0 and aiohttp to 3.14.4 (#1020) (5479e14), (#1028) (6ff92db)
• deps: update certifi to 2026.10.19 and the VS Code extension's markdown-it to 14.3.3 (#1037) (087d87e), (#1038) (9f21b78)

---

Release Please publishes these notes after the release commit passes the required checks.

[duriantaco]

🤖 Created releases:

• v5.0.0

🌻