chore(main): release 5.0.0

CHANGELOG.md

@@ -1,31 +1,40 @@
 ## Changelog
 
-## [4.51.0](https://github.com/duriantaco/skylos/compare/v4.50.1...v4.51.0) (2026-10-20)
+## [5.0.0](https://github.com/duriantaco/skylos/compare/v4.50.1...v5.0.0) (2026-10-23)
 
 
 ### Features
 
-* **agents:** skylos agent recap, hook activity in doctor, live readme badge ([#1012](https://github.com/duriantaco/skylos/issues/1012)) ([ba7a926](https://github.com/duriantaco/skylos/commit/ba7a92635ceea56bea7d221e0f440c589bdeba1f))
-
-
-### Bug Fixes
-
-* **analyzer:** require source evidence for exclusions and live references ([#1025](https://github.com/duriantaco/skylos/issues/1025)) ([f93ce5e](https://github.com/duriantaco/skylos/commit/f93ce5ec0ff72b3d737d359eb802952a264b68eb))
-* **ci:** run a full scan when push history is unavailable ([#1017](https://github.com/duriantaco/skylos/issues/1017)) ([851d8b7](https://github.com/duriantaco/skylos/commit/851d8b7de377bddaa2223eeacbe4b73e2e77ad6d))
-* **performance:** correct P401/P403 receiver and control flow analysis ([#1015](https://github.com/duriantaco/skylos/issues/1015)) ([7b5c5a3](https://github.com/duriantaco/skylos/commit/7b5c5a3f776e2be1a0db1f0a8d4015459c88fcd5))
-* **quality:** correct advice using source and scope evidence ([#1027](https://github.com/duriantaco/skylos/issues/1027)) ([f43e565](https://github.com/duriantaco/skylos/commit/f43e56538460426b54a1cfcef92619ed4b049ea3))
-* **quality:** correct advice using source and scope evidence ([#1029](https://github.com/duriantaco/skylos/issues/1029)) ([2b15100](https://github.com/duriantaco/skylos/commit/2b151005d79f5471f356414e39ef658e5bea3854))
-* **quality:** correct metrics and typing scope, report code left unused by PRs ([#1016](https://github.com/duriantaco/skylos/issues/1016)) ([9d6255f](https://github.com/duriantaco/skylos/commit/9d6255f97000dae1fb6d15b6e45d6cdef840f5b1))
-* **quality:** correct source evidence and control flow analysis in noisy rules ([#1013](https://github.com/duriantaco/skylos/issues/1013)) ([12ea15f](https://github.com/duriantaco/skylos/commit/12ea15f9c321b69e150afef878c66740f5022d50))
-* **quality:** guard advice collection and typing contexts ([#1021](https://github.com/duriantaco/skylos/issues/1021)) ([5f4a478](https://github.com/duriantaco/skylos/commit/5f4a478ae4a5906847f6349c0e3b1b0e77597f07))
-* **quality:** preserve boolean call evidence and correct advice context ([#1023](https://github.com/duriantaco/skylos/issues/1023)) ([2b0c305](https://github.com/duriantaco/skylos/commit/2b0c3050cca19b253fa299df88d38eebdf5db615))
-* **quality:** reduce advice noise with source and policy evidence ([#1024](https://github.com/duriantaco/skylos/issues/1024)) ([7c2ce60](https://github.com/duriantaco/skylos/commit/7c2ce602caa374f400c50b12c61e28d79ee44331))
-* **quality:** reduce false positives with guarded context checks ([#1018](https://github.com/duriantaco/skylos/issues/1018)) ([47d631c](https://github.com/duriantaco/skylos/commit/47d631ccf255c5b7fc523daa1ea92c8bc5278e83))
-* **reporting:** combine complexity advice per function ([#1019](https://github.com/duriantaco/skylos/issues/1019)) ([91ac1ed](https://github.com/duriantaco/skylos/commit/91ac1ed2a8be3ac6f4785292a0a052d97676d175))
-* **reporting:** focus advice while preserving raw findings ([#1022](https://github.com/duriantaco/skylos/issues/1022)) ([5ecd621](https://github.com/duriantaco/skylos/commit/5ecd62166176cb3877aea58746d6408eafa09878))
-* **secrets:** preserve scalar values in pnpm lockfile streams ([#1031](https://github.com/duriantaco/skylos/issues/1031)) ([34b5e20](https://github.com/duriantaco/skylos/commit/34b5e20478559193af7f0b9374c316650ee4440f))
-* **security:** resolve open modes before classifying path operations ([#1033](https://github.com/duriantaco/skylos/issues/1033)) ([f7accea](https://github.com/duriantaco/skylos/commit/f7acceae92ec6110ff14f875e2a4b402c0b48a5e))
-* **security:** resolve sink receivers from source bindings ([#1030](https://github.com/duriantaco/skylos/issues/1030)) ([59aecb8](https://github.com/duriantaco/skylos/commit/59aecb83dee2cd28d632e850eb6ceef587308160))
+* **agents:** add `skylos agent recap`, hook activity in `skylos doctor`, and a live README badge ([#1012](https://github.com/duriantaco/skylos/pull/1012)) ([ba7a926](https://github.com/duriantaco/skylos/commit/ba7a92635ceea56bea7d221e0f440c589bdeba1f))
+* **cicd:** add `skylos cicd agent-review` for approved Cloud PR reviews, with GitHub OIDC, bounded source bundles and a generated trusted workflow ([#1047](https://github.com/duriantaco/skylos/pull/1047)) ([0e4055c](https://github.com/duriantaco/skylos/commit/0e4055c70e3d8f1b0409227e4f16f6c514b3b5a4))
+* **quality:** add idiom advice backed by source evidence for repeated imports, boolean branches, f-string conversions and handlers that only re-raise (`SKY-L036`–`SKY-L039`) ([#1042](https://github.com/duriantaco/skylos/pull/1042)) ([fa1c9a3](https://github.com/duriantaco/skylos/commit/fa1c9a340770bf7ae79f06dcc30fc76b9f202e0c))
+* **security:** add Dependabot execution and cooldown checks, decoded-secret exposure, workflow obfuscation and trusted-publishing advice (`SKY-D360`–`SKY-D364`) ([#1043](https://github.com/duriantaco/skylos/pull/1043)) ([f806a0a](https://github.com/duriantaco/skylos/commit/f806a0a28a4585554414f5d0ef951b7cf87f1d5d))
+
+### Bug Fixes
+
+* **analyzer:** require source evidence for exclusions and live references; track import bindings and match mock targets exactly ([#1025](https://github.com/duriantaco/skylos/pull/1025)) ([f93ce5e](https://github.com/duriantaco/skylos/commit/f93ce5ec0ff72b3d737d359eb802952a264b68eb)), ([#1048](https://github.com/duriantaco/skylos/pull/1048)) ([d3d9d21](https://github.com/duriantaco/skylos/commit/d3d9d213f747f52af2fb806b99f5a9b4867b5f18))
+* **dead-code:** verify dynamic lookups, lazy exports, browser entrypoints, registration and import evidence before marking code as used ([#1036](https://github.com/duriantaco/skylos/pull/1036)) ([55b81f3](https://github.com/duriantaco/skylos/commit/55b81f3dfbd9173d62bb7c2b737034250377fdc8)), ([#1044](https://github.com/duriantaco/skylos/pull/1044)) ([8159626](https://github.com/duriantaco/skylos/commit/81596265441ab69562d2e130924612219a030ac0))
+* **security:** resolve sink receivers from source bindings and classify filesystem reads, writes and exclusive creates using their actual open modes ([#1030](https://github.com/duriantaco/skylos/pull/1030)) ([59aecb8](https://github.com/duriantaco/skylos/commit/59aecb83dee2cd28d632e850eb6ceef587308160)), ([#1033](https://github.com/duriantaco/skylos/pull/1033)) ([f7accea](https://github.com/duriantaco/skylos/commit/f7acceae92ec6110ff14f875e2a4b402c0b48a5e))
+* **security:** trace filesystem paths through exact call sites and helper callers, preserving safe, untrusted, unknown and incomplete provenance ([#1032](https://github.com/duriantaco/skylos/pull/1032)) ([d7ea15b](https://github.com/duriantaco/skylos/commit/d7ea15b1816423358f1a6dd3dedad16e74cd0f48)), ([#1039](https://github.com/duriantaco/skylos/pull/1039)) ([48c5f77](https://github.com/duriantaco/skylos/commit/48c5f770831d4a0d99b47cc961f13939cb2fc3f4))
+* **security:** lock `SKY-D215` regressions for nested path-table lookups: retain proven safe temporary paths while reporting unsafe values and mutations and preserving unknown caller evidence ([#1052](https://github.com/duriantaco/skylos/pull/1052)) ([d2e0588](https://github.com/duriantaco/skylos/commit/d2e05884474bdc927fd199f051ed2cae9f8cdfae))
+* **security:** verify SQL, LLM and web input safety evidence; validate URL guards and bound XSS helper tracing ([#1040](https://github.com/duriantaco/skylos/pull/1040)) ([58081f5](https://github.com/duriantaco/skylos/commit/58081f5f9a9bf2de61736cab8227dbf4c2b82c7c)), ([#1045](https://github.com/duriantaco/skylos/pull/1045)) ([929e7b3](https://github.com/duriantaco/skylos/commit/929e7b32d3cd3e339b5c0b564d386e2d60cf72fb))
+* **security:** verify workflow credential exposure and actor authorization; follow GitHub Actions expressions, outputs and reachable triggers before reporting injection or cache risks ([#1035](https://github.com/duriantaco/skylos/pull/1035)) ([07e80f4](https://github.com/duriantaco/skylos/commit/07e80f4dfd4f899affdaa57bbba9e46776e59c4d)), ([#1043](https://github.com/duriantaco/skylos/pull/1043)) ([f806a0a](https://github.com/duriantaco/skylos/commit/f806a0a28a4585554414f5d0ef951b7cf87f1d5d))
+* **secrets:** preserve scalar values when reading pnpm lockfile streams ([#1031](https://github.com/duriantaco/skylos/pull/1031)) ([34b5e20](https://github.com/duriantaco/skylos/commit/34b5e20478559193af7f0b9374c316650ee4440f))
+* **dependencies:** verify declared and transitive import providers and explicit package scopes without treating unrelated lockfile entries as declarations ([#1041](https://github.com/duriantaco/skylos/pull/1041)) ([65994e3](https://github.com/duriantaco/skylos/commit/65994e38a037cfecef1fd0d3d9b787622f728c4f))
+* **performance:** correct `SKY-P401`/`SKY-P403` receiver and control-flow analysis ([#1015](https://github.com/duriantaco/skylos/pull/1015)) ([7b5c5a3](https://github.com/duriantaco/skylos/commit/7b5c5a3f776e2be1a0db1f0a8d4015459c88fcd5))
+* **quality:** correct metrics and typing scope, and report code left unused by PR changes ([#1016](https://github.com/duriantaco/skylos/pull/1016)) ([9d6255f](https://github.com/duriantaco/skylos/commit/9d6255f97000dae1fb6d15b6e45d6cdef840f5b1))
+* **quality:** reduce false positives using source and control-flow evidence for mutable defaults, resource lifetimes, test code and security context ([#1013](https://github.com/duriantaco/skylos/pull/1013)) ([12ea15f](https://github.com/duriantaco/skylos/commit/12ea15f9c321b69e150afef878c66740f5022d50)), ([#1018](https://github.com/duriantaco/skylos/pull/1018)) ([47d631c](https://github.com/duriantaco/skylos/commit/47d631ccf255c5b7fc523daa1ea92c8bc5278e83))
+* **quality:** respect pytest collection and typing contexts, preserve boolean-call evidence and keep advice scoped to the relevant code ([#1021](https://github.com/duriantaco/skylos/pull/1021)) ([5f4a478](https://github.com/duriantaco/skylos/commit/5f4a478ae4a5906847f6349c0e3b1b0e77597f07)), ([#1023](https://github.com/duriantaco/skylos/pull/1023)) ([2b0c305](https://github.com/duriantaco/skylos/commit/2b0c3050cca19b253fa299df88d38eebdf5db615))
+* **quality:** require source and policy evidence for annotation, parameter, metric and design advice ([#1024](https://github.com/duriantaco/skylos/pull/1024)) ([7c2ce60](https://github.com/duriantaco/skylos/commit/7c2ce602caa374f400c50b12c61e28d79ee44331)), ([#1027](https://github.com/duriantaco/skylos/pull/1027)) ([f43e565](https://github.com/duriantaco/skylos/commit/f43e56538460426b54a1cfcef92619ed4b049ea3)), ([#1029](https://github.com/duriantaco/skylos/pull/1029)) ([2b15100](https://github.com/duriantaco/skylos/commit/2b151005d79f5471f356414e39ef658e5bea3854))
+* **quality:** keep `SKY-L036`–`SKY-L039` style advice out of default displays and gates while retaining raw JSON records; `--all-advice` and explicit rule selection include it ([#1046](https://github.com/duriantaco/skylos/pull/1046)) ([9a98c5e](https://github.com/duriantaco/skylos/commit/9a98c5e51c34be70c1e813c538b39620a6d7f494))
+* **reporting:** combine complexity advice per function, preserve raw findings and count grouped advice consistently across reports, uploads and gates ([#1019](https://github.com/duriantaco/skylos/pull/1019)) ([91ac1ed](https://github.com/duriantaco/skylos/commit/91ac1ed2a8be3ac6f4785292a0a052d97676d175)), ([#1022](https://github.com/duriantaco/skylos/pull/1022)) ([5ecd621](https://github.com/duriantaco/skylos/commit/5ecd62166176cb3877aea58746d6408eafa09878)), ([#1049](https://github.com/duriantaco/skylos/pull/1049)) ([1c80c7e](https://github.com/duriantaco/skylos/commit/1c80c7e28a3c79cf0c1967842148dacf9d8a797d))
+* **reporting:** normalize nested evidence and definition paths for uploads, keep receiver proofs relative to the scanned project, and mask external evidence paths ([#1050](https://github.com/duriantaco/skylos/pull/1050)) ([7999e8f](https://github.com/duriantaco/skylos/commit/7999e8fe439fe595980a0fad5a2984d167a42805))
+* **ci:** fall back to a full scan when push history is unavailable and trigger releases after required checks finish ([#1017](https://github.com/duriantaco/skylos/pull/1017)) ([851d8b7](https://github.com/duriantaco/skylos/commit/851d8b7de377bddaa2223eeacbe4b73e2e77ad6d)), ([#1034](https://github.com/duriantaco/skylos/pull/1034)) ([2d9bda8](https://github.com/duriantaco/skylos/commit/2d9bda852c4a9431aadb6a2eef9c2f0e1e81ce67))
+
+### Dependency Updates
+
+* **deps:** update `mcp` to 1.30.0 and `aiohttp` to 3.14.4 ([#1020](https://github.com/duriantaco/skylos/pull/1020)) ([5479e14](https://github.com/duriantaco/skylos/commit/5479e140cb3e51b15a589222a987bb66e55884c1)), ([#1028](https://github.com/duriantaco/skylos/pull/1028)) ([6ff92db](https://github.com/duriantaco/skylos/commit/6ff92dbf5c4babaa6f75c95dfd25caced83fe11b))
+* **deps:** update `certifi` to 2026.10.19 and the VS Code extension's `markdown-it` to 14.3.3 ([#1037](https://github.com/duriantaco/skylos/pull/1037)) ([087d87e](https://github.com/duriantaco/skylos/commit/087d87e35aa56acf1fd785b50dfceb11f9b9bf02)), ([#1038](https://github.com/duriantaco/skylos/pull/1038)) ([9f21b78](https://github.com/duriantaco/skylos/commit/9f21b7851a7ad1ad298ddd5f561f8400af24703f))
 
 ## [4.50.1](https://github.com/duriantaco/skylos/compare/v4.50.0...v4.50.1) (2026-10-15)
 

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "skylos"
-version = "4.51.0"
+version = "5.0.0"
 requires-python = ">=3.10"
 description = "Python dead code, security and secrets scanner with a pull-request gate; narrower checks for TypeScript, Java and more."
 authors = [{name = "Aaron Oh", email = "aaronoh2015@gmail.com"}]

server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/duriantaco/skylos",
     "source": "github"
   },
-  "version": "4.51.0",
+  "version": "5.0.0",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "skylos",
-      "version": "4.51.0",
+      "version": "5.0.0",
       "runtimeHint": "uvx",
       "transport": {
         "type": "stdio"

tools/release/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "4.51.0"
+  ".": "5.0.0"
 }