[github-actions]

Summary

All bumped packages.

Package	From	To
@inth/cli-darwin-arm64	0.0.7	0.1.0
@inth/cli-linux-arm64	0.0.7	0.1.0
@inth/cli-win32-x64	0.0.7	0.1.0
@inth/cli-linux-x64	0.0.7	0.1.0
@inth/cli	0.0.7	0.1.0

Changelogs

2026-10-18-vendor-decisions.md

Show Bumped Packages (5)

Package	Bump
npm:@inth/cli-darwin-arm64	minor
npm:@inth/cli-linux-arm64	minor
npm:@inth/cli-win32-x64	minor
npm:@inth/cli-linux-x64	minor
npm:@inth/cli	minor

Review vendors seen on a project

inth vendor list --project <project-id> lists the vendors scans saw on a project, with their category, state, and vendor ID. --state active shows only vendors nobody has decided on yet. inth vendor get <vendor-id> --project <project-id> shows a vendor's hosts, when it was last seen, what loaded it, and its open Inbox finding. Both work with API keys.

inth vendor approve <vendor-id> --project <project-id> accepts a vendor seen on a project and resolves its runtime Inbox finding. inth vendor ignore ignores the vendor and dismisses the finding. Both print the vendor's name, its new state, and the finding they closed.

inth inbox get now shows the vendor behind a runtime finding: its name, vendor ID, project ID, state, and what loaded it, such as a script URL or a Google Tag Manager container.

Browser sign-ins now request vendors.write. Run inth login again to approve vendors from an existing sign-in. Organization API keys cannot make vendor decisions.

2026-10-20-c15t-codemods.md

Show Bumped Packages (5)

Package	Bump
npm:@inth/cli-darwin-arm64	patch
npm:@inth/cli-linux-arm64	patch
npm:@inth/cli-win32-x64	patch
npm:@inth/cli-linux-x64	patch
npm:@inth/cli	patch

Upgrade c15t apps to v3 with inth c15t codemods

inth c15t codemods runs the c15t v2 to v3 codemods. Name the codemods to run, and add --dry-run to preview the changes first. --list prints them in the order they run. It needs no sign-in or Inth project.

Its output matches c15t codemods from @c15t/cli@3.1.0, with one exception: offline mode stays as it is, with a TODO(c15t v3) comment to finish by hand.

Publish

The following packages will be published if merged:

Package	Version	Registry
@inth/cli-darwin-arm64	0.1.0 (dist-tag: latest)	npm
@inth/cli-linux-arm64	0.1.0 (dist-tag: latest)	npm
@inth/cli-win32-x64	0.1.0 (dist-tag: latest)	npm
@inth/cli-linux-x64	0.1.0 (dist-tag: latest)	npm
@inth/cli	0.1.0 (dist-tag: latest)	npm

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 294c8e8b-84b5-4783-b347-4bca157033e1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}