Skip to content

chore: add CLI v2.41.0–v2.43.1 changelog entries #424

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mbevc1 merged 2 commits into from
Sep 21, 2026
Merged

chore: add CLI v2.41.0–v2.43.1 changelog entries #424

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f3a8268
chore: add CLI v2.41.0–v2.43.1 changelog entries
mintlify[bot] Sep 21, 2026
a840ac4
chore: update changelog/index.mdx
mbevc1 Sep 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
58 changes: 58 additions & 0 deletions changelog/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,64 @@ description: "Release notes for Kosli products."
rss: true
---

<Update label="September 18, 2026" description="v2.43.1" tags={["CLI"]}>

## Updates

- **Attestation commands survive missing repositories** — `kosli attest` commands now warn (instead of failing) when a CI-defaulted `--commit` cannot be resolved because no repository is checked out, letting jobs without a repo continue.
- **Clearer errors when commit info is required** — `kosli attest pullrequest-*` and [`kosli attest jira`](/client_reference/kosli_attest_jira) now emit a descriptive error when the commit cannot be resolved, instead of silently proceeding or panicking. Explicit `--commit` or `--repo-root` values that fail to resolve now name the fix.

@claude claude Bot Sep 21, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Contradicts the generated reference — and the bullet above it.

The reference was generated from v2.43.1 (client_reference/overview.md:7), so it already contains this change. It documents the opposite behavior for kosli attest jira:

client_reference/kosli_attest_jira.md:98 — "If both --commit and --repo-root are left at their defaults and the commit cannot be read from the repository, a warning is printed and the attestation is sent without commit info."

Same text on client_reference/kosli_attest_pullrequest_azure.md:37. That is exactly what bullet 1 (line 11) describes, so as written the two bullets in this entry disagree about what kosli attest jira does when a defaulted commit can't be resolved.

The second sentence ("explicit --commit or --repo-root values that fail to resolve") is consistent with both — scoping the whole bullet to the explicit case would resolve the conflict.

Separately: pullrequest-* implies commands named pullrequest-github. The actual commands use a space — kosli attest pullrequest github|gitlab|azure|bitbucket (client_reference/kosli_attest_pullrequest_github.md:9).

Fix this →


[View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.43.1)

</Update>

<Update label="September 17, 2026" description="v2.43.0" tags={["CLI"]}>

## New features

- **`kosli evaluate policy`** — evaluate a policy and record the decision in a single request, instead of calling evaluate and record separately. **Beta**

[View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.43.0)

</Update>

<Update label="September 16, 2026" description="v2.42.0" tags={["CLI"]}>

## New features

- **Parallel S3 downloads with a byte budget** — [`kosli snapshot s3`](/client_reference/kosli_snapshot_s3) now takes `--download-concurrency` and `--download-budget` to control how many objects download in parallel and the peak temporary disk usage while fingerprinting a bucket.
- **`--sonar-revision` works with `--pull-request`** — [`kosli attest sonar`](/client_reference/kosli_attest_sonar) now accepts both flags together. The command fails if the pull request's latest analysis is not of the specified revision.

## Updates

- **S3 keys no longer used as local file names** — [`kosli snapshot s3`](/client_reference/kosli_snapshot_s3) downloads each object to a temporary file, hashes it, and removes it, so any valid S3 key can be fingerprinted on any operating system.
- **`Visibility` dropped from flow output** — `kosli get flow` and `kosli list flows` no longer show the legacy `Visibility` field, which had no effect on access.

## Bug fixes

- **`kosli list flows` no longer panics on flows without tags** — listing a flow that has no tags now succeeds instead of crashing.

[View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.42.0)

</Update>

<Update label="September 15, 2026" description="v2.41.0" tags={["CLI"]}>

## New features

- **`kosli attest sbom` (beta)** — attest a software bill of materials (CycloneDX JSON/XML or SPDX JSON/tag-value) to an artifact or trail in a Kosli flow. The SBOM file checksum, format, and a parsed summary are recorded, and `sbom_format` and `sbom_sha256` are added as annotations. See the [`kosli attest sbom` reference](/client_reference/kosli_attest_sbom).

## Bug fixes

- **`kosli attest sonar` never sends the API token to a redirect target** — the Sonar API token is no longer forwarded when the request is redirected off the configured host. See the [`kosli attest sonar` reference](/client_reference/kosli_attest_sonar).
- **`kosli snapshot azure` rejects unsafe zip entries** — zip archives fetched during a snapshot can no longer extract files outside the temporary directory. See the [`kosli snapshot azure` reference](/client_reference/kosli_snapshot_azure).
- **`kosli snapshot azure` cannot be spoofed via a container digest in logs mode** — a container claiming a different image digest in its logs no longer overrides the digest recorded for the snapshot.
- **CycloneDX SBOM tool read from `services`** — the SBOM tool name is now taken from a CycloneDX `services` entry when present, so [`kosli attest sbom`](/client_reference/kosli_attest_sbom) reports the correct tool.

[View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.41.0)

</Update>

<Update label="September 11, 2026" description="v2.40.1" tags={["CLI"]}>

## Updates
Expand Down
Loading