v4.20.3 v2.9.5
medium risk
Genymobile/scrcpyAug 13, 2026 → Aug 15, 20262 days between releases
What's New
Adds OpenAI-compatible provider support and static detection for insecure deserialization.
Breaking Changes
- Bound the optional MCP dependency to the supported major version.
- Scoped the destructive-autonomy YARA post-filter to SkillSpector's built-in rule namespace.
New Features
- Support for Ollama, Azure OpenAI, and generic OpenAI-compatible providers.
- Static detection for insecure deserialization patterns (AST10, TT6, DS1–DS4).
- Opt-in discovery of a top-level `.skillspector-baseline.yaml` file.
Improvements
- Use byte offsets when mapping YARA matches back to source lines for non-ASCII content.
- Reduce false positives with opt-in shipped baselines.
- Improve scan accuracy across safety-pattern, MCP dependency, and YARA scanning paths.
Bug Fixes
- Reduce false positives when safety-sensitive language explicitly negates unsafe behavior.
- Bound the optional MCP dependency to the supported major version to prevent version conflicts.
Upgrade Notes
Verify your MCP dependency major version compatibility and review any custom YARA rules to ensure they work with the updated namespace scope.
The Two Releases
v4.20.3
v4.20.3
Aug 13, 2026· 2 months ago
A hotfix release that restores stability by reverting the RediSearch 8.6 upgrade introduced in the previous version, which caused a search regression.
Full release notesv2.9.5
SkillSpector v2.9.5
Aug 15, 2026· 2 months ago
SkillSpector 2.9.5 expands provider support (Ollama, Azure OpenAI), adds opt-in author-shipped baselines, and strengthens static detection for insecure deserialization.
Full release notes