v1.5.0 v2.11.0
nari-labs/dia2Aug 27, 2026 → Aug 28, 20261 day between releases
What's New
Major SkillSpector upgrades add npm lockfile analysis and LLM sampling controls
New Features
- Resolve npm versions from lockfiles (v1, v2, v3) before vulnerability analysis
- BH1–BH3 findings for bundled lifecycle hooks and remote transfers
- Optional LLM sampling controls via environment variables
- Secure file traversal using O_PATH in restricted environments
Improvements
- Parse npm lockfile versions 1, 2, and 3
- Analyze bundled hook execution for sensitive content
- Improve secure file traversal in restricted Linux environments
- Remove MP3/P6 false positives
Bug Fixes
- Remove MP3/P6 false positives while retaining directive detection
Upgrade Notes
Review BH1–BH3 findings for bundled hooks and consider setting SKILLSPECTOR_TEMPERATURE and SKILLSPECTOR_SEED for LLM sampling. Ensure O_PATH compatibility for secure file traversal in restricted environments.
The Two Releases
v1.5.0
Aug 27, 2026· 2 months ago
Expands agentgateway capabilities for LLM and agent traffic, introducing API-key budgets, native Gemini support, Anthropic-to-OpenAI conversion, and enhanced logging and guardrails.
Full release notesSkillSpector v2.11.0
Aug 28, 2026· 2 months ago
Enhances SkillSpector with npm version resolution from lockfiles, bounded analysis of bundled lifecycle hooks, and optional LLM sampling controls, while improving secure file traversal.
Full release notes