v0.3.9 v2.11.1
zed-industries/zedSep 5, 2026 → Sep 7, 20262 days between releases
What's New
Comparing VulnClaw v0.3.9 to SkillSpector v2.11.1 reveals a major version jump with configurable scan deadlines and security fixes.
New Features
- Added SKILLSPECTOR_MAX_WORKFLOW_SECONDS environment variable for customizing aggregate scan deadlines.
- Enhanced security finding classification preservation during deduplication and report generation.
- Improved detection of concealed instructions using bounded text normalization.
- Enforced SKILLSPECTOR_MAX_LLM_CONCURRENCY across all concurrently running LLM analyzers.
Improvements
- Default aggregate scan deadline increased from 60 to 600 seconds to prevent timeouts.
- Consistent deadline application across direct, recursive, transitive, and multi-skill scan paths.
- Bounded total in-flight LLM requests to handle rate-limited providers better.
Bug Fixes
- Prevented premature workflow termination for scans requiring more than one minute.
- Fixed parsing of whitespace-separated allowed-tools declarations to avoid false positives.
- Fixed deduplication logic to keep safe and unsafe findings distinct when sharing fingerprints.
- Fixed handling of concealed-instruction obfuscation to fail closed when interpretation is incomplete.
Upgrade Notes
Existing users automatically receive the 600-second default. Deployments requiring a different aggregate deadline can set SKILLSPECTOR_MAX_WORKFLOW_SECONDS to a positive finite number of seconds; invalid values retain the 600-second default.
The Two Releases
v0.3.9
Sep 5, 2026· 2 months ago
Adds execution approval workflows, restores TUI v1 protocol, introduces a config wizard, and enables cross-session learning with an OpenRouter provider preset.
Full release notesSkillSpector v2.11.1
Sep 7, 2026· 1 month ago
Increases the default aggregate scan deadline to prevent timeouts on larger valid scans and fixes security analysis correctness issues.
Full release notes