v2.10.0 v2.11.0
zed-industries/zedAug 26, 2026 → Aug 28, 20261 day between releases
What's New
Adds npm dependency analysis and LLM sampling controls
New Features
- Parse npm lockfiles (v1, v2, v3) for dependency analysis.
- Analyze bundled lifecycle hooks for sensitive transfers.
- Add LLM sampling controls (`SKILLSPECTOR_TEMPERATURE`, `SKILLSPECTOR_SEED`).
- Secure file traversal in restricted Linux environments using O_PATH.
Improvements
- Resolve exact npm versions from lockfiles before vulnerability analysis.
- Improve provider guidance and fallback routing.
- Remove MP3 and P6 false positives.
Bug Fixes
- Remove MP3 and P6 false positives.
- Fix file traversal in restricted Linux environments.
Upgrade Notes
New environment variables `SKILLSPECTOR_TEMPERATURE` and `SKILLSPECTOR_SEED` are available for LLM sampling. The tool now analyzes npm lockfiles and bundled hooks, which may increase scan time or resource usage.
The Two Releases
SkillSpector v2.10.0
Aug 26, 2026· 2 months ago
SkillSpector 2.10.0 expands security coverage across concealed artifacts, referenced skills, structured skill bundles, and external model selection.
Full release notesSkillSpector v2.11.0
Aug 28, 2026· 2 months ago
SkillSpector 2.11.0 expands supply-chain coverage to installed npm dependency versions, adds bounded analysis of bundled lifecycle hooks, and introduces optional LLM sampling controls.
Full release notes