releases:
  - version: "1.8.2"
    date: "2026-03-09"
    changes:
      - report: ~
        type: added
        description: "Google Gemini AI provider (--ai-provider gemini) with GEMINI_API_KEY / GOOGLE_API_KEY support"
      - report: ~
        type: added
        description: "GitHub Copilot interactive OAuth device flow — no GITHUB_TOKEN required for --ai-provider copilot"
      - report: ~
        type: added
        description: "--json output on list projects, list folders, and list versions (completes --json across all list subcommands)"
      - report: ~
        type: added
        description: "list components subcommand with --search and --json flags"
      - report: ~
        type: added
        description: "--component filtering on Findings by Project, Triage Prioritization, and Component Vulnerability Analysis with --component-match (contains/exact)"
      - report: ~
        type: added
        description: "--no-nvd flag to skip NVD enrichment for faster runs"
      - report: ~
        type: added
        description: "Headless mode JSON summary to stdout (output paths, files, stats)"
      - report: "Findings by Project"
        type: added
        description: "JSON output format"
      - report: "Triage Prioritization"
        type: added
        description: "JSON output format"
      - report: "Remediation Package"
        type: added
        description: "Folder-scoped operation — --folder generates per-project subdirectories"
      - report: "Executive Dashboard"
        type: improved
        description: "Vectorized iterrows loops and batched portfolio component fetch for better performance"
      - report: ~
        type: fixed
        description: "15 fixes across CLI parameter wiring, report engine (NVD pipeline, RunResult, folder failure propagation), transforms (component filter, JSON serialization), and renderers"

  - version: "1.8.0"
    date: "2026-03-06"
    changes:
      - report: "License Report"
        type: added
        description: "New recipe classifying component licenses into risk categories (Permissive, Weak Copyleft, Strong Copyleft, Proprietary/Restricted, Unknown) with HTML, CSV, and XLSX output"
      - report: "Triage Prioritization"
        type: added
        description: "Airgapped AI workflow — --ai-export exports prompts to JSON, --ai-import ingests responses, no API key required"
      - report: "Triage Prioritization"
        type: added
        description: "--top N flag limits output to the top N findings by score (CLI and web UI)"
      - report: "Triage Prioritization"
        type: added
        description: "--triage N flag limits VEX recommendation generation to top N findings while showing full list (CLI and web UI)"
      - report: "Triage Prioritization"
        type: added
        description: "--tp-gate flag filters findings to a specific gate tier (GATE_1, GATE_2, or NONE)"
      - report: "Triage Prioritization"
        type: improved
        description: "Score breakdown tooltip on hover shows Reachability, Exploit/KEV, Attack Vector, EPSS, CVSS, and Gate Bonus factors"
      - report: "Triage Prioritization"
        type: improved
        description: "Gate scores are now additive bonuses on top of computed score, allowing differentiation among findings within the same gate"
      - report: "Triage Prioritization"
        type: improved
        description: "Tables with more than 10 rows are collapsed by default with a Show more button"
      - report: "Triage Prioritization"
        type: fixed
        description: "VEX justification uses CODE_NOT_PRESENT (API enum) instead of COMPONENT_NOT_PRESENT (CycloneDX enum)"
      - report: "Findings by Project"
        type: added
        description: "KEV column showing Known Exploited Vulnerability indicator in all output formats including HTML"
      - report: "Executive Dashboard"
        type: added
        description: "CSV and XLSX export formats with aggregated project summary table"
      - report: "Executive Dashboard"
        type: added
        description: "KEV indicators in Top Risk Products and Project Findings Summary tables"
      - report: "Executive Dashboard"
        type: improved
        description: "Project Summary table moved to bottom of report; auto-logarithmic scale on Findings by Group chart"
      - report: "Executive Dashboard"
        type: improved
        description: "Configurable project grouping via max_projects recipe parameter (0 = show all, no binning)"
      - report: "Executive Dashboard"
        type: improved
        description: "License distribution chart shows all licenses instead of top 10"
      - report: "Executive Summary"
        type: improved
        description: "Severity counts shown as pivoted columns (Critical, High, Medium, Low, Total) per project"
      - report: "Component List"
        type: added
        description: "HTML output format with KPI cards, charts, and tabular view"
      - report: "Version Comparison"
        type: improved
        description: "Project column always shown regardless of comparison mode"
      - report: ~
        type: added
        description: "Deployment Context UI in web pre-run form and settings page (product type, network exposure, regulatory, deployment notes)"
      - report: ~
        type: improved
        description: "Cache TTL input in web UI accepts duration strings (4h, 2d, 30m) matching CLI behavior"
      - report: ~
        type: improved
        description: "GHSA and PYSEC findings link to github.com/advisories instead of NVD"
      - report: ~
        type: improved
        description: "XLSX formula injection protection via disabled strings_to_formulas"
      - report: ~
        type: fixed
        description: "Serve UI no longer crashes with Content-Length mismatch when reports are regenerated"
      - report: ~
        type: fixed
        description: "SQLite cache tables auto-created on first access, preventing no such table errors"
      - report: ~
        type: fixed
        description: "Batch API request sizes reduced to avoid HTTP 414 URL-too-long on large folders"

  - version: "1.7.1"
    date: "2026-03-03"
    changes:
      - report: "Executive Dashboard"
        type: fixed
        description: "Policy violation and warning KPI counts restored — licenseDetails arrays preserved through SQLite cache"
      - report: ~
        type: fixed
        description: "Batch fetch HTTP 400 on large portfolios — reduced project batch sizes to keep URLs under server limits"
      - report: ~
        type: fixed
        description: "Suppressed noisy 404 warnings for findings without exploit data"
      - report: "Executive Dashboard"
        type: changed
        description: "Warnings label renamed to Policy Warnings for clarity"

  - version: "1.7.0"
    date: "2026-03-01"
    changes:
      - report: ~
        type: added
        description: "Deployment context (--product-type, --network-exposure, --context-file) tailors AI prompts to product type and network environment"
      - report: "Triage Prioritization"
        type: improved
        description: "AI prompts use product-specific persona and workaround templates when deployment context is provided"
      - report: "CVE Impact"
        type: improved
        description: "AI prompts use product-specific persona and workaround templates when deployment context is provided"
      - report: "Remediation Package"
        type: improved
        description: "AI prompts use product-specific persona and workaround templates when deployment context is provided"
      - report: "Executive Dashboard"
        type: improved
        description: "Additional metrics and visualizations"
      - report: "Findings by Project"
        type: improved
        description: "Richer finding detail columns in HTML table"
      - report: ~
        type: added
        description: "Scanner accuracy analysis script (scripts/analysis/scanner_accuracy.py)"
      - report: "Remediation Package"
        type: improved
        description: "Bold subject CVE and expand arrow indicators on clickable CVE detail badges"
      - report: ~
        type: improved
        description: "Docker base image upgraded to Python 3.13; Pillow >=11.1.0 lower-bound pin"
      - report: ~
        type: fixed
        description: "Web UI SSE log events use json.dumps() instead of hand-rolled escaping — fixes malformed JSON on tab/control characters"
      - report: ~
        type: fixed
        description: "Web UI stderr redirect is now thread-safe across concurrent report runs"
      - report: "Triage Prioritization"
        type: fixed
        description: "Markdown renderer findings table column alignment corrected"

  - version: "1.6.0"
    date: "2026-02-25"
    changes:
      - report: "Remediation Package"
        type: added
        description: "OSV fix-version validation ensures proposed upgrades aren't themselves vulnerable"
      - report: "Remediation Package"
        type: added
        description: "Structured remediation options (upgrade / workaround / code_mitigation) per action"
      - report: "Remediation Package"
        type: added
        description: "NVD workaround/mitigation URL extraction and LLM enrichment fields"
      - report: "Remediation Package"
        type: changed
        description: "Charts removed in favour of concentrated data output; summary shows Components instead of Actions"
      - report: ~
        type: added
        description: "Markdown output format (agent-optimised, token-efficient) enabled on CVA, CVE Impact, Findings by Project, Triage, and Version Comparison"
      - report: ~
        type: added
        description: "Web UI: Remediation Package, CVA, and Export Components workflow cards; zip download; log viewer; new folder; per-recipe progress bar"
      - report: ~
        type: added
        description: "--ai off master switch disables all AI enrichment regardless of recipe defaults"
      - report: ~
        type: added
        description: "XLSX renderer skips export with warning when rows exceed Excel 65K URL limit"
      - report: ~
        type: fixed
        description: "Theme toggle (dark/light) now works — app.js was not loaded in base.html"
      - report: ~
        type: fixed
        description: "18 pre-existing mypy type errors fixed in report_engine.py and settings.py"

  - version: "1.5.4"
    date: "2026-02-21"
    changes:
      - report: "CVE Impact"
        type: fixed
        description: "Version filter now uses authoritative defaultBranch.latestVersion.id instead of unreliable max(version_id) heuristic"
      - report: "CVE Impact"
        type: fixed
        description: "Version ID type coercion prevents filter failures when SQLite cache returns string values"
      - report: "CVE Impact"
        type: fixed
        description: "Per-CVE fallback keeps findings unfiltered rather than showing all UNKNOWN when authoritative data is incomplete"

  - version: "1.5.3"
    date: "2026-02-21"
    changes:
      - report: ~
        type: added
        description: "VEX import via --apply-vex-triage and --autotriage CLI flags"
      - report: ~
        type: added
        description: "Custom logo support (--logo flag, config file, or web UI)"
      - report: "Triage Prioritization"
        type: added
        description: "AI columns (ai_fix_version, ai_guidance, ai_workaround, ai_confidence) in CSV/XLSX exports"
      - report: "Triage Prioritization"
        type: improved
        description: "Bottom-up AI guidance cascade with multi-signal component ranking"
      - report: ~
        type: changed
        description: "Rationalized CSV/XLSX column ordering across all 6 tabular reports"
      - report: "CVE Impact"
        type: fixed
        description: "Reachability data now filtered to latest version per project"
      - report: ~
        type: fixed
        description: "AI parser hardening — CONFIDENCE field corruption and grounding constraints"
      - report: "Scan Analysis"
        type: fixed
        description: "Scan queue rate-limit spiral replaced with sequential fetch and circuit breaker"

  - version: "1.5.2"
    date: "2026-02-19"
    changes:
      - report: ~
        type: added
        description: "Scan Queue dashboard in web UI with live monitoring and stuck scan detection"
      - report: ~
        type: added
        description: "Configurable AI models via --ai-model-high and --ai-model-low flags"
      - report: "Triage Prioritization"
        type: fixed
        description: "Reachability labels no longer replaced with UNKNOWN in HTML reports"
      - report: ~
        type: fixed
        description: "Stable model alias IDs prevent 404 errors on retired Anthropic model versions"
      - report: ~
        type: fixed
        description: "SQLite cache preserves nested reachability data from alternate API format"
      - report: ~
        type: fixed
        description: "serve command accepts --port in any position"

  - version: "1.5.0"
    date: "2026-02-18"
    changes:
      - report: "Executive Dashboard"
        type: added
        description: "11-section executive-level security report with KPI cards, severity trends, exploit intelligence, and project table"
      - report: ~
        type: improved
        description: "Exploit intelligence derived from findings-level booleans instead of separate CVE fetch"
      - report: ~
        type: improved
        description: "Scoped component fetch prevents timeout on large portfolios"
      - report: ~
        type: improved
        description: "Enhanced web UI with directory browser and scope dropdowns"
      - report: ~
        type: fixed
        description: "Combined --finding-types filter now works correctly with multiple types"
      - report: ~
        type: fixed
        description: "Date validation and XLSX rendering errors resolved"

  - version: "1.4.2"
    date: "2026-02-18"
    changes:
      - report: ~
        type: improved
        description: "Cross-directory report history shared across working directories"
      - report: ~
        type: improved
        description: "Reports UI distinguishes HTML, CSV, and XLSX file types"
      - report: ~
        type: improved
        description: "View Report button links directly to generated file"
      - report: ~
        type: fixed
        description: "Jira integration fixes for ticket creation and session management"

  - version: "1.4.0"
    date: "2026-02-17"
    changes:
      - report: ~
        type: improved
        description: "Enhanced logging and session management"
      - report: ~
        type: changed
        description: "CLI commands updated to use fs-report run subcommand pattern"

  - version: "1.3.2"
    date: "2026-02-17"
    changes:
      - report: ~
        type: fixed
        description: "Token login in web UI setup wizard now persists token to config file"
      - report: ~
        type: added
        description: "One-line curl installer for customer onboarding"
      - report: ~
        type: improved
        description: "View Report button links directly to generated HTML after a run"
      - report: ~
        type: fixed
        description: "Cancel button now works during NVD lookups and long API fetches"
      - report: ~
        type: added
        description: "Changelog CLI command (fs-report changelog)"
      - report: ~
        type: added
        description: "Upgrade notification when a newer PyPI version is available"

  - version: "1.3.1"
    date: "2026-02-16"
    changes:
      - report: "CVE Impact"
        type: improved
        description: "Entity-level NVD caching for --current-version-only + --project"
      - report: "CVE Impact"
        type: fixed
        description: "Respect --current-version-only with --project filter"
      - report: "CVE Impact"
        type: improved
        description: "Unified CVE description fetching via NVD batch lookup"
      - report: ~
        type: added
        description: "NVD cache management CLI (fs-report cache --nvd)"
      - report: ~
        type: added
        description: "Web UI cancel button for running reports"

  - version: "1.3.0"
    date: "2026-01-20"
    changes:
      - report: "Findings by Project"
        type: improved
        description: "Enriched report with CVE details (description, CVSS, references)"
      - report: "Triage Prioritization"
        type: improved
        description: "VEX status and penalties added to AI prompts"
      - report: "Triage Prioritization"
        type: changed
        description: "Updated scoring methodology for better prioritization"
      - report: ~
        type: added
        description: "FastAPI web UI replacing the terminal TUI"
      - report: ~
        type: added
        description: "Bundled recipes and templates inside the package"
      - report: ~
        type: improved
        description: "Cross-platform compatibility (Windows, Linux, macOS)"

  - version: "1.2.0"
    date: "2025-12-10"
    changes:
      - report: "Triage Prioritization"
        type: added
        description: "OpenAI API support for AI-powered remediation guidance"
      - report: ~
        type: improved
        description: "Connection badge and action button UI enhancements"
      - report: ~
        type: fixed
        description: "Prevent reopening of modals after successful actions"

  - version: "1.1.3"
    date: "2025-11-15"
    changes:
      - report: "CVE Impact"
        type: added
        description: "Initial CVE Impact report"
      - report: ~
        type: improved
        description: "Enhanced caching behaviour in ReportEngine and SQLiteCache"
      - report: ~
        type: fixed
        description: "Overwrite guard false positive on intermediate files"
