Iris Code Changelog: VS Code, JetBrains, and CLI Release Notes

These are the release notes for the Iris Code VS Code extension, the JetBrains plugin, and the @iris-code/cli npm package. Updates ship automatically through the VS Code Marketplace, Open VSX, and the JetBrains Marketplace - you do not need to reinstall to receive new versions.

---

​

v1.34.0 - 2026-09-30

• Added incremental scans in VS Code and JetBrains IDEs. A repeat workspace or folder scan reuses the analysis of every file whose contents and settings are unchanged, and works out the totals, unused packages and duplicate findings again from the current files. The result matches a full scan.
• Added a notification after each scan saying how many files were analysed and how many were reused.
• Added Rescan everything, in the Workspace tab, the folder view and the command palette, which analyses every file again.
• Added the email of the account you are signed in with, on the licence card at the bottom of the sidebar.

The CLI, git hooks, CI, the MCP server and cloud scans still analyse every file on each run.

---

​

v1.33.0 - 2026-09-29

​

The package guard

The package guard works out which version an install would actually add, then blocks a known-vulnerable, malicious, yanked or, if you choose, too-new version and names the version to use instead. A package it could not check is reported as not checked, never as safe. It is free on every plan.

• Added hooks for Claude Code, Cursor, Codex, GitHub Copilot, Gemini CLI and Windsurf. Run Iris Code: Check Packages Before Agents Install Them, or iris hook agent install, and every package the agent tries to install is checked first.
• Added whole-project checks. When an agent runs npm install, pip install -r requirements.txt, bundle install or another install that names no package, every package the lockfile would install is checked, and a malicious package blocks the install. The repository’s own install scripts are shown and asked about.
• Added iris install and iris remove, which check packages and then run the project’s own package manager. With no package names, iris install checks the whole project first.
• Added the iris_check_package MCP tool, which answers whether one package is safe to add.
• Added a notice in VS Code and JetBrains IDEs when a manifest or lockfile gains a package that would be blocked, in any project folder of a monorepo.
• Added packageGuard in .irisconfig.json: onUnchecked, blockSeverity, minimumReleaseAgeDays, reviewed allow exceptions and, on Pro, prePush to check packages added in pushed lockfiles. The Config Studio sets the policy.
• Added a package guard row in the sidebar’s Hooks section, which now appears on every plan.

When you are not signed in, the guard sends an anonymous daily count of its checks: the ecosystem, the verdict, the surface and, for a hook, which agent. It never sends a package, path or project, and only after you have allowed dependency lookups. DO_NOT_TRACK=1 or IRIS_TELEMETRY=off turns it off.

​

Changed

• Changed the dependency cache location to ~/.iris/cache/, per user, instead of .iris-cache/ in the project. Iris Code no longer edits your .gitignore for it, and an existing .iris-cache/ folder can be deleted.
• Changed the Dependencies table, iris deps and iris cve to include nested Go, Python and Ruby projects, such as a monorepo’s services/gateway/go.mod.

​

Fixed

• Fixed a Python range being reported as the installed version. Only == pins a version now; without a lockfile, a ranged requirement is shown as not checked.
• Fixed Config Studio sync removing ignoreFiles, ignoreFunctions, testConvention and the package guard’s allow list from your config.
• Fixed the Config Studio missing controls for naming rules, severity overrides, scoring weights and inline findings, and writing a cleared gate limit as 0.
• Fixed iris cve letting a malicious-package report pass at the default --severity high.

​

v1.32.0 - 2026-09-27

​

Import impact

• Added import impact beside each changed file in Change Review. Expand the count to open the files that import it. Pro also shows the number of transitive dependents, capped at 500+, and a summary of other files the whole change set reaches.
• Added import impact to iris_check for each checked file: direct importers on Free, plus the transitive count on Pro. iris check --changed and --staged include it in JSON and as one line per file in pretty output. Impact informs a review and does not change gate decisions or exit codes.
• Added automatic import mapping. A review that opens without an import graph builds one, in VS Code and JetBrains IDEs, and asks first in a very large workspace. An unmapped file is never shown as having zero importers.
• Added imports through a package. In Go, a C# using, a Java wildcard import or a Python namespace package, an import names the package rather than the file; those importers are counted and labelled “through its package”.

​

Fixed

• Fixed the focused Code Map Graph and iris graph --focus drawing a file imported through its package as if nothing imported it.
• Fixed a pause of about 5 seconds on the first Iris Code action after a JetBrains IDE starts. The language server was rewritten on every start, so Windows scanned it as a new program each session; it is now extracted once and reused.
• Fixed Change Review hiding each finding’s message on narrow panels.
• Fixed Change Review showing Windows paths with backslashes.
• Fixed iris_check reporting impact from imports as they were when the session started. It now re-reads files changed on disk.

​

v1.31.0 - 2026-09-25

​

The import graph

Switch the Code Map from Tree to Graph to see how files import each other. Each line is an import; selecting it lists the lines it came from and opens them in the editor, and cycles are marked. The workspace scan that scores the tree also maps the imports, so there is nothing separate to build.

• Added the Graph for TypeScript, JavaScript, Vue, Svelte, Go, Python, Java, C# and Rust. A Go or Java package, or a C# namespace, is drawn as its folder, because that is what the import names.
• Added a list of every import Iris Code could not resolve, each with its reason, rather than a guess.
• Added the same Graph to the account dashboard’s Code Map for each cloud audit.
• Free shows the focused file with its direct imports and importers; Pro adds Folder and Workspace scope.

An import graph only shows imports. Files in the same Go or Java package, C# namespace or Rust module can use each other without one, so those uses are not drawn, and the canvas says so.

​

Export

• Added export for the Tree and the Graph: PNG, SVG, Mermaid, a Markdown table, CSV and JSON. An export is exactly what is on screen. Mermaid and Markdown can also be copied to the clipboard; GitHub draws Mermaid when it is pasted into a README or pull request.
• Export is free, and a Free export contains only what a Free user can see.

​

CLI 1.22.0

• Added iris graph: the same graph as text or JSON. --focus <file> is free; the whole graph needs Pro. Unresolved imports never change the exit code.

​

JetBrains

• Fixed the progress bars not appearing during a workspace or folder scan.

​

v1.29.2 - 2026-09-22

​

Finishing what 1.29.1 started

1.29.1 stopped an apostrophe in a React component being read as the start of a string. That fixed one character. This release fixes the category: text between tags is a string literal, delimited by tags instead of quotes, and is never counted as code.

• Fixed a bracket written as text being counted in the bracket balance. Markup that renders a code sample - a page showing a JSON snippet, written as <span>]</span> - put that bracket into the count, so the file was reported as a syntax error and every finding in it was discarded.
• Fixed a regular expression inside a ${...} template swallowing the rest of the file. The scanner knew about strings, backticks and braces inside a template but not regular expressions, so the quote in an everyday CSV escape - `"${String(cell).replace(/"/g, '""')}"` - opened a string and ran on to the next quote.
• Changed a code sample rendered as markup so it is no longer counted as a declaration. A component displaying export async function cancelOrder(...) as text on the page had that counted as a real function in the file.
• Changed, same as 1.29.1 and in the same direction: your gate result may change on upgrade, because files that were silently scoring 0 now report what is in them.

​

How it was checked

The fix was measured rather than argued: 1,258 real files from four codebases were analysed before and after, and diffed file by file. Files reported as syntax errors went from two to none, and exactly three other files changed, each one explained - the two that had been scoring 0, and the component that had been counting a function out of a code sample. The two gaps v1.29.1 recorded as known and unfixed are both closed by this, because prose stops being code once the analyser knows where the markup region is.

​

v1.29.1 - 2026-09-22

​

A file that scored 0 looked exactly like a clean file

JSX children are not quoted, so a sentence written as ordinary text inside a React component put a bare ' into the analyser’s scanner every time it contained a possessive or a contraction: this project's limits, each rule's threshold, agents don't read them. That apostrophe was read as the start of a string, and everything after it - up to the next apostrophe or the end of the file - stopped being treated as code. The consequence was not a wrong finding. It was no findings at all: the file’s brackets no longer balanced, so it was reported as a syntax error, scored 0, and every real finding in it was discarded. Two of Iris Code’s own screens had been in that state.

• Fixed a quote directly preceded by a letter or digit opening a string. No valid JavaScript or TypeScript string literal is ever written that way, so this costs nothing and is decided by a single character. Backticks are exempt, because a backtick after a name is a tagged template.
• Fixed an unterminated quote being honoured to the end of the file. A quote that never closes was not a string opener, and the scan now resumes after it instead of blanking everything below.
• Changed, and worth expecting: your gate result may change on upgrade. Files that were silently scoring 0 now report what is actually in them, so a project can move from pass to fail without a line of its code changing. Those files were never being measured; the new number is the honest one.

The same fix reaches the Playground and the Config Studio, which run the real engine in your browser.

​

Known, and deliberately not fixed here

A bracket written as literal text in JSX - <span>]</span>, which happens when markup renders a code sample - is still counted as a delimiter and can still report a false syntax error. It has the same root cause: this scanner is lexical and has no concept of a JSX text region. Closing it properly is its own change.

​

v1.29.0 - 2026-09-21

​

Two changes that affect CI results

Both can turn a passing pipeline red the first time you run them. In each case the old behaviour reported a pass it had not established, so the new failure is the accurate answer rather than a regression in Iris Code.

• Changed a Pro command whose licence cannot be verified to exit 3 instead of 0. It used to skip and report success, so a brief licence-server outage turned iris gate into a silent no-op and let a build through that should have been blocked. Exit 3 is separate from 1 so a pipeline can distinguish “the gate failed” from “the gate never ran”. See CI exit codes.
• Unchanged for users without a Pro licence. That case is known, not unverified, so those commands still skip and exit 0 and your build stays green. Only a licence that exists but could not be checked fails closed.
• Fixed --config so it decides the rules rather than only minHealthScore and the printed summary. iris gate --config shared.json applied one field from the file you named; every other threshold came from whatever .irisconfig.json sat in the scanned project, while the table displayed the values you had asked for. A config named explicitly now wins, and a project without the flag still resolves its own as before. iris check and iris report had the same fault.

​

The dependency table

• Fixed the table not scanning when you open it. It showed “No scan yet” and waited for a click even on a project it had scanned before, because a cached scan older than 24 hours was read as no cache at all.
• Changed the first open to still show the Scan button, so the network-access prompt follows a click rather than appearing because you opened a panel. Every open after that scans by itself.
• Fixed clearing the cache reading as “nothing here” while the rescan it had just started was already running.

​

JetBrains

• Fixed the Trends and Git History Secrets tables opening blank. The panel delivered a table’s first state before the page was listening, and Trends sends its state exactly once, so it was lost for good.
• Fixed the sixth and later tables opening blank when several were open at once. Each table held a connection for as long as its tab existed and the embedded browser allows only six, so which table failed depended on the order you opened them.

​

Licences and the CLI

• Fixed a sign-in through a development build replacing your real credentials. Both wrote to the same file, so a token issued by a local backend overwrote the production one and every command afterwards failed to validate.
• Fixed every command re-checking your licence over the network. A successful check is now reused for ten minutes, so a script or CI job that runs several commands makes one request instead of one per command. iris auth status and iris auth login always check for real, and signing out clears it.

​

Accuracy

• Added deep-nesting to the measured corpus, taking it to 38 rules and 174 rule-language pairs. The rule now counts control blocks rather than indentation, so a widely-indented file is no longer reported as deeply nested and a minified one no longer escapes.
• Fixed file naming not being checked on a file whose contents fail to parse. The parse-error path reported “no naming problem” rather than “never looked”, so those files silently passed the rule.

---

​

v1.28.0 - 2026-09-16

​

Every command that runs an analysis is called Scan

The Command Palette offered two verbs for a single act. Scan Workspace sat beside Analyse Current File, and the Folder tab told you to choose Iris: Analyse This Folder, a name no registered command had. The JetBrains plugin carried its own copies of these titles and had drifted from VS Code.

• Changed Analyse Workspace to Scan Workspace, Analyse This Folder to Scan This Folder, Analyse Current Folder to Scan Current Folder, Analyse Current File to Scan Current File, and Analyse This File to Scan This File.
• Changed Restart First Review to Restart First Scan. It restarts the first file scan; a review is the changed-files feature.
• Unchanged command ids. Any keybinding you have already set still works.
• Fixed six places in the in-app documentation that named commands prefixed Iris: rather than Iris Code:, including Install Git Hook, Install Build Hook, Add GitHub Actions Workflow, Add CI Pipeline Snippet and Open Dependents Table. Following any of those instructions found nothing.

​

One name per concept everywhere else

• Changed the Issues tab to the Findings tab. A finding is what Iris Code reports; “issue” also meant a real defect and a support report.
• Changed “Project Review” to a workspace scan. The behaviour is identical: your first full workspace scan is still free, still saved locally, still needs no account.
• Changed cloud audits to cloud scans, and the Teams entity that owns seats and billing from a “workspace” to a team. Workspace now means the project folder open in your editor and nothing else, because that is what VS Code uses the word for.
• Added a terminology reference listing every term and the ones it replaced, and inline definitions of finding, blocker, warning, gate and threshold on the home page.

​

Corrections to these docs

• Fixed Gate Preview and Quick Start stating five presets while the configuration pages stated six. The ai-assisted preset, minimum score 82, was missing from both.
• Fixed the CLI overview omitting iris init, iris fix, iris mcp, iris rules and iris auth while linking to a page describing all seventeen commands.
• Fixed the Languages table on the home page listing six of ten languages, silently omitting Ruby, C#, Java and Rust.
• Fixed Gate Preview claiming it would block commits. It blocks pushes.

---

​

v1.27.0 - 2026-09-15

​

iris init sets a project up in one command

It asks three short questions, recommends one of the shipped presets and explains why, writes a commented .irisconfig.json, creates or refreshes the AGENTS.md rules block, and installs the pre-push hook where the licence allows it. Every step says what it did or why it skipped it. Re-running preserves an existing config, and --yes takes the Balanced default without prompting.

​

iris fix --safe removes only what it can prove is safe

Three cases qualify: a line holding nothing but a debug statement, a literal-only unused variable, and a standalone unused Java import. Everything else refuses with a reason, per finding rather than per run, and a hardcoded secret is never auto-fixed.

• Added the same fixes as a Quick Fix in VS Code. The lightbulb on an eligible finding offers to remove it, sharing one planner with the CLI and the MCP server so all three agree on what is safe.
• Previews by default. --apply asks before writing, and requires --yes when there is nobody to ask.

​

A preset now enforces what it displays

• Fixed presetId being honoured in the editor and silently dropped by the CLI, the git hook and CI. A project on strict saw strict thresholds while its hook and CI enforced the shipped defaults: one repository judged by two standards, with nothing on screen saying so. Expect your gate to start enforcing the threshold it has been displaying. legacy gates at 60, balanced at 70, typescript at 76, strict and ai-assisted at 82, security at 85.
• Changed presets to carry gate limits, so choosing one configures the whole gate rather than only the score. Gate limits remain a Pro feature.
• Changed strict, security and ai-assisted to check filenames across the whole project rather than only newly added files. Set "fileNamingScope": "new-files" to keep the old behaviour.

​

Smaller additions

• Added stale-rules detection. Saving .irisconfig.json compares the Iris Code block in files it has already written and suggests iris rules --refresh when it no longer describes the config. It never edits a committed file.
• Added native MCP server discovery in VS Code, so no hand-written JSON entry is needed.
• Fixed Husky and custom hook paths. Iris Code follows Git’s active core.hooksPath, so the block lands in .husky/pre-push with your script preserved.
• Fixed a rate-limited licence check switching Pro off. The endpoint locks out per IP rather than per key, so a shared network could trip it; that response was read as a definitive “you are on Free”. A rate limit is now treated as transient and nothing is revoked.

---

​

v1.26.0 - 2026-09-08

​

Audits that run without your editor open

Connect a GitHub repository once and Iris Code audits it on the events you choose: every change that lands on your default branch, every pull request update, or both. It keeps the score, findings and dependency report against the commit that produced them. Each repository decides its own triggers, because a merge costs one audit and a pull request costs one per update pushed to it. Merges are on by default; pull requests are opt-in. See Cloud scanning.

​

Team evidence, from the editor and from CI

• Added teamProjectId in .irisconfig.json, binding a repository to a team project. Every completed workspace scan and every iris gate run then records privacy-minimal evidence against it. The value is opaque and is not a repository URL.
• Added the option to the JSON schema, so editors complete and validate it.
• Team evidence records execution outcomes and aggregate counts. It never contains source, file paths, repository URLs, snippets, or finding text.

​

Fixed

• Fixed a dependency scan being discarded in order to save its cache. Creating the cache directory happened outside the write’s error handling, so a read-only checkout aborted the whole scan after every registry and advisory lookup had already completed.

---

​

v1.25.2 - 2026-08-31

​

Files that could not be read are no longer scored as though they were bad

Iris Code reported some valid JavaScript and TypeScript files as unparseable, scored them zero, and failed the gate on them. Two causes: brackets inside regular expressions were counted as code, and a URL in JSX text was read as the start of a comment, which swallowed the rest of the line. Both were reported on the same day from two unrelated projects. Ships with @iris-code/cli 1.17.3.

• Fixed false parse errors on regular expressions containing brackets or braces, such as /\[([^\]]*)\]/, and on .jsx/.tsx files with a URL in visible markup. Twelve files in one project moved from a score of 0 to between 92 and 100.
• Fixed a related error where a self-closing JSX tag with an attribute, such as <Input value={x} />, caused the rest of the component to be misread.
• Changed how an unparseable file affects your results. It is now excluded from the workspace average and from the list of files below the minimum score, and is reported separately as a file that could not be analysed. A syntax error your compiler already catches no longer blocks the gate twice.
• Added gateMaxParseErrors for teams that want unparseable files to fail the gate. Unset by default. See .irisconfig.json.

​

React components are measured by their logic

“Function too long” counted JSX markup as function length, so it fired on about a third of .tsx files against 2% of .ts files. A component with twenty lines of hooks and sixty lines of markup was reported as an eighty-line function.

• Changed function length in .jsx and .tsx to exclude JSX markup. Logic inside markup, such as an inline handler or a .filter().map() chain, still counts. Vue and Svelte have always worked this way, so this brings React into line with them.
• Unchanged file length and functions-per-file, which still count every line. A 400-line component is still reported as a long file.
• .tsx files score about 1 to 2 points higher as a result, measured across two projects. This corrects a measurement rather than reflecting a change in your code. If you use gateBaselineMode or follow the trend chart, re-lock your baseline after updating.
• Files with no JSX are measured exactly as before, verified across 422 files.

​

Smaller corrections

• Fixed storage keys being reported as hardcoded secrets. const KEY = "da-os-canvas" carried the same penalty as a live provider token. A value that a secret-named variable holds, such as CLIENT_SECRET, still reports.
• Fixed TODO and FIXME going undetected in block comments. This affected every language variant, and mattered most in React, where a block comment is the only comment form available inside markup.
• Fixed a localhost mention inside prose being reported as a hardcoded endpoint. Documentation explaining how to connect to a local database was flagged on every mention.
• Fixed sample code quoted inside a string being detected as a real function.

---

​

v1.25.1 - 2026-08-31

​

The documented MCP setup no longer names a folder

Every published example pinned --root /path/to/project, including the configuration block most people copy. That flag stops Iris Code asking your editor which project is open, so one pinned entry reused across projects answered all of them about the folder it named, safe fixes included.

• Changed the documented setup to npx -y @iris-code/mcp with no folder, which is what makes a single registration correct for every project you open.
• Changed --root to be documented as a per-project pin rather than a default. --root . pins nothing: it resolves to the directory the server was started in, which is already the fallback.
• Fixed the server printing nothing at startup, which made a server that was waiting for its client indistinguishable from one that had failed. It now reports the folder it is analysing and where that came from. Run in a terminal by hand, it explains that it is a Model Context Protocol server and shows the configuration to paste.
• Root resolution itself is unchanged. See MCP server.

---

​

v1.25.0 - 2026-08-28

​

Your agent can ask what your project actually enforces

An agent asked to clean up a file has no way to know what your project counts as clean, so it guesses, and its guess is not the standard your pre-push hook uses. Iris Code now runs as a Model Context Protocol server, so Claude Code, Codex, Cursor, Windsurf, Copilot agent mode, Zed and JetBrains AI Assistant can ask for your real thresholds instead. Delivered through @iris-code/cli 1.17.0, so it needs no editor. See MCP server.

• Added six tools. Free: findings for a single file, the project’s resolved configuration, and safe fixes on a single file. Pro: folder and workspace scope, rule detail, gate status, and dependency risk. Pro tools stay listed and identify themselves as Pro rather than hiding.
• Added preview-first safe fixes. Applying requires a token from a previous preview, so a change set you have not seen cannot be written. Refusals are per finding with a reason: a hardcoded secret is never auto-fixed, and a debug print sharing its line with real code is left alone.
• Added findings carrying every rule with its real severity and a stable id, rather than the error-level list CI annotations are limited to. Oversized results drop the lowest severities first and report what was withheld.
• Added Tools | Iris Code | Set Up MCP Server in JetBrains IDEs, which copies a ready-to-paste configuration using the bundled binary and needs no Node.js installation.
• Analysis stays on your machine. Only dependency and advisory lookups reach the network, and those ask first.

​

Changed

• Changed the finding list used by CI annotations to exclude debug prints. That list produces one error-level annotation per entry with about ten visible per step, so a low-severity rule in it both misreported severity and could push a hardcoded-secret annotation out of view. Health scores are unchanged, and agents receive the complete list through MCP.

---

​

v1.24.0 - 2026-08-25

​

Your standards, in the file your agent reads

An agent writing code in your repository does not know your file-length limit, your naming convention, or the score your pre-push hook blocks below. It finds out when something fails, which is after the work is done. iris rules writes those rules into the file the agent already reads, generated from .irisconfig.json. Nothing is analysed, nothing is sent anywhere, and no model is involved. Ships alongside @iris-code/cli 1.16.0. See Project rules.

• Added iris rules and the editor command Iris Code: Write Project Rules for AI Agents, reachable from the command palette, the File tab, the welcome page, and in JetBrains from Find Action. Free.
• Added support for writing several files in one run. Claude Code reads only CLAUDE.md, while AGENTS.md is the file Codex, Cursor and Copilot read, so a team running two agents needs both. Each file receives the full rules rather than a pointer to another file, and the editor picker accepts more than one.
• Added --all to write every target, --refresh to update only the files a repository already has and create none, and --dry-run to print the result instead of writing it. Each file is written independently, so one file that cannot be updated is reported with its reason while the rest still change.
• Added markers around the generated block, so regenerating updates only Iris Code’s own section and never text you wrote. Running it again with an unchanged config reports the file is already up to date rather than producing a diff, and a file with a damaged marker is refused with an explanation rather than duplicated.
• Changed the rules to describe only what your project contains. A Java project is not told to avoid any, and the debug-output rule names System.out.println rather than listing every language’s equivalent.
• Changed how a single-language project is described: where your config raises that language’s limits, the rules state the effective numbers rather than the project defaults with a footnote. A rule that quotes a limit the gate does not enforce is worse than no rule.
• Fixed per-language overrides for Java and Rust being rejected by the config schema. Both languages have been analysed since 1.23.0, but the schema declared six language keys against the analyser’s eight, so a valid languages.java block was reported as invalid in every editor with schema support.

---

​

v1.23.1 - 2026-08-23

​

A scan covers the folder you selected

A workspace score is only useful if it describes the project it names. A symlinked file pointing outside the scanned folder was followed, so a file living elsewhere on the machine could be analysed, scored, and counted as part of the project.

• Fixed workspace scans following symlinked files out of the selected folder. Partial scans compare resolved paths, and full scans skip links.

Version 1.23.2 followed the same day with a fix to the release process itself and no change to analysis.

---

​

v1.23.0 - 2026-08-17

​

Java and Rust join the same engine

Java and Rust are analysed everywhere Iris Code runs - the editor, the CLI, hooks, and CI - which brings the total to nine languages. Both arrive with the full rule set rather than a subset: functions and methods, imports, nesting, complexity, magic numbers, debug output, TODOs, secrets, security smells, duplicate detection, suppressions, file naming, scoring, and gates. Ships alongside @iris-code/cli 1.15.0. See Language support.

• Added Java analysis for .java source and .properties configuration. A .properties file is read as configuration rather than code: it is scanned for committed credentials, and its ports and log levels are not reported as unexplained numbers.
• Added Rust analysis, covering functions, modules, imports, complexity, secrets, suppressions, naming, scoring, gates, and duplicate detection.
• Added three language-specific checks: process execution in Java through Runtime.exec or ProcessBuilder, and in Rust both unwrap or expect calls and explicit panics.
• Added Java to the catch-all exception rule that C# already used, under one shared rule id. The same defect has the same fix in both languages, so one severity setting and one iris-ignore comment cover a codebase that uses both.
• Added test-aware exemptions for Rust. Rust puts its tests in the file under test, so the exemption is computed per #[cfg(test)] item rather than per file. A file-level exemption would spare the production half of the same file.
• Added Java unused-import reporting. The usage search reads Javadoc, so an import referenced only from a {@link} is left alone, because removing it would break javadoc.
• Added Maven and Gradle dependency and CVE audits, covering pom.xml, build.gradle, build.gradle.kts, and version catalogues, including ${property} placeholders and dependencyManagement. Neither tool commits a resolved dependency tree by default, so these scans cover declared dependencies and say so. See Dependents Table.
• Added Cargo dependency and CVE audits. Cargo.lock gives exact versions and the full transitive tree, with git and path dependencies excluded, because a public registry knows nothing about them.
• Added Java and Rust to the published accuracy benchmark, on 17 and 16 rules respectively. See Accuracy benchmark.
• Changed advisories published without a severity to appear rather than be dropped. Most RustSec advisories carry no score, so they were hidden entirely. They now show as unrated and are counted, and they never satisfy a --severity high gate, because an unrated advisory is one nobody has scored rather than one known to be minor.
• Fixed committed credentials in Java source and .properties files going undetected. Java has no const, let, or var, so the name-based check matched nothing and only credentials with a recognisable provider format were ever reported. A database password has no such format.
• Fixed constants that name a credential field being reported as the credential itself, such as PASSWORD_FIELD = "password".
• Fixed fixture credentials in Gradle test source sets being reported as production secrets. Gradle projects declare test source sets freely, and only src/test was recognised.
• Fixed a named constant being reported as a magic number in Java and Rust. Naming the number is the fix the rule asks for, so reporting it described the fix as the defect.
• Fixed a naming convention asking you to rename application.properties. Spring resolves that filename exactly, so the rename would have broken the application, and both the Quick Fix and the Pro batch rename offered to make it in one click.
• Fixed iris sbom reporting no dependencies for Java and Rust projects, and iris deps, iris cve, and iris sbom refusing pure Rust and pure Gradle projects while naming both manifest families in the error.
• Fixed Maven latest-version lookups in both directions. An upgrade is no longer offered to a date-based release from 2003, which sorts above every modern version, and a -jre or -android classifier is no longer read as a prerelease, which had left some packages with no known latest version at all.
• Fixed a Cargo dependency whose name is not a valid crate name being matched against an unrelated crate that occupies the same index path. It is reported as not checked.
• Fixed the Dependencies table flickering when a scan finishes. It rebuilt every row in order to re-sort them, which also closed any advisory panel you had expanded, and repeated on every filter click and search keystroke.
• Fixed large, heavily documented Java files analysing slowly. Analysis now scales in proportion to file size.

---

​

v1.22.0 - 2026-08-13

​

Ruby and .NET dependencies are audited like every other ecosystem

The Dependents Table, iris deps, iris cve, and iris sbom now read Ruby and .NET manifests alongside npm, Go, and Python. Gemfile.lock gives the full resolved tree, so transitive gems are covered; NuGet without packages.lock.json sees the packages a project declares. Where a version cannot be resolved, the package is reported as not checked rather than assumed clean. See Dependents Table.

• Added RubyGems support: Gemfile.lock for exact transitive versions, with Gemfile and .gemspec as fallbacks. A gem pinned to an exact version is checked; a range is reported as not checked, because an advisory verdict against a range is either a false clean or a false alarm.
• Added NuGet support: .csproj PackageReference entries aggregated across every project in a solution, plus Central Package Management (Directory.Packages.props), packages.lock.json, and legacy packages.config. Two projects pinning different versions of one package are reported as a conflict rather than silently resolved to one of them.
• Added prerelease filtering for NuGet, so a 9.0.0-preview is never offered as an upgrade from a stable release.
• Added Ruby to the published accuracy benchmark on every shared rule, not only its three Ruby-specific ones. See Accuracy benchmark.
• Changed the dependency-lookup disclosure to name RubyGems.org and NuGet.org, the two new registries contacted. Only package names and versions are sent, as before.
• Fixed native gems being reported as vulnerable when already patched. A gem built for your platform is locked as 1.19.4-x64-mingw-ucrt, and that platform suffix was read as part of the version, sorting it below the plain release - so advisories already fixed in the installed version still matched, and up-to-date gems sat permanently in “outdated”. This affected most Ruby projects, since Rails pulls in several native gems.
• Fixed a gem RubyGems cannot resolve - yanked, renamed, private, or mistyped - appearing as outdated with an upgrade target of “unknown” instead of being reported as not checked.
• Fixed SBOM components with no resolvable version carrying a package URL whose version was placeholder text. The form was structurally valid, so a vulnerability scanner reading the SBOM failed to match those components without reporting a problem. They now carry a version-less package URL and state why.
• Fixed “Update all outdated” offering a command that covered only part of what it listed in a project using more than one package manager.
• Fixed the CLI reporting “Running as Free” when the licence server was unreachable but a cached Pro licence was still valid, and emitting the CI notice about skipped Pro steps on runs where nothing was skipped.

---

​

v1.21.0 - 2026-08-12

​

C# joins the same engine

C# is analysed everywhere Iris Code runs - the editor, the CLI, hooks, and CI - with the same scoring, secrets detection, security smells, duplicate detection and suppressions as every other language. A .csproj is read as a manifest rather than as code: it contributes the packages your project depends on, and it is scanned for secrets, but its language version and warning level are build settings. See Language support.

• Added C# analysis for .cs and .csproj, covering methods and constructors, nesting and complexity, using namespaces and PackageReference entries, security idioms, secrets in fields, properties, locals and project XML, test conventions, suppressions, file naming, scoring, and gates.
• Added four C#-specific checks: async void outside event handlers, where a thrown exception cannot be observed by the caller; catch-all exception handlers, with when (...) filters exempt; LINQ chains of five or more operators in one statement; and types carrying too many responsibilities.
• Added .NET build hooks. A project with a .csproj or .sln gets an iris-check Makefile target wired as a prerequisite of build or all, defaulting to dotnet build.
• Added a csharp key to the languages block in .irisconfig.json, and severity overrides plus iris-ignore support for the four new rule ids.
• Fixed a verbatim Windows path breaking the file it appeared in. @"C:\logs\" was read as an unterminated string, so every brace after it counted at the wrong depth and the file was reported as a parse error with no findings at all. Raw strings failed the same way in the other direction. Both are now understood, along with the interpolated and doubled-quote forms.
• Fixed .NET test projects being treated as production code. C# has no _test filename separator and its test directory is <Project>.Tests, so fixture credentials and localhost URLs in tests were reported as real findings.
• Fixed project files reporting their language version and warning level as unnamed numbers, and C# attributes, const/readonly declarations and enum members now count as naming their own values.
• Fixed constructors with a : base(...) or : this(...) initialiser being skipped entirely, so no length, parameter, or nesting check applied to them, and a positional record being counted as both a type and a method.
• Fixed the C# debug-output Code Lens appearing in JetBrains only, and the File tab, Problems entries and inline diagnostic using the JavaScript wording for a C# file.
• Fixed the Iris Code panel opening blank in IntelliJ 2026.2 and other current JetBrains IDEs. The IDE moved its embedded browser out of the platform into a bundled component that Iris Code did not ask for, so the panel and the table tabs had nothing to draw with. Where an IDE cannot provide an embedded browser at all - some platforms and architectures do not ship one - the panel now offers to open the same interface in your own browser, and everything you click there still acts on the IDE. Analysis, diagnostics and enforcement were never affected.
• Fixed a type written entirely on one line - class C { public void M() { } } - reporting no methods, which exempted its members from the length, parameter-count and nesting checks.
• Fixed the Problems list showing raw rule ids as group headings for the C# checks and, since 1.20.0, the Ruby ones.

---

​

v1.20.0 - 2026-08-10

​

Ruby joins the same engine

Ruby is analysed everywhere Iris Code runs - the editor, the CLI, hooks, and CI - with the same scoring, secrets detection, security smells, duplicate detection and suppressions as every other language. Ships alongside @iris-code/cli 1.12.0. See Language support.

• Added Ruby analysis covering .rb and the Ruby DSL extensions, plus the extensionless files Ruby projects actually use: Gemfile, Rakefile, Vagrantfile, Capfile, the Fastlane set, and .irbrc. A file’s language is not always decidable from its extension, so these are matched by name.
• Added ERB template support. Ruby inside <% %> and <%= %> tags is analysed while the surrounding HTML is excluded from scoring and duplicate matching, and findings report the line number in the template file itself.
• Added three Ruby-specific checks: method_missing defined without respond_to_missing?, god classes, and Rails parameters reaching a model without require and permit.
• Added Ruby build hooks. A project with a Gemfile gets an iris-check Makefile target wired as a prerequisite of build or all.
• Changed file renaming to warn on Ruby as it already did on Python. A rename does not rewrite require_relative paths or the constant names Rails derives from a filename.
• Fixed a Ruby guard clause such as return 0 if value.nil? being read as a missing end, which scored the file 0 and skipped its analysis.
• Fixed analysis speed on large files containing many findings. Several checks repeated whole-file work per finding, so cost grew with the square of the file size; a large Rails controller that took over a minute now completes in a fraction of a second. Findings are unchanged.

---

​

v1.19.0 - 2026-08-08

​

Gate results where the team sees them

Iris Code can send iris check and iris gate results directly from your own CI to Slack. The message never passes through Iris Code servers, and notification delivery never changes the command’s exit code. Ships alongside @iris-code/cli 1.11.0. See Slack notifications.

• Added Slack notifications controlled by the IRIS_SLACK_WEBHOOK CI secret. Messages contain file paths, scores, rule names and counts, but never source, finding text or secret values.
• Added the free iris slack setup, iris slack test and iris slack manifest commands for guided setup, delivery testing and creation of a pre-configured Slack app.
• Added --slack-on always to report passing runs and --slack-dry-run to inspect the payload without posting.
• Changed the Config Studio on narrow screens. Preview config opens the live .irisconfig.json preview in a centred, scrollable modal, and account navigation opens from an animated menu instead of occupying the bottom of each page.
• Fixed file-naming violations appearing twice in the VS Code Problems panel.

---

​

v1.18.0 - 2026-08-05

​

Components are code too

Iris Code reads .vue and .svelte components: their <script> blocks are analysed as JavaScript or TypeScript from the lang attribute, while template and style markup is excluded from both analysis and duplicate detection. Findings keep the component’s own line numbers. Ships alongside @iris-code/cli 1.10.0. See Language support.

• Added Vue and Svelte single-file component analysis everywhere Iris Code runs - the editor, the CLI, hooks, and CI. Secrets, security smells, duplicate detection, suppressions, health scores, change review, and workspace scans all cover them, and root-level script blocks only: a <script> inside a template or an {#if} block is markup, not code.
• Added role-based file naming (Free): fileNaming.overrides takes an ordered list of path globs, so components/** can require PascalCase while composables/** requires camelCase. Both conventions could not be expressed before, because a lang="ts" component and an ordinary .ts module resolve to the same language. The last matching rule wins, workspace ignore globs stay absolute, and a config without overrides behaves exactly as before. See File naming.
• Added inline file-naming diagnostics in JetBrains IDEs, matching VS Code.
• Added SvelteKit awareness: +page.svelte, +layout.svelte, +server.ts and their siblings are exempt from naming conventions, because the framework resolves them by exact filename.
• Fixed the no-exports check firing on essentially every Vue and Svelte component - a <script setup> block has no export by design.
• Fixed large-file analysis speed. Analysis time grew with the square of a file’s line count, so a very long file - especially one with many blank lines, worse with Windows line endings - could stall the editor or a CI run for minutes. A 200,000-line file went from over two minutes to a fraction of a second, with no change to findings.
• Fixed an unusable file-naming glob stopping the scan. The offending pattern is now named with its exact location, the rest of the rule keeps working, and the pattern can never quietly excuse a file from its convention.
• Changed iris report and iris sbom to require --output to stay inside the current directory, matching iris check, iris deps, and iris cve.
• Fixed the Config Studio preview showing a config shape Iris cannot read. The panel described its own nested format (thresholds, detections, diagnostics, severity), so copying the preview instead of syncing produced a file where every threshold, detection toggle, inline-diagnostic setting, and severity override was silently ignored - and because presetId was honoured, it looked like it had worked. The preview, the Copy button, and Sync are now the same text: the exact file that gets written. Configs you synced were always correct; only copied ones were affected.

---

​

v1.17.0 - 2026-07-30

​

One engine, every editor

Iris Code now runs in JetBrains IDEs and installs from Open VSX, both driven by the same analysis engine as the VS Code extension. A file scores identically in each host, one sign-in covers your editors and the CLI, and analysis still never leaves your machine.

• Added Iris Code for JetBrains IDEs - IntelliJ IDEA, WebStorm, PyCharm, GoLand, PhpStorm, Rider, RubyMine, CLion, and Android Studio. Inline diagnostics, iris-ignore quick fixes, health scores on hover, code lenses, filename-convention renames, and the full Iris Code panel under Tools > Iris Code. Install the LSP4IJ plugin first and restart the IDE fully after installing.
• Added Open VSX distribution, so Cursor, Windsurf, VSCodium, and other Open VSX editors install the byte-identical extension and receive updates automatically instead of a manual .vsix.
• Added 25 searchable Iris Code commands in JetBrains: press Ctrl+Shift+A (Cmd+Shift+A), type iris, and run workspace scans, Review My Changes, trends, hooks, dependencies, history secrets, or report export. Any of them can be bound to a shortcut under Settings > Keymap.
• Added sign in and sign out from JetBrains under Tools > Iris Code. Analysis and the panel refresh in place, so Pro features activate without restarting the IDE.
• Added dashboard config sync for JetBrains: build a config in the Config Studio, choose Sync to JetBrains, and paste the one-time code into Tools > Iris Code > Sync Config from Dashboard. You review a diff before anything is written.
• Added GitHub Actions workflow and CI snippet generators to JetBrains, matching the VS Code commands.
• Added shared push-blocked history, so the Enforcement card shows the same blocked-push counts, Pro activation date, and score delta in either editor.
• Changed hover documentation for .irisconfig.json now comes from the schema bundled with your installed version. Hovering any setting explains what it does, works offline and behind a proxy, and always matches the version of Iris Code you are running.
• Fixed a Pro config could briefly be reported as Free in JetBrains while the licence was still being validated, which also scored files against Free thresholds until it settled.
• Fixed Gate Preview and the trend-history table are Free features but were refused on the Free plan in JetBrains.
• Fixed the GitHub Actions and CI snippet generators now require Pro in JetBrains, matching VS Code.
• Fixed .irisconfig.json is recognised as comment-tolerant JSON in JetBrains. If your IDE still reports “JSON standard does not allow comments”, it holds a user-level override - see Installation.

---

​

v1.16.0 - 2026-07-26

• Added Quality Signals: recurring workspace issues ranked by density and impact, with raw counts and percentages linked to the corresponding finding surfaces. Code Health remains the single headline score.
• Added Free workspace-wide and per-language file naming checks with four conventions, framework-aware exemptions, custom ignore globs, rename suggestions, baseline-aware new-file rollout, Explorer/Problems decorations, an open-file rename hint, and a 50-result disclosure for first scans without a baseline.
• Added the ai-assisted preset for high-volume AI-assisted review. It tightens structural, security, suppression, and duplication defaults without choosing a team-specific naming style.
• Added the Pro gate field gateMaxNamingViolations, enforced consistently by the CLI, hooks, and CI.
• Changed Free config handling inside languages: Iris keeps fileNaming and squiggles each ignored Pro-only sibling instead of discarding the whole block.
• Fixed the bundled config schema now recognizes trendRegressionThreshold and gateBaselineMode.

---

​

v1.15.0 - 20 Jul 2026

​

Accuracy you can check, and rate

Iris Code 1.15.0 makes its findings accountable: every analysis rule is measured against a labelled corpus of real code for per-rule, per-language precision and recall, a checked-in baseline blocks any release that regresses a rule, and every finding in the sidebar now carries a thumbs up / down so you can tell Iris Code when it is right or wrong. Ships alongside @iris-code/cli 1.8.0. See Accuracy benchmark.

• Added a thumbs up / down control on every finding in the sidebar and Issues view. Feedback is count-only - the rule, the language, and your verdict, never source code, file paths, or line contents - and respects your account analytics setting. Rate once and change your mind anytime; the control remembers your choice.
• Added an accuracy benchmark: every rule is measured against a labelled corpus for per-rule, per-language precision and recall, with a checked-in baseline that fails the build on any regression. A public methodology page shows the enforcement-rule figures per rule - no single misleading global percentage.
• Fixed false positives found by the benchmark: any in a comment or string, print(...) in a Python docstring, CommonJS module.exports files reported as export-less, arithmetic like (a + b) * c mistaken for a risky regular expression, and the eval( token inside a string literal are no longer flagged. Each fix is guarded by a permanent test case.

---

​

v1.14.0 - 19 Jul 2026

​

One config, honest thresholds for every language in the repo

Iris Code 1.14.0 lets mixed-language repos stop compromising: a languages block in .irisconfig.json overrides per-file thresholds for TypeScript, JavaScript, Go, and Python independently, applied identically by the sidebar, CLI, hooks, and CI. Ships alongside @iris-code/cli 1.7.0. See Per-language overrides.

• Added per-language config overrides (Pro): per-file thresholds, healthScoreWeights, severityOverrides, and the per-file gate caps can differ per language; anything unstated falls back to the base config. Scan-total gates and toggles are rejected inside a block with a clear warning, and unknown language keys warn instead of breaking older installs. The file tab shows the applied override next to the config source, and iris gate prints the limit that actually governed each failing file.
• Added six more secret formats: Stripe live/restricted keys (sk_live_/rk_live_), GitHub fine-grained PATs, GitLab PATs, npm access tokens, SendGrid API keys, and PEM private-key headers - masked in output, as always.
• Added a bounded timeout to the installed pre-push hook: a hung analysis is stopped after 120 seconds (IRIS_HOOK_TIMEOUT to adjust) instead of blocking git push indefinitely. The push still fails closed with a bypass hint, so enforcement is never silently skipped. Reinstall the hook to pick this up.
• Fixed function-length measurement for functions with destructured parameters - which includes essentially every React component. Component-heavy files may score lower after updating: that is the analyser finally seeing them, not a scoring change.
• Fixed --allow-network so it reliably re-enables dependency lookups after --revoke-network, and hardened the remaining CLI commands (report, sbom, config, auth, hook, todos) against a Windows-only crash on exit.

---

​

v1.13.0 - 15 Jul 2026

​

Review my changes, and secrets that history still remembers

Iris Code 1.13.0 makes reviewing your own Git changes the primary workflow - free, interactive, and scoped to exactly what you touched - and adds a git history secrets scan that finds credentials which were committed and later removed. Ships alongside @iris-code/cli 1.6.0. See Review My Changes and Git History Secrets Scan.

• Added Review my changes (free): when Git reports local changes, a count-aware strip appears above the sidebar tabs. Running it checks every supported staged, unstaged, and untracked file and opens a dedicated review - blockers first, severity filters, search, changed-file health, and click-to-open findings. The Issues and TODOs tabs show the review’s evidence on Free.
• Added the git history secrets scan (Pro): walks past commits - committed .env files included - through the same two-layer secrets detection. Findings are deduplicated per distinct secret, always masked, and show first/last sighting, commit and file counts, and whether the secret is still in HEAD. Merge-commit content is covered; depth, size-cap, and shallow-clone limits are always disclosed. Runs entirely against local git.
• Added iris secrets --history [--depth N] (Pro): the same scan in the terminal, with JSON output for automation; exits 1 when any secret is found in the scanned range.
• Changed change reviews to stay honest about scope: they never create a workspace trend snapshot and never report unused dependencies, because that conclusion requires a full-project scan. The changed-file count only counts files the review will actually analyse.
• Changed git-aware discovery to include untracked files not excluded by .gitignore, and to scope to the workspace when it sits inside a larger repository.
• Fixed predictability in unusual environments: repositories with very large untracked sets no longer fail discovery, a missing Git installation is reported as exactly that, and the history panel shows distinct loading, error, and empty states.
• Fixed CLI exit-code reliability on Windows so free users and unlicensed CI runs stay green as documented.

---

​

v1.12.0 - 13 Jul 2026

​

Duplicate code detection: find the copy-paste, diff it, gate on it

Iris Code 1.12.0 finds copy-pasted blocks within and across files using normalised token-window matching - renamed identifiers, changed literals, reformatted whitespace, and comments do not hide a duplicate. Free for everyone, with a Pro side-by-side diff view and a new gate rule. Ships alongside @iris-code/cli 1.5.0. See Duplicate Code Detection.

• Added duplicate code detection (free): source is normalised before comparison (identifiers, literals, whitespace, and comments ignored; keywords kept verbatim), so two stretches of code that differ only in naming or values still match. Within-file blocks appear as a Duplicate blocks smell on the File tab and deduct healthScoreWeights.duplicateCode points (default 3); cross-file blocks power a new Duplication section on the Workspace and Folder tabs with block count, the duplication percentage of total code lines, and the largest blocks with click-through to both locations.
• Added noise guards so results stay reviewable: import/require headers never match, uniform data literals (country lists, enum tables) are excluded, a block repeated many times reports as a minimal set of pairs instead of every combination, JSX-heavy files need twice the token evidence, and oversized or minified-looking files are excluded and disclosed as skipped.
• Added a full Duplicates table - filterable by cross-file or within-file, searchable, both locations clickable - that tracks live edits: line ranges update as you type and resolved pairs drop out without a rescan.
• Added an Open diff action on every duplicate (Pro), titled with both locations GitHub-style. Cross-file pairs open the two full files side by side, editable with normal saves; same-file pairs open the two blocks as editable extracts that write back to the real file. Iris Code toasts the moment the duplication is resolved.
• Added gateMaxDuplicateBlocks (Pro): caps the total duplicate blocks across the scan, enforced by iris check, iris gate, the git hook, and the build hook - a block spanning two files counts once. New config keys: enableDuplicateDetection (default on), duplicateBlockMinTokens (default 40), the duplicateCode scoring weight, and an optional inlineDiagnostics.duplicateCode squiggle toggle.
• Added duplicate-code as a suppressible rule id: // iris-ignore: duplicate-code -- <reason>.
• Added duplicateBlocks arrays to iris check --format json file entries (additive; schema version unchanged) and a “Max duplicate blocks” rule row to iris gate.
• Fixed .mjs and .cjs files being skipped entirely - they are now analysed everywhere .js is: workspace scans, folder scans, and CLI directory checks.

---

​

v1.11.0 - 9 Jul 2026

​

Inline suppressions with required reasons, and dependency lookups move to OSV.dev

Iris Code 1.11.0 lets you silence individual findings with a documented iris-ignore comment, and moves all dependency vulnerability lookups to the OSV.dev database - no token, no rate-limit setup. Ships alongside @iris-code/cli 1.4.0.

• Added inline suppressions (free): // iris-ignore: <ruleId>[, <ruleId>...] -- <reason> suppresses matching findings on the next line, and // iris-ignore-file: ... covers the whole file (# works for Python). The reason is required - a directive missing it, or naming an unknown rule, suppresses nothing and is reported as a Bare Ignore finding with its own score penalty (healthScoreWeights.bareSuppression, default 2). Eighteen rule ids are suppressible; suppressed findings stop costing health-score points but stay counted and visible. See Inline Suppressions.
• Added suppression surfaces in the sidebar: a Suppressed section in the File tab, and a Suppressions section in the Workspace and Folder tabs with per-file counts and a See all button that opens a full filterable table with click-to-open at the exact line.
• Added --show-suppressed to iris check and iris gate: lists each suppressed finding with its reason. Suppressed counts always appear in the output, and JSON reports gain a per-file suppressed array (schema version unchanged).
• Added two Pro team controls: gateMaxSuppressions (per-file cap, enforced by iris gate, the git hook, and the build hook) and ignoreSuppressions: true (kill-switch that makes every directive inert so suppressed findings count as live).
• Changed the Dependents Table, iris deps, and iris cve to source vulnerability data from the OSV.dev database. No token or rate-limit setup is needed: the in-panel GitHub token button is gone, the GITHUB_TOKEN environment variable is no longer used, and iris auth login no longer prompts for a GitHub PAT. Only the package name, ecosystem, and version are sent - never code, file paths, or project names - and the consent flow is unchanged. Old advisory caches invalidate automatically.
• Added a confidence label on every advisory (fix-available, direct, transitive, or manual-review) plus the fixed-in version where one exists, in both the panel and CLI output.
• Improved advisory trustworthiness: records without a verifiable id or severity are never shown - they are dropped and the skip count is disclosed in the panel footer and CLI output - and dependencies whose lookup errored are marked “not checked” instead of being assumed clean.
• Fixed debug prints quoted inside comments being flagged as live debug prints in TS/JS, Go, and Python.
• Fixed iris deps and iris cve argument errors no longer risk a crash on exit on Windows.

---

​

v1.10.0 - 5 Jul 2026

​

CVE severity gate, CycloneDX SBOM export, and lockfile-aware dependency audits

Iris Code 1.10.0 turns the dependency scanner into a full supply-chain toolkit: gate CI on advisory severity with iris cve, export a CycloneDX SBOM with iris sbom, and get audits that reflect what is actually installed thanks to lockfile resolution and monorepo workspace discovery. Ships alongside @iris-code/cli 1.3.0.

• Added iris cve [path] (Pro): runs the same dependency and CVE scan as iris deps (sharing its 24-hour cache and network consent), but exits 1 only when an advisory at or above the --severity threshold (low, medium, high, critical; default high) is found. Built for CI gates: block on critical or high advisories without failing the pipeline on low-severity noise.
• Added iris sbom [path] (Pro): exports a CycloneDX 1.5 software bill of materials across npm, Go, and Python manifests. Fully offline: no network requests, no consent prompt. Components carry the name, exact installed version, purl, and a required/optional scope (direct vs dev). If a cached iris deps scan exists, known vulnerabilities fold in as CycloneDX vulnerabilities entries cross-referenced by purl. Writes iris-sbom.json by default; --stdout prints instead.
• Improved iris deps: installed versions are now resolved from lockfiles (package-lock.json v1-v3, pnpm-lock.yaml, yarn.lock classic and Berry, poetry.lock, Pipfile.lock) instead of manifest ranges, and advisories are filtered to the installed version.
• Improved monorepo support in the dependency scanner: npm and yarn workspaces plus pnpm-workspace.yaml members are discovered and deduplicated, and internal workspace: / file: / link: dependencies are excluded.
• Added network consent for dependency lookups: the first lookup asks permission and discloses exactly what is sent (package names and versions, nothing else), persisted in ~/.iris/preferences.json. --revoke-network disables lookups; --allow-network re-enables them. Cached results now print their age.
• Added a CVE summary badge (Pro) to the Dependencies section of the Workspace tab: a green “no known CVEs” pill, or the vulnerable package count plus the highest severity from the last cached scan. Cache-only: the badge never triggers a network request itself.
• Added a scope indicator to the Issues and TODOs tabs: each tab now labels which scan it is showing (for example, “Showing: folder · src”) with a one-click Show workspace switch.

---

​

v1.9.0 - 2 Jul 2026

​

Security smell enforcement: gate on it, scan for it from the CLI

Iris Code 1.9.0 closes the loop on 1.8.0’s security smell detection: a new gate rule blocks pushes and CI runs on security smell count, and a dedicated CLI command scans for them independently of a full health check.

• Added gateMaxSecuritySmells to .irisconfig.json - the gate fails when the total number of security smells (eval usage, SQL injection risk, insecure RNG, disabled TLS, weak hashing, and the rest of the nine 1.8.0 patterns) across the workspace exceeds this value. Enforced by the CLI, the git hook, and the build hook alongside gateMaxSecrets, gateMaxComplexity, gateMaxFileLength, and gateMaxSmellsPerFile.
• Added iris security [path] - a free CLI command that scans JS/TS/Go/Python for the same nine security smell categories as the sidebar, independent of a full iris check run. Supports --format pretty|json and --output; exits 1 if any smell is found.
• Added a Security Posture section to the Workspace and Folder tabs in the VS Code sidebar - a collapsible count-by-category breakdown of security smells found in the current scan.
• Added the gateMaxSecuritySmells field to the Config Studio’s Gate limits editor for Pro users.

---

​

v1.8.0 - 30 Jun 2026

​

Security smell detection: nine patterns, every file, free

Iris Code 1.8.0 adds a second static-analysis tier below hardcoded secrets: security smells. Nine patterns catch the most common security anti-patterns before they reach production. The feature is on by default, free for all users, and emits Warning-severity squiggles in the editor when inline diagnostics are enabled.

• Added nine security smell detectors across TypeScript, JavaScript, Go, and Python:
  • Eval / exec calls - dynamic code execution via eval(), exec(), or similar constructs
  • SQL built by string concatenation - query strings assembled with + or template literals instead of parameterised queries
  • Insecure random number generation - Math.random(), rand.Intn(), random.random(), and other non-cryptographic RNG in a security-sensitive context
  • ReDoS-prone regexes - nested quantifiers in patterns that can cause catastrophic backtracking
  • Disabled TLS verification - rejectUnauthorized: false, InsecureSkipVerify: true, or verify=False
  • Weak hashing - MD5 or SHA-1 in contexts that suggest security use (passwords, tokens, signatures)
  • Open redirects - res.redirect() or equivalent called with unvalidated user-controlled input
  • Debug flags in production - debug: true flag objects left in non-test code
  • Hardcoded localhost URLs - http://localhost or http://127.0.0.1 in production code paths (skipped in test files)
• Added enableSecuritySmells toggle in .irisconfig.json and VS Code settings (iris.enableSecuritySmells, default on). Turning it off suppresses all nine patterns.
• Added inline diagnostics support: when enableInlineDiagnostics is on, security smell findings appear as Warning squiggles in the editor and entries in the Problems panel. Controlled per-category via inlineDiagnostics.securitySmells.
• Added custom scoring weights for each of the nine patterns for Pro users - adjust the health-score penalty per pattern in healthScoreWeights (keys: evalUsage, sqlConcatenation, insecureRandom, unsafeRegex, hardcodedLocalhost, disabledTlsVerification, debugFlagsEnabled, weakHashing, openRedirect).

---

​

v1.7.0 - 25 Jun 2026

​

Trend tracking, baseline enforcement, and dashboard redesign

Iris Code 1.7.0 ships health score history, a dedicated Trends panel with per-file comparison, and baseline-mode gate enforcement so existing debt never blocks your team.

• Added trend tracking: Iris Code automatically snapshots your workspace health score on every scan, stored in .iris-snapshots/ (gitignored, 2 MB cap, same-day dedup, corrupt-entry hardening).
• Added Trends panel: compare any two snapshots with a sortable, filterable per-file score table. Click any row to jump directly to the file. Free tier: rolling 2-snapshot window. Pro: unlimited history.
• Added inline trend summary in the Workspace tab showing regressed files, recovered files, and net score change between the two most recent snapshots.
• Added baseline mode: lock a baseline with iris.lockTrendBaseline. Iris Code writes .iris-baseline.json to the workspace root (committable, diffable). Set gateBaselineMode: true and the gate only blocks new regressions above the accepted baseline.
• Added iris.clearTrendHistory command to remove all snapshots and the baseline file.
• Added trial plan type: the extension now surfaces trial as a distinct plan with an Iris Code Pro Trial badge and trial-end date. Trial users get full Pro access.

---

​

v1.6.1 - 17 Jun 2026

​

Python analysis fixes: multi-line signatures and test-file secrets

Two Python correctness fixes. Files using multi-line (Black-formatted) function or block signatures are no longer misreported as syntax errors, and test files no longer have their score penalised for fixture credentials.

• Fixed: a Python def/class/if/for/with header that wraps across multiple lines (e.g. a long Black-formatted signature) was being flagged as a syntax error, scoring the file 0 and skipping all analysis. These files now analyse normally.
• Fixed: the suspicious-name secret heuristic no longer fires in test files (test_*.py, *_test.go, *.test.ts, tests/, __tests__/, conftest.py, and similar), so fixture credentials like password="secret123" no longer reduce the score. Real provider token formats (AWS, Stripe, GitHub, and more) are still detected everywhere, including tests.

---

​

v1.6.0 - 16 Jun 2026

​

CI enforcement: GitHub Actions, inline PR annotations, and multi-CI snippets

Iris Code 1.6.0 takes the same health gate you run locally and enforces it in CI. Run iris gate . --format github on every pull request to block merges and annotate the exact failing lines inline on the diff. Everything runs on your own runners - your code never leaves your infrastructure.

• Added --format github to iris check and iris gate: emits GitHub Actions workflow commands so failing rules render as inline annotations on the pull request diff, and writes a pass/fail summary table to the run’s job summary.
• Added the Iris Code: Add GitHub Actions Workflow command (Pro): generates a ready-to-commit .github/workflows/iris.yml in your repo, pre-filled with your configured threshold.
• Added the Iris Code: Add CI Pipeline Snippet command (Pro): generates an Iris Code step for GitLab CI, Bitbucket Pipelines, an npm/pnpm/yarn script, or a generic shell script.
• Added a versioned JSON schema: all --format json output now carries a schemaVersion field (currently 1) so scripts can depend on the payload shape.
• Changed CI behaviour when no licence is present: Pro-only steps now skip and exit 0 instead of failing the build, with a non-blocking warning annotation inside GitHub runners, so a missing token does not turn the pipeline red with noise.
• Added an iris-alpine-amd64 binary for musl-based (Alpine) containers. The npm install -g @iris-code/cli route was already musl-safe and works unchanged.
• Published @iris-code/cli 1.1.0 with the new --format github support, and bumped the example workflows to actions/checkout@v5 and actions/setup-node@v5 (Node 24).

---

​

v1.5.0 - 10 Jun 2026

​

Analytics batching, push-blocked counter, and reliability improvements

Iris Code 1.5.0 ships reliable background analytics, a Pro push-blocked counter, CLI event tracking, and reliability improvements across the extension and backend.

• Added analytics batching: the extension buffers usage events in memory and flushes every 60 seconds. push_blocked events flush immediately. The buffer survives extension crashes via crash-safe persistence to globalState.
• Added exponential backoff on consecutive analytics flush failures, with a clean flush on extension deactivate so no events are dropped on VS Code quit.
• Added CLI analytics: iris check, iris gate, and iris secrets runs now emit a fire-and-forget event so hook-triggered runs appear in the Iris Code dashboard alongside extension activity.
• Added push-blocked counter: the Pro sidebar now shows monthly pushes blocked, total pushes blocked, and the health score delta since Pro was activated. Resets the monthly count automatically on month rollover.
• Improved reliability and hardening across the extension, backend, and web surfaces.

---

​

v1.4.2 - 5 Jun 2026

​

Documentation and CLI reference updates

Documentation clarity improvements and expanded CLI command reference across the extension and landing site.

• Improved command reference documentation for the full CLI suite with clearer descriptions and examples.
• Updated landing site copy to reflect the published @iris-code/cli npm package.

---

​

v1.4.1 - 4 Jun 2026

​

Welcome page improvements

Enhanced welcome page layout with updated feature highlights and clearer onboarding paths.

• Refreshed the VS Code welcome page with a new feature section layout and updated quick-start links.

---

​

v1.4.0 - 3 Jun 2026

​

Full CLI command suite and npm package

Iris Code 1.4.0 ships a complete command-line tool - available via npm install -g @iris-code/cli. Scan any project from your terminal, manage enforcement hooks without opening VS Code, audit dependencies for CVEs, and authenticate once with a persistent credentials file. No VS Code installation required.

• Added iris auth: sign in via browser or licence token, store credentials in ~/.iris/credentials (chmod 600). Subcommands: iris auth login, iris auth logout, and iris auth status. Credentials are read from the IRIS_LICENCE_TOKEN environment variable first, then the credentials file.
• Added iris secrets: free hardcoded secret scanner across JS/TS/Go/Python. Two-layer detection - suspicious variable names and known token formats. Exits 1 if any findings. No licence required.
• Added iris deps: audit all dependencies (package.json, go.mod, requirements.txt) for outdated versions and CVEs via the GitHub Advisory API. Results are cached for 24 hours. Store a GitHub PAT via iris auth login for higher rate limits.
• Added iris todos: aggregate all TODO/FIXME/HACK comments across your codebase. Pro feature.
• Added iris gate: run the full enforcement gate and show each configured rule’s threshold vs actual value with per-rule PASS/FAIL. Pro feature.
• Added iris report: generate a standalone dark-themed HTML scan report. Free. Defaults to iris-report.html in the current directory.
• Added iris hook: manage pre-push and pre-build hooks from the terminal without VS Code. iris hook git|build install|uninstall|status. Install/uninstall is Pro; status is free.
• Added iris config: iris config init generates a .irisconfig.json with interactive preset selection. iris config validate reports any problems in an existing config.
• Updated iris check: file scans remain free. Directory scans, --staged, and --changed now require Pro - consistent with workspace analysis in the extension.
• Published @iris-code/cli to npm with Linux and Windows self-contained binaries on each GitHub Release.
• Added GitHub Actions docs page at iriscode.co/docs/enforcement/github-actions covering the full CI workflow, gate variant, exit codes, and threshold configuration.
• Improved hook install messages in the extension to inform users to run iris auth login or set IRIS_LICENCE_TOKEN so the hook can validate at push or build time.

---

​

v1.3.0 - 28 May 2026

​

Gate Preview, preset cycling, and custom scoring weights

Iris Code 1.3.0 ships Gate Preview - a free, read-only view of how your workspace scores against all five preset thresholds. Cycle through presets with prev/next controls or jump directly from the chip strip, drill into failing files (Pro), and apply the chosen preset in one click. Also ships custom health score weights and four new gate enforcement config fields for Pro users.

• Added Gate Preview: open it from the bottom of the File tab. It runs a full workspace scan and shows pass/fail counts for each of the five preset thresholds (legacy, balanced, typescript, strict, security) with proportion bars, a threshold card, and a recommendation for the next enforcement step. Always read-only - no files are blocked and no config is written.
• Added preset cycling: use prev/next arrows or click any chip in the preset strip to jump between presets. The focused preset shows a full drilldown and an Apply button so you can lock in a threshold in one click without leaving the surface.
• Added per-file drilldown for Pro users: expand any preset row to see the exact files that would be blocked, their health scores, and the warning pills driving the failure.
• Added custom health score weights for Pro users: set healthScoreWeights in .irisconfig.json to change how many points each finding type deducts from the base 100. Supported keys: hardcodedSecret, errorWarning, warningWarning, anyUsage, tsIgnore, consoleLog, deepNesting, longParamList, unusedVar, unusedFunction.
• Added four gate enforcement config fields for Pro users: gateMaxSecrets, gateMaxComplexity, gateMaxFileLength, and gateMaxSmellsPerFile. Set these in .irisconfig.json and the CLI enforces them on every push alongside minHealthScore.
• Improved licence reliability: server errors (5xx) and network timeouts now apply an offline grace period instead of revoking Pro. Activation skips the network call if your licence was validated within the last 24 hours.

---

​

v1.2.1 - 27 May 2026

​

Collapsible Pro card

A small follow-up to 1.2.0 that adds a collapsible Pro-status card in the sidebar and detached panel.

• Added a collapsible Pro-status card in the sidebar and detached panel. Once signed in, the card collapses to a compact chip so it stays out of the way while still showing plan status at a glance.

---

​

v1.2.0 - 20 May 2026

​

Config presets, dashboard sync, and bank transfer billing

Iris Code 1.2.0 ships a complete config management flow - pick from five presets, tune on the dashboard, and push to VS Code in one click. Nigerian users can now also pay with a bank transfer instead of a card.

• Added preset configs: set presetId in .irisconfig.json to snap your whole team to a known baseline (strict, balanced, legacy, security, or typescript). Preset configs are free for all users.
• Added config enforcement for Free users: if a free user edits preset threshold values locally, those edits are ignored and marked with a yellow warning in the editor pointing to the preset as the source of truth.
• Pro users can start from any preset and override individual values - the preset acts as a baseline, not a lock.
• Added a Config page in the account dashboard for generating and customising Iris Code configs with a live preview.
• Added dashboard-to-VS Code sync: generate a config on the dashboard, click Sync to VS Code, review a diff preview in the editor, and confirm the write - no copy-pasting.
• Added Paystack bank transfer checkout for Nigerian users: choose a one-time transfer checkout from the billing page, pay to the transaction-specific account shown, and Pro activates on confirmation. A fresh checkout is opened each renewal cycle.
• Fixed config sync diff preview leaving behind unsaved Untitled files after confirmation.

---

​

v1.1.0 - 18 May 2026

​

Onboarding, docs, and account setup flow

Iris Code 1.1.0 turns the first-run experience into a complete product flow across the extension and the web account surfaces, with guided onboarding, embedded docs, and clearer setup follow-through.

• Added a guided first-run onboarding flow inside the extension sidebar, including skip, resume, restart, and a 15-step spotlight walkthrough across the live tabs.
• Added an in-flow docs surface inside Iris Code so setup help now lives in the extension instead of forcing users out to separate pages first.
• Added public and dashboard-nested getting-started flows covering install, first scan, sign-in, configuration, and enforcement setup.
• Added an account dashboard welcome banner and contextual driver.js tour to help new users land on billing, license, and quick-start actions faster.
• Improved onboarding state handling so returning users with existing config do not get dropped back into the first-run path unnecessarily.
• Added a free-user config nudge and clearer Pro gating cues so workspace scans, issue navigation, and setup boundaries are easier to understand.

---

​

v1.0.9 - 11 May 2026

​

Trae, Cursor, Windsurf and all VS Code forks

Sign-in now works correctly in Trae IDE and any other VS Code fork. The sidebar has also been rebuilt internally for better reliability.

• Fixed sign-in redirect failing in Trae IDE and other VS Code forks - the extension now auto-detects the correct URI scheme for any editor without needing manual updates.
• Fixed an inaccurate notification shown in the detached panel when a free user clicks a Pro-only feature.
• Rebuilt the sidebar and detached panel internals using React - the experience is identical but the foundation is now typed and maintainable.

---

​

v1.0.x - Apr 2026

​

Stability and polish (25 Apr)

A follow-up update focused on smoothing rough edges after the main 1.0 rollout.

• Improved default configuration behavior for day-to-day use.
• Fixed smaller workflow issues and tightened overall stability.
• Polished supporting parts of the product for a cleaner experience.

​

Enforcement Update (29 Apr)

Version 1.0.0 brings Iris Code together as a fuller code-health workflow inside VS Code, with stronger checks before code leaves your machine.

• Added pre-push enforcement so teams can catch failing code before it is pushed.
• Improved in-editor issue visibility with clearer diagnostics while you work.
• Expanded project-wide analysis and dependency review in the extension.
• Included a more complete release focused on enforcement, scanning, and review flows.

​

Build hook enforcement (30 Apr)

Iris Code can now run a health check before your project builds, not just before you push. Failing files block the build early, before the language toolchain runs.

• Added pre-build health check for Node projects via the npm prebuild lifecycle script - runs automatically before pnpm build, npm run build, and yarn build.
• Added Makefile-based pre-build check for Go and Python projects, wired as a prerequisite on the build or all target.
• Iris Code creates a Makefile with sensible defaults if none exists in Go or Python projects.
• Build hook status appears alongside the existing Git Hook section in the sidebar File tab.
• Both install and uninstall are safe: markers guard the injected block and original hook content is preserved on removal.

---

​

v0.2.0 - 13 Apr 2026

​

Version 0.2.0

Version 0.2.0 continued the early Iris Code rollout with another round of product polish and refinement.

• Improved the overall extension experience.
• Shipped another round of fixes and polish in the 0.x cycle.

---

​

v0.1.x - 6 Apr 2026

​

Panel and history improvements

This update expanded how results could be reviewed during longer coding sessions.

• Added a wider panel view for reviewing analysis results.
• Improved how scan history and progress were presented.

---

​

v0.1.x - 12 Mar 2026

​

Initial rollout

The first Iris Code release introduced the foundation for local code-health analysis inside VS Code.

• Launched the first version of the Iris Code extension experience.
• Introduced the early scoring and analysis workflow.