Iris Code Changelog: VS Code, JetBrains, and CLI Release Notes

​

v1.25.2 - 2026-08-31

​

Files that could not be read are no longer scored as though they were bad

• Fixed false parse errors on regular expressions containing brackets or braces, such as /\[([^\]]*)\]/, and on .jsx/.tsx files with a URL in visible markup. Twelve files in one project moved from a score of 0 to between 92 and 100.
• Fixed a related error where a self-closing JSX tag with an attribute, such as <Input value={x} />, caused the rest of the component to be misread.
• Changed how an unparseable file affects your results. It is now excluded from the workspace average and from the list of files below the minimum score, and is reported separately as a file that could not be analysed. A syntax error your compiler already catches no longer blocks the gate twice.
• Added gateMaxParseErrors for teams that want unparseable files to fail the gate. Unset by default. See .irisconfig.json.

​

React components are measured by their logic

• Changed function length in .jsx and .tsx to exclude JSX markup. Logic inside markup, such as an inline handler or a .filter().map() chain, still counts. Vue and Svelte have always worked this way, so this brings React into line with them.
• Unchanged file length and functions-per-file, which still count every line. A 400-line component is still reported as a long file.
• .tsx files score about 1 to 2 points higher as a result, measured across two projects. This corrects a measurement rather than reflecting a change in your code. If you use gateBaselineMode or follow the trend chart, re-lock your baseline after updating.
• Files with no JSX are measured exactly as before, verified across 422 files.

​

Smaller corrections

• Fixed storage keys being reported as hardcoded secrets. const KEY = "da-os-canvas" carried the same penalty as a live provider token. A value that a secret-named variable holds, such as CLIENT_SECRET, still reports.
• Fixed TODO and FIXME going undetected in block comments. This affected every language variant, and mattered most in React, where a block comment is the only comment form available inside markup.
• Fixed a localhost mention inside prose being reported as a hardcoded endpoint. Documentation explaining how to connect to a local database was flagged on every mention.
• Fixed sample code quoted inside a string being detected as a real function.

​

v1.25.1 - 2026-08-31

​

The documented MCP setup no longer names a folder

• Changed the documented setup to npx -y @iris-code/mcp with no folder, which is what makes a single registration correct for every project you open.
• Changed --root to be documented as a per-project pin rather than a default. --root . pins nothing: it resolves to the directory the server was started in, which is already the fallback.
• Fixed the server printing nothing at startup, which made a server that was waiting for its client indistinguishable from one that had failed. It now reports the folder it is analysing and where that came from. Run in a terminal by hand, it explains that it is a Model Context Protocol server and shows the configuration to paste.
• Root resolution itself is unchanged. See MCP server.

​

v1.25.0 - 2026-08-28

​

Your agent can ask what your project actually enforces

• Added six tools. Free: findings for a single file, the project’s resolved configuration, and safe fixes on a single file. Pro: folder and workspace scope, rule detail, gate status, and dependency risk. Pro tools stay listed and identify themselves as Pro rather than hiding.
• Added preview-first safe fixes. Applying requires a token from a previous preview, so a change set you have not seen cannot be written. Refusals are per finding with a reason: a hardcoded secret is never auto-fixed, and a debug print sharing its line with real code is left alone.
• Added findings carrying every rule with its real severity and a stable id, rather than the error-level list CI annotations are limited to. Oversized results drop the lowest severities first and report what was withheld.
• Added Tools | Iris Code | Set Up MCP Server in JetBrains IDEs, which copies a ready-to-paste configuration using the bundled binary and needs no Node.js installation.
• Analysis stays on your machine. Only dependency and advisory lookups reach the network, and those ask first.

​

Changed

• Changed the finding list used by CI annotations to exclude debug prints. That list produces one error-level annotation per entry with about ten visible per step, so a low-severity rule in it both misreported severity and could push a hardcoded-secret annotation out of view. Health scores are unchanged, and agents receive the complete list through MCP.

​

v1.24.0 - 2026-08-25

​

Your standards, in the file your agent reads

• Added iris rules and the editor command Iris Code: Write Project Rules for AI Agents, reachable from the command palette, the File tab, the welcome page, and in JetBrains from Find Action. Free.
• Added support for writing several files in one run. Claude Code reads only CLAUDE.md, while AGENTS.md is the file Codex, Cursor and Copilot read, so a team running two agents needs both. Each file receives the full rules rather than a pointer to another file, and the editor picker accepts more than one.
• Added --all to write every target, --refresh to update only the files a repository already has and create none, and --dry-run to print the result instead of writing it. Each file is written independently, so one file that cannot be updated is reported with its reason while the rest still change.
• Added markers around the generated block, so regenerating updates only Iris Code’s own section and never text you wrote. Running it again with an unchanged config reports the file is already up to date rather than producing a diff, and a file with a damaged marker is refused with an explanation rather than duplicated.
• Changed the rules to describe only what your project contains. A Java project is not told to avoid any, and the debug-output rule names System.out.println rather than listing every language’s equivalent.
• Changed how a single-language project is described: where your config raises that language’s limits, the rules state the effective numbers rather than the project defaults with a footnote. A rule that quotes a limit the gate does not enforce is worse than no rule.
• Fixed per-language overrides for Java and Rust being rejected by the config schema. Both languages have been analysed since 1.23.0, but the schema declared six language keys against the analyser’s eight, so a valid languages.java block was reported as invalid in every editor with schema support.

​

v1.23.1 - 2026-08-23

​

A scan covers the folder you selected

• Fixed workspace scans following symlinked files out of the selected folder. Partial scans compare resolved paths, and full scans skip links.

​

v1.23.0 - 2026-08-17

​

Java and Rust join the same engine

• Added Java analysis for .java source and .properties configuration. A .properties file is read as configuration rather than code: it is scanned for committed credentials, and its ports and log levels are not reported as unexplained numbers.
• Added Rust analysis, covering functions, modules, imports, complexity, secrets, suppressions, naming, scoring, gates, and duplicate detection.
• Added three language-specific checks: process execution in Java through Runtime.exec or ProcessBuilder, and in Rust both unwrap or expect calls and explicit panics.
• Added Java to the catch-all exception rule that C# already used, under one shared rule id. The same defect has the same fix in both languages, so one severity setting and one iris-ignore comment cover a codebase that uses both.
• Added test-aware exemptions for Rust. Rust puts its tests in the file under test, so the exemption is computed per #[cfg(test)] item rather than per file. A file-level exemption would spare the production half of the same file.
• Added Java unused-import reporting. The usage search reads Javadoc, so an import referenced only from a {@link} is left alone, because removing it would break javadoc.
• Added Maven and Gradle dependency and CVE audits, covering pom.xml, build.gradle, build.gradle.kts, and version catalogues, including ${property} placeholders and dependencyManagement. Neither tool commits a resolved dependency tree by default, so these scans cover declared dependencies and say so. See Dependents Table.
• Added Cargo dependency and CVE audits. Cargo.lock gives exact versions and the full transitive tree, with git and path dependencies excluded, because a public registry knows nothing about them.
• Added Java and Rust to the published accuracy benchmark, on 17 and 16 rules respectively. See Accuracy benchmark.
• Changed advisories published without a severity to appear rather than be dropped. Most RustSec advisories carry no score, so they were hidden entirely. They now show as unrated and are counted, and they never satisfy a --severity high gate, because an unrated advisory is one nobody has scored rather than one known to be minor.
• Fixed committed credentials in Java source and .properties files going undetected. Java has no const, let, or var, so the name-based check matched nothing and only credentials with a recognisable provider format were ever reported. A database password has no such format.
• Fixed constants that name a credential field being reported as the credential itself, such as PASSWORD_FIELD = "password".
• Fixed fixture credentials in Gradle test source sets being reported as production secrets. Gradle projects declare test source sets freely, and only src/test was recognised.
• Fixed a named constant being reported as a magic number in Java and Rust. Naming the number is the fix the rule asks for, so reporting it described the fix as the defect.
• Fixed a naming convention asking you to rename application.properties. Spring resolves that filename exactly, so the rename would have broken the application, and both the Quick Fix and the Pro batch rename offered to make it in one click.
• Fixed iris sbom reporting no dependencies for Java and Rust projects, and iris deps, iris cve, and iris sbom refusing pure Rust and pure Gradle projects while naming both manifest families in the error.
• Fixed Maven latest-version lookups in both directions. An upgrade is no longer offered to a date-based release from 2003, which sorts above every modern version, and a -jre or -android classifier is no longer read as a prerelease, which had left some packages with no known latest version at all.
• Fixed a Cargo dependency whose name is not a valid crate name being matched against an unrelated crate that occupies the same index path. It is reported as not checked.
• Fixed the Dependencies table flickering when a scan finishes. It rebuilt every row in order to re-sort them, which also closed any advisory panel you had expanded, and repeated on every filter click and search keystroke.
• Fixed large, heavily documented Java files analysing slowly. Analysis now scales in proportion to file size.

​

v1.22.0 - 2026-08-13

​

Ruby and .NET dependencies are audited like every other ecosystem

• Added RubyGems support: Gemfile.lock for exact transitive versions, with Gemfile and .gemspec as fallbacks. A gem pinned to an exact version is checked; a range is reported as not checked, because an advisory verdict against a range is either a false clean or a false alarm.
• Added NuGet support: .csproj PackageReference entries aggregated across every project in a solution, plus Central Package Management (Directory.Packages.props), packages.lock.json, and legacy packages.config. Two projects pinning different versions of one package are reported as a conflict rather than silently resolved to one of them.
• Added prerelease filtering for NuGet, so a 9.0.0-preview is never offered as an upgrade from a stable release.
• Added Ruby to the published accuracy benchmark on every shared rule, not only its three Ruby-specific ones. See Accuracy benchmark.
• Changed the dependency-lookup disclosure to name RubyGems.org and NuGet.org, the two new registries contacted. Only package names and versions are sent, as before.
• Fixed native gems being reported as vulnerable when already patched. A gem built for your platform is locked as 1.19.4-x64-mingw-ucrt, and that platform suffix was read as part of the version, sorting it below the plain release - so advisories already fixed in the installed version still matched, and up-to-date gems sat permanently in “outdated”. This affected most Ruby projects, since Rails pulls in several native gems.
• Fixed a gem RubyGems cannot resolve - yanked, renamed, private, or mistyped - appearing as outdated with an upgrade target of “unknown” instead of being reported as not checked.
• Fixed SBOM components with no resolvable version carrying a package URL whose version was placeholder text. The form was structurally valid, so a vulnerability scanner reading the SBOM failed to match those components without reporting a problem. They now carry a version-less package URL and state why.
• Fixed “Update all outdated” offering a command that covered only part of what it listed in a project using more than one package manager.
• Fixed the CLI reporting “Running as Free” when the licence server was unreachable but a cached Pro licence was still valid, and emitting the CI notice about skipped Pro steps on runs where nothing was skipped.

​

v1.21.0 - 2026-08-12

​

C# joins the same engine

• Added C# analysis for .cs and .csproj, covering methods and constructors, nesting and complexity, using namespaces and PackageReference entries, security idioms, secrets in fields, properties, locals and project XML, test conventions, suppressions, file naming, scoring, and gates.
• Added four C#-specific checks: async void outside event handlers, where a thrown exception cannot be observed by the caller; catch-all exception handlers, with when (...) filters exempt; LINQ chains of five or more operators in one statement; and types carrying too many responsibilities.
• Added .NET build hooks. A project with a .csproj or .sln gets an iris-check Makefile target wired as a prerequisite of build or all, defaulting to dotnet build.
• Added a csharp key to the languages block in .irisconfig.json, and severity overrides plus iris-ignore support for the four new rule ids.
• Fixed a verbatim Windows path breaking the file it appeared in. @"C:\logs\" was read as an unterminated string, so every brace after it counted at the wrong depth and the file was reported as a parse error with no findings at all. Raw strings failed the same way in the other direction. Both are now understood, along with the interpolated and doubled-quote forms.
• Fixed .NET test projects being treated as production code. C# has no _test filename separator and its test directory is <Project>.Tests, so fixture credentials and localhost URLs in tests were reported as real findings.
• Fixed project files reporting their language version and warning level as unnamed numbers, and C# attributes, const/readonly declarations and enum members now count as naming their own values.
• Fixed constructors with a : base(...) or : this(...) initialiser being skipped entirely, so no length, parameter, or nesting check applied to them, and a positional record being counted as both a type and a method.
• Fixed the C# debug-output Code Lens appearing in JetBrains only, and the File tab, Problems entries and inline diagnostic using the JavaScript wording for a C# file.
• Fixed the Iris Code panel opening blank in IntelliJ 2026.2 and other current JetBrains IDEs. The IDE moved its embedded browser out of the platform into a bundled component that Iris Code did not ask for, so the panel and the table tabs had nothing to draw with. Where an IDE cannot provide an embedded browser at all - some platforms and architectures do not ship one - the panel now offers to open the same interface in your own browser, and everything you click there still acts on the IDE. Analysis, diagnostics and enforcement were never affected.
• Fixed a type written entirely on one line - class C { public void M() { } } - reporting no methods, which exempted its members from the length, parameter-count and nesting checks.
• Fixed the Problems list showing raw rule ids as group headings for the C# checks and, since 1.20.0, the Ruby ones.

​

v1.20.0 - 2026-08-10

​

Ruby joins the same engine

• Added Ruby analysis covering .rb and the Ruby DSL extensions, plus the extensionless files Ruby projects actually use: Gemfile, Rakefile, Vagrantfile, Capfile, the Fastlane set, and .irbrc. A file’s language is not always decidable from its extension, so these are matched by name.
• Added ERB template support. Ruby inside <% %> and <%= %> tags is analysed while the surrounding HTML is excluded from scoring and duplicate matching, and findings report the line number in the template file itself.
• Added three Ruby-specific checks: method_missing defined without respond_to_missing?, god classes, and Rails parameters reaching a model without require and permit.
• Added Ruby build hooks. A project with a Gemfile gets an iris-check Makefile target wired as a prerequisite of build or all.
• Changed file renaming to warn on Ruby as it already did on Python. A rename does not rewrite require_relative paths or the constant names Rails derives from a filename.
• Fixed a Ruby guard clause such as return 0 if value.nil? being read as a missing end, which scored the file 0 and skipped its analysis.
• Fixed analysis speed on large files containing many findings. Several checks repeated whole-file work per finding, so cost grew with the square of the file size; a large Rails controller that took over a minute now completes in a fraction of a second. Findings are unchanged.

​

v1.19.0 - 2026-08-08

​

Gate results where the team sees them

• Added Slack notifications controlled by the IRIS_SLACK_WEBHOOK CI secret. Messages contain file paths, scores, rule names and counts, but never source, finding text or secret values.
• Added the free iris slack setup, iris slack test and iris slack manifest commands for guided setup, delivery testing and creation of a pre-configured Slack app.
• Added --slack-on always to report passing runs and --slack-dry-run to inspect the payload without posting.
• Changed the Config Studio on narrow screens. Preview config opens the live .irisconfig.json preview in a centred, scrollable modal, and account navigation opens from an animated menu instead of occupying the bottom of each page.
• Fixed file-naming violations appearing twice in the VS Code Problems panel.

​

v1.18.0 - 2026-08-05

​

Components are code too

• Added Vue and Svelte single-file component analysis everywhere Iris Code runs - the editor, the CLI, hooks, and CI. Secrets, security smells, duplicate detection, suppressions, health scores, change review, and workspace scans all cover them, and root-level script blocks only: a <script> inside a template or an {#if} block is markup, not code.
• Added role-based file naming (Free): fileNaming.overrides takes an ordered list of path globs, so components/** can require PascalCase while composables/** requires camelCase. Both conventions could not be expressed before, because a lang="ts" component and an ordinary .ts module resolve to the same language. The last matching rule wins, workspace ignore globs stay absolute, and a config without overrides behaves exactly as before. See File naming.
• Added inline file-naming diagnostics in JetBrains IDEs, matching VS Code.
• Added SvelteKit awareness: +page.svelte, +layout.svelte, +server.ts and their siblings are exempt from naming conventions, because the framework resolves them by exact filename.
• Fixed the no-exports check firing on essentially every Vue and Svelte component - a <script setup> block has no export by design.
• Fixed large-file analysis speed. Analysis time grew with the square of a file’s line count, so a very long file - especially one with many blank lines, worse with Windows line endings - could stall the editor or a CI run for minutes. A 200,000-line file went from over two minutes to a fraction of a second, with no change to findings.
• Fixed an unusable file-naming glob stopping the scan. The offending pattern is now named with its exact location, the rest of the rule keeps working, and the pattern can never quietly excuse a file from its convention.
• Changed iris report and iris sbom to require --output to stay inside the current directory, matching iris check, iris deps, and iris cve.
• Fixed the Config Studio preview showing a config shape Iris cannot read. The panel described its own nested format (thresholds, detections, diagnostics, severity), so copying the preview instead of syncing produced a file where every threshold, detection toggle, inline-diagnostic setting, and severity override was silently ignored - and because presetId was honoured, it looked like it had worked. The preview, the Copy button, and Sync are now the same text: the exact file that gets written. Configs you synced were always correct; only copied ones were affected.

​

v1.17.0 - 2026-07-30

​

One engine, every editor

• Added Iris Code for JetBrains IDEs - IntelliJ IDEA, WebStorm, PyCharm, GoLand, PhpStorm, Rider, RubyMine, CLion, and Android Studio. Inline diagnostics, iris-ignore quick fixes, health scores on hover, code lenses, filename-convention renames, and the full Iris Code panel under Tools > Iris Code. Install the LSP4IJ plugin first and restart the IDE fully after installing.
• Added Open VSX distribution, so Cursor, Windsurf, VSCodium, and other Open VSX editors install the byte-identical extension and receive updates automatically instead of a manual .vsix.
• Added 25 searchable Iris Code commands in JetBrains: press Ctrl+Shift+A (Cmd+Shift+A), type iris, and run workspace scans, Review My Changes, trends, hooks, dependencies, history secrets, or report export. Any of them can be bound to a shortcut under Settings > Keymap.
• Added sign in and sign out from JetBrains under Tools > Iris Code. Analysis and the panel refresh in place, so Pro features activate without restarting the IDE.
• Added dashboard config sync for JetBrains: build a config in the Config Studio, choose Sync to JetBrains, and paste the one-time code into Tools > Iris Code > Sync Config from Dashboard. You review a diff before anything is written.
• Added GitHub Actions workflow and CI snippet generators to JetBrains, matching the VS Code commands.
• Added shared push-blocked history, so the Enforcement card shows the same blocked-push counts, Pro activation date, and score delta in either editor.
• Changed hover documentation for .irisconfig.json now comes from the schema bundled with your installed version. Hovering any setting explains what it does, works offline and behind a proxy, and always matches the version of Iris Code you are running.
• Fixed a Pro config could briefly be reported as Free in JetBrains while the licence was still being validated, which also scored files against Free thresholds until it settled.
• Fixed Gate Preview and the trend-history table are Free features but were refused on the Free plan in JetBrains.
• Fixed the GitHub Actions and CI snippet generators now require Pro in JetBrains, matching VS Code.
• Fixed .irisconfig.json is recognised as comment-tolerant JSON in JetBrains. If your IDE still reports “JSON standard does not allow comments”, it holds a user-level override - see Installation.

​

v1.16.0 - 2026-07-26

• Added Quality Signals: recurring workspace issues ranked by density and impact, with raw counts and percentages linked to the corresponding finding surfaces. Code Health remains the single headline score.
• Added Free workspace-wide and per-language file naming checks with four conventions, framework-aware exemptions, custom ignore globs, rename suggestions, baseline-aware new-file rollout, Explorer/Problems decorations, an open-file rename hint, and a 50-result disclosure for first scans without a baseline.
• Added the ai-assisted preset for high-volume AI-assisted review. It tightens structural, security, suppression, and duplication defaults without choosing a team-specific naming style.
• Added the Pro gate field gateMaxNamingViolations, enforced consistently by the CLI, hooks, and CI.
• Changed Free config handling inside languages: Iris keeps fileNaming and squiggles each ignored Pro-only sibling instead of discarding the whole block.
• Fixed the bundled config schema now recognizes trendRegressionThreshold and gateBaselineMode.

​

v1.15.0 - 20 Jul 2026

​

Accuracy you can check, and rate

• Added a thumbs up / down control on every finding in the sidebar and Issues view. Feedback is count-only - the rule, the language, and your verdict, never source code, file paths, or line contents - and respects your account analytics setting. Rate once and change your mind anytime; the control remembers your choice.
• Added an accuracy benchmark: every rule is measured against a labelled corpus for per-rule, per-language precision and recall, with a checked-in baseline that fails the build on any regression. A public methodology page shows the enforcement-rule figures per rule - no single misleading global percentage.
• Fixed false positives found by the benchmark: any in a comment or string, print(...) in a Python docstring, CommonJS module.exports files reported as export-less, arithmetic like (a + b) * c mistaken for a risky regular expression, and the eval( token inside a string literal are no longer flagged. Each fix is guarded by a permanent test case.

​

v1.14.0 - 19 Jul 2026

​

One config, honest thresholds for every language in the repo

• Added per-language config overrides (Pro): per-file thresholds, healthScoreWeights, severityOverrides, and the per-file gate caps can differ per language; anything unstated falls back to the base config. Scan-total gates and toggles are rejected inside a block with a clear warning, and unknown language keys warn instead of breaking older installs. The file tab shows the applied override next to the config source, and iris gate prints the limit that actually governed each failing file.
• Added six more secret formats: Stripe live/restricted keys (sk_live_/rk_live_), GitHub fine-grained PATs, GitLab PATs, npm access tokens, SendGrid API keys, and PEM private-key headers - masked in output, as always.
• Added a bounded timeout to the installed pre-push hook: a hung analysis is stopped after 120 seconds (IRIS_HOOK_TIMEOUT to adjust) instead of blocking git push indefinitely. The push still fails closed with a bypass hint, so enforcement is never silently skipped. Reinstall the hook to pick this up.
• Fixed function-length measurement for functions with destructured parameters - which includes essentially every React component. Component-heavy files may score lower after updating: that is the analyser finally seeing them, not a scoring change.
• Fixed --allow-network so it reliably re-enables dependency lookups after --revoke-network, and hardened the remaining CLI commands (report, sbom, config, auth, hook, todos) against a Windows-only crash on exit.

​

v1.13.0 - 15 Jul 2026

​

Review my changes, and secrets that history still remembers

• Added Review my changes (free): when Git reports local changes, a count-aware strip appears above the sidebar tabs. Running it checks every supported staged, unstaged, and untracked file and opens a dedicated review - blockers first, severity filters, search, changed-file health, and click-to-open findings. The Issues and TODOs tabs show the review’s evidence on Free.
• Added the git history secrets scan (Pro): walks past commits - committed .env files included - through the same two-layer secrets detection. Findings are deduplicated per distinct secret, always masked, and show first/last sighting, commit and file counts, and whether the secret is still in HEAD. Merge-commit content is covered; depth, size-cap, and shallow-clone limits are always disclosed. Runs entirely against local git.
• Added iris secrets --history [--depth N] (Pro): the same scan in the terminal, with JSON output for automation; exits 1 when any secret is found in the scanned range.
• Changed change reviews to stay honest about scope: they never create a workspace trend snapshot and never report unused dependencies, because that conclusion requires a full-project scan. The changed-file count only counts files the review will actually analyse.
• Changed git-aware discovery to include untracked files not excluded by .gitignore, and to scope to the workspace when it sits inside a larger repository.
• Fixed predictability in unusual environments: repositories with very large untracked sets no longer fail discovery, a missing Git installation is reported as exactly that, and the history panel shows distinct loading, error, and empty states.
• Fixed CLI exit-code reliability on Windows so free users and unlicensed CI runs stay green as documented.

​

v1.12.0 - 13 Jul 2026

​

Duplicate code detection: find the copy-paste, diff it, gate on it

• Added duplicate code detection (free): source is normalised before comparison (identifiers, literals, whitespace, and comments ignored; keywords kept verbatim), so two stretches of code that differ only in naming or values still match. Within-file blocks appear as a Duplicate blocks smell on the File tab and deduct healthScoreWeights.duplicateCode points (default 3); cross-file blocks power a new Duplication section on the Workspace and Folder tabs with block count, the duplication percentage of total code lines, and the largest blocks with click-through to both locations.
• Added noise guards so results stay reviewable: import/require headers never match, uniform data literals (country lists, enum tables) are excluded, a block repeated many times reports as a minimal set of pairs instead of every combination, JSX-heavy files need twice the token evidence, and oversized or minified-looking files are excluded and disclosed as skipped.
• Added a full Duplicates table - filterable by cross-file or within-file, searchable, both locations clickable - that tracks live edits: line ranges update as you type and resolved pairs drop out without a rescan.
• Added an Open diff action on every duplicate (Pro), titled with both locations GitHub-style. Cross-file pairs open the two full files side by side, editable with normal saves; same-file pairs open the two blocks as editable extracts that write back to the real file. Iris Code toasts the moment the duplication is resolved.
• Added gateMaxDuplicateBlocks (Pro): caps the total duplicate blocks across the scan, enforced by iris check, iris gate, the git hook, and the build hook - a block spanning two files counts once. New config keys: enableDuplicateDetection (default on), duplicateBlockMinTokens (default 40), the duplicateCode scoring weight, and an optional inlineDiagnostics.duplicateCode squiggle toggle.
• Added duplicate-code as a suppressible rule id: // iris-ignore: duplicate-code -- <reason>.
• Added duplicateBlocks arrays to iris check --format json file entries (additive; schema version unchanged) and a “Max duplicate blocks” rule row to iris gate.
• Fixed .mjs and .cjs files being skipped entirely - they are now analysed everywhere .js is: workspace scans, folder scans, and CLI directory checks.

​

v1.11.0 - 9 Jul 2026

​

Inline suppressions with required reasons, and dependency lookups move to OSV.dev

• Added inline suppressions (free): // iris-ignore: <ruleId>[, <ruleId>...] -- <reason> suppresses matching findings on the next line, and // iris-ignore-file: ... covers the whole file (# works for Python). The reason is required - a directive missing it, or naming an unknown rule, suppresses nothing and is reported as a Bare Ignore finding with its own score penalty (healthScoreWeights.bareSuppression, default 2). Eighteen rule ids are suppressible; suppressed findings stop costing health-score points but stay counted and visible. See Inline Suppressions.
• Added suppression surfaces in the sidebar: a Suppressed section in the File tab, and a Suppressions section in the Workspace and Folder tabs with per-file counts and a See all button that opens a full filterable table with click-to-open at the exact line.
• Added --show-suppressed to iris check and iris gate: lists each suppressed finding with its reason. Suppressed counts always appear in the output, and JSON reports gain a per-file suppressed array (schema version unchanged).
• Added two Pro team controls: gateMaxSuppressions (per-file cap, enforced by iris gate, the git hook, and the build hook) and ignoreSuppressions: true (kill-switch that makes every directive inert so suppressed findings count as live).
• Changed the Dependents Table, iris deps, and iris cve to source vulnerability data from the OSV.dev database. No token or rate-limit setup is needed: the in-panel GitHub token button is gone, the GITHUB_TOKEN environment variable is no longer used, and iris auth login no longer prompts for a GitHub PAT. Only the package name, ecosystem, and version are sent - never code, file paths, or project names - and the consent flow is unchanged. Old advisory caches invalidate automatically.
• Added a confidence label on every advisory (fix-available, direct, transitive, or manual-review) plus the fixed-in version where one exists, in both the panel and CLI output.
• Improved advisory trustworthiness: records without a verifiable id or severity are never shown - they are dropped and the skip count is disclosed in the panel footer and CLI output - and dependencies whose lookup errored are marked “not checked” instead of being assumed clean.
• Fixed debug prints quoted inside comments being flagged as live debug prints in TS/JS, Go, and Python.
• Fixed iris deps and iris cve argument errors no longer risk a crash on exit on Windows.

​

v1.10.0 - 5 Jul 2026

​

CVE severity gate, CycloneDX SBOM export, and lockfile-aware dependency audits

• Added iris cve [path] (Pro): runs the same dependency and CVE scan as iris deps (sharing its 24-hour cache and network consent), but exits 1 only when an advisory at or above the --severity threshold (low, medium, high, critical; default high) is found. Built for CI gates: block on critical or high advisories without failing the pipeline on low-severity noise.
• Added iris sbom [path] (Pro): exports a CycloneDX 1.5 software bill of materials across npm, Go, and Python manifests. Fully offline: no network requests, no consent prompt. Components carry the name, exact installed version, purl, and a required/optional scope (direct vs dev). If a cached iris deps scan exists, known vulnerabilities fold in as CycloneDX vulnerabilities entries cross-referenced by purl. Writes iris-sbom.json by default; --stdout prints instead.
• Improved iris deps: installed versions are now resolved from lockfiles (package-lock.json v1-v3, pnpm-lock.yaml, yarn.lock classic and Berry, poetry.lock, Pipfile.lock) instead of manifest ranges, and advisories are filtered to the installed version.
• Improved monorepo support in the dependency scanner: npm and yarn workspaces plus pnpm-workspace.yaml members are discovered and deduplicated, and internal workspace: / file: / link: dependencies are excluded.
• Added network consent for dependency lookups: the first lookup asks permission and discloses exactly what is sent (package names and versions, nothing else), persisted in ~/.iris/preferences.json. --revoke-network disables lookups; --allow-network re-enables them. Cached results now print their age.
• Added a CVE summary badge (Pro) to the Dependencies section of the Workspace tab: a green “no known CVEs” pill, or the vulnerable package count plus the highest severity from the last cached scan. Cache-only: the badge never triggers a network request itself.
• Added a scope indicator to the Issues and TODOs tabs: each tab now labels which scan it is showing (for example, “Showing: folder · src”) with a one-click Show workspace switch.

​

v1.9.0 - 2 Jul 2026

​

Security smell enforcement: gate on it, scan for it from the CLI

• Added gateMaxSecuritySmells to .irisconfig.json - the gate fails when the total number of security smells (eval usage, SQL injection risk, insecure RNG, disabled TLS, weak hashing, and the rest of the nine 1.8.0 patterns) across the workspace exceeds this value. Enforced by the CLI, the git hook, and the build hook alongside gateMaxSecrets, gateMaxComplexity, gateMaxFileLength, and gateMaxSmellsPerFile.
• Added iris security [path] - a free CLI command that scans JS/TS/Go/Python for the same nine security smell categories as the sidebar, independent of a full iris check run. Supports --format pretty|json and --output; exits 1 if any smell is found.
• Added a Security Posture section to the Workspace and Folder tabs in the VS Code sidebar - a collapsible count-by-category breakdown of security smells found in the current scan.
• Added the gateMaxSecuritySmells field to the Config Studio’s Gate limits editor for Pro users.

​

v1.8.0 - 30 Jun 2026

​

Security smell detection: nine patterns, every file, free

• Added nine security smell detectors across TypeScript, JavaScript, Go, and Python:
  • Eval / exec calls - dynamic code execution via eval(), exec(), or similar constructs
  • SQL built by string concatenation - query strings assembled with + or template literals instead of parameterised queries
  • Insecure random number generation - Math.random(), rand.Intn(), random.random(), and other non-cryptographic RNG in a security-sensitive context
  • ReDoS-prone regexes - nested quantifiers in patterns that can cause catastrophic backtracking
  • Disabled TLS verification - rejectUnauthorized: false, InsecureSkipVerify: true, or verify=False
  • Weak hashing - MD5 or SHA-1 in contexts that suggest security use (passwords, tokens, signatures)
  • Open redirects - res.redirect() or equivalent called with unvalidated user-controlled input
  • Debug flags in production - debug: true flag objects left in non-test code
  • Hardcoded localhost URLs - http://localhost or http://127.0.0.1 in production code paths (skipped in test files)
• Added enableSecuritySmells toggle in .irisconfig.json and VS Code settings (iris.enableSecuritySmells, default on). Turning it off suppresses all nine patterns.
• Added inline diagnostics support: when enableInlineDiagnostics is on, security smell findings appear as Warning squiggles in the editor and entries in the Problems panel. Controlled per-category via inlineDiagnostics.securitySmells.
• Added custom scoring weights for each of the nine patterns for Pro users - adjust the health-score penalty per pattern in healthScoreWeights (keys: evalUsage, sqlConcatenation, insecureRandom, unsafeRegex, hardcodedLocalhost, disabledTlsVerification, debugFlagsEnabled, weakHashing, openRedirect).

​

v1.7.0 - 25 Jun 2026

​

Trend tracking, baseline enforcement, and dashboard redesign

• Added trend tracking: Iris Code automatically snapshots your workspace health score on every scan, stored in .iris-snapshots/ (gitignored, 2 MB cap, same-day dedup, corrupt-entry hardening).
• Added Trends panel: compare any two snapshots with a sortable, filterable per-file score table. Click any row to jump directly to the file. Free tier: rolling 2-snapshot window. Pro: unlimited history.
• Added inline trend summary in the Workspace tab showing regressed files, recovered files, and net score change between the two most recent snapshots.
• Added baseline mode: lock a baseline with iris.lockTrendBaseline. Iris Code writes .iris-baseline.json to the workspace root (committable, diffable). Set gateBaselineMode: true and the gate only blocks new regressions above the accepted baseline.
• Added iris.clearTrendHistory command to remove all snapshots and the baseline file.
• Added trial plan type: the extension now surfaces trial as a distinct plan with an Iris Code Pro Trial badge and trial-end date. Trial users get full Pro access.

​

v1.6.1 - 17 Jun 2026

​

Python analysis fixes: multi-line signatures and test-file secrets

• Fixed: a Python def/class/if/for/with header that wraps across multiple lines (e.g. a long Black-formatted signature) was being flagged as a syntax error, scoring the file 0 and skipping all analysis. These files now analyse normally.
• Fixed: the suspicious-name secret heuristic no longer fires in test files (test_*.py, *_test.go, *.test.ts, tests/, __tests__/, conftest.py, and similar), so fixture credentials like password="secret123" no longer reduce the score. Real provider token formats (AWS, Stripe, GitHub, and more) are still detected everywhere, including tests.

​

v1.6.0 - 16 Jun 2026

​

CI enforcement: GitHub Actions, inline PR annotations, and multi-CI snippets

• Added --format github to iris check and iris gate: emits GitHub Actions workflow commands so failing rules render as inline annotations on the pull request diff, and writes a pass/fail summary table to the run’s job summary.
• Added the Iris Code: Add GitHub Actions Workflow command (Pro): generates a ready-to-commit .github/workflows/iris.yml in your repo, pre-filled with your configured threshold.
• Added the Iris Code: Add CI Pipeline Snippet command (Pro): generates an Iris Code step for GitLab CI, Bitbucket Pipelines, an npm/pnpm/yarn script, or a generic shell script.
• Added a versioned JSON schema: all --format json output now carries a schemaVersion field (currently 1) so scripts can depend on the payload shape.
• Changed CI behaviour when no licence is present: Pro-only steps now skip and exit 0 instead of failing the build, with a non-blocking warning annotation inside GitHub runners, so a missing token does not turn the pipeline red with noise.
• Added an iris-alpine-amd64 binary for musl-based (Alpine) containers. The npm install -g @iris-code/cli route was already musl-safe and works unchanged.
• Published @iris-code/cli 1.1.0 with the new --format github support, and bumped the example workflows to actions/checkout@v5 and actions/setup-node@v5 (Node 24).

​

v1.5.0 - 10 Jun 2026

​

Analytics batching, push-blocked counter, and reliability improvements

• Added analytics batching: the extension buffers usage events in memory and flushes every 60 seconds. push_blocked events flush immediately. The buffer survives extension crashes via crash-safe persistence to globalState.
• Added exponential backoff on consecutive analytics flush failures, with a clean flush on extension deactivate so no events are dropped on VS Code quit.
• Added CLI analytics: iris check, iris gate, and iris secrets runs now emit a fire-and-forget event so hook-triggered runs appear in the Iris Code dashboard alongside extension activity.
• Added push-blocked counter: the Pro sidebar now shows monthly pushes blocked, total pushes blocked, and the health score delta since Pro was activated. Resets the monthly count automatically on month rollover.
• Improved reliability and hardening across the extension, backend, and web surfaces.

​

v1.4.2 - 5 Jun 2026

​

Documentation and CLI reference updates

• Improved command reference documentation for the full CLI suite with clearer descriptions and examples.
• Updated landing site copy to reflect the published @iris-code/cli npm package.

​

v1.4.1 - 4 Jun 2026

​

Welcome page improvements

• Refreshed the VS Code welcome page with a new feature section layout and updated quick-start links.

​

v1.4.0 - 3 Jun 2026

​

Full CLI command suite and npm package

• Added iris auth: sign in via browser or licence token, store credentials in ~/.iris/credentials (chmod 600). Subcommands: iris auth login, iris auth logout, and iris auth status. Credentials are read from the IRIS_LICENCE_TOKEN environment variable first, then the credentials file.
• Added iris secrets: free hardcoded secret scanner across JS/TS/Go/Python. Two-layer detection - suspicious variable names and known token formats. Exits 1 if any findings. No licence required.
• Added iris deps: audit all dependencies (package.json, go.mod, requirements.txt) for outdated versions and CVEs via the GitHub Advisory API. Results are cached for 24 hours. Store a GitHub PAT via iris auth login for higher rate limits.
• Added iris todos: aggregate all TODO/FIXME/HACK comments across your codebase. Pro feature.
• Added iris gate: run the full enforcement gate and show each configured rule’s threshold vs actual value with per-rule PASS/FAIL. Pro feature.
• Added iris report: generate a standalone dark-themed HTML scan report. Free. Defaults to iris-report.html in the current directory.
• Added iris hook: manage pre-push and pre-build hooks from the terminal without VS Code. iris hook git|build install|uninstall|status. Install/uninstall is Pro; status is free.
• Added iris config: iris config init generates a .irisconfig.json with interactive preset selection. iris config validate reports any problems in an existing config.
• Updated iris check: file scans remain free. Directory scans, --staged, and --changed now require Pro - consistent with workspace analysis in the extension.
• Published @iris-code/cli to npm with Linux and Windows self-contained binaries on each GitHub Release.
• Added GitHub Actions docs page at iriscode.co/docs/enforcement/github-actions covering the full CI workflow, gate variant, exit codes, and threshold configuration.
• Improved hook install messages in the extension to inform users to run iris auth login or set IRIS_LICENCE_TOKEN so the hook can validate at push or build time.

​

v1.3.0 - 28 May 2026

​

Gate Preview, preset cycling, and custom scoring weights

• Added Gate Preview: open it from the bottom of the File tab. It runs a full workspace scan and shows pass/fail counts for each of the five preset thresholds (legacy, balanced, typescript, strict, security) with proportion bars, a threshold card, and a recommendation for the next enforcement step. Always read-only - no files are blocked and no config is written.
• Added preset cycling: use prev/next arrows or click any chip in the preset strip to jump between presets. The focused preset shows a full drilldown and an Apply button so you can lock in a threshold in one click without leaving the surface.
• Added per-file drilldown for Pro users: expand any preset row to see the exact files that would be blocked, their health scores, and the warning pills driving the failure.
• Added custom health score weights for Pro users: set healthScoreWeights in .irisconfig.json to change how many points each finding type deducts from the base 100. Supported keys: hardcodedSecret, errorWarning, warningWarning, anyUsage, tsIgnore, consoleLog, deepNesting, longParamList, unusedVar, unusedFunction.
• Added four gate enforcement config fields for Pro users: gateMaxSecrets, gateMaxComplexity, gateMaxFileLength, and gateMaxSmellsPerFile. Set these in .irisconfig.json and the CLI enforces them on every push alongside minHealthScore.
• Improved licence reliability: server errors (5xx) and network timeouts now apply an offline grace period instead of revoking Pro. Activation skips the network call if your licence was validated within the last 24 hours.

​

v1.2.1 - 27 May 2026

​

Collapsible Pro card

• Added a collapsible Pro-status card in the sidebar and detached panel. Once signed in, the card collapses to a compact chip so it stays out of the way while still showing plan status at a glance.

​

v1.2.0 - 20 May 2026

​

Config presets, dashboard sync, and bank transfer billing

• Added preset configs: set presetId in .irisconfig.json to snap your whole team to a known baseline (strict, balanced, legacy, security, or typescript). Preset configs are free for all users.
• Added config enforcement for Free users: if a free user edits preset threshold values locally, those edits are ignored and marked with a yellow warning in the editor pointing to the preset as the source of truth.
• Pro users can start from any preset and override individual values - the preset acts as a baseline, not a lock.
• Added a Config page in the account dashboard for generating and customising Iris Code configs with a live preview.
• Added dashboard-to-VS Code sync: generate a config on the dashboard, click Sync to VS Code, review a diff preview in the editor, and confirm the write - no copy-pasting.
• Added Paystack bank transfer checkout for Nigerian users: choose a one-time transfer checkout from the billing page, pay to the transaction-specific account shown, and Pro activates on confirmation. A fresh checkout is opened each renewal cycle.
• Fixed config sync diff preview leaving behind unsaved Untitled files after confirmation.

​

v1.1.0 - 18 May 2026

​

Onboarding, docs, and account setup flow

• Added a guided first-run onboarding flow inside the extension sidebar, including skip, resume, restart, and a 15-step spotlight walkthrough across the live tabs.
• Added an in-flow docs surface inside Iris Code so setup help now lives in the extension instead of forcing users out to separate pages first.
• Added public and dashboard-nested getting-started flows covering install, first scan, sign-in, configuration, and enforcement setup.
• Added an account dashboard welcome banner and contextual driver.js tour to help new users land on billing, license, and quick-start actions faster.
• Improved onboarding state handling so returning users with existing config do not get dropped back into the first-run path unnecessarily.
• Added a free-user config nudge and clearer Pro gating cues so workspace scans, issue navigation, and setup boundaries are easier to understand.

​

v1.0.9 - 11 May 2026

​

Trae, Cursor, Windsurf and all VS Code forks

• Fixed sign-in redirect failing in Trae IDE and other VS Code forks - the extension now auto-detects the correct URI scheme for any editor without needing manual updates.
• Fixed an inaccurate notification shown in the detached panel when a free user clicks a Pro-only feature.
• Rebuilt the sidebar and detached panel internals using React - the experience is identical but the foundation is now typed and maintainable.

​

v1.0.x - Apr 2026

​

Stability and polish (25 Apr)

• Improved default configuration behavior for day-to-day use.
• Fixed smaller workflow issues and tightened overall stability.
• Polished supporting parts of the product for a cleaner experience.

​

Enforcement Update (29 Apr)

• Added pre-push enforcement so teams can catch failing code before it is pushed.
• Improved in-editor issue visibility with clearer diagnostics while you work.
• Expanded project-wide analysis and dependency review in the extension.
• Included a more complete release focused on enforcement, scanning, and review flows.

​

Build hook enforcement (30 Apr)

• Added pre-build health check for Node projects via the npm prebuild lifecycle script - runs automatically before pnpm build, npm run build, and yarn build.
• Added Makefile-based pre-build check for Go and Python projects, wired as a prerequisite on the build or all target.
• Iris Code creates a Makefile with sensible defaults if none exists in Go or Python projects.
• Build hook status appears alongside the existing Git Hook section in the sidebar File tab.
• Both install and uninstall are safe: markers guard the injected block and original hook content is preserved on removal.

​

v0.2.0 - 13 Apr 2026

​

Version 0.2.0

• Improved the overall extension experience.
• Shipped another round of fixes and polish in the 0.x cycle.

​

v0.1.x - 6 Apr 2026

​

Panel and history improvements

• Added a wider panel view for reviewing analysis results.
• Improved how scan history and progress were presented.

​

v0.1.x - 12 Mar 2026

​

Initial rollout

• Launched the first version of the Iris Code extension experience.
• Introduced the early scoring and analysis workflow.