> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iriscode.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Iris Code Changelog: VS Code, JetBrains, and CLI Release Notes

> Full release notes for the Iris Code VS Code extension, the JetBrains plugin, and the @iris-code/cli npm package. Updates ship automatically through the VS Code Marketplace, Open VSX, and the JetBrains Marketplace.

These are the release notes for the Iris Code VS Code extension, the JetBrains plugin, and the `@iris-code/cli` npm package. Updates ship automatically through the VS Code Marketplace, Open VSX, and the JetBrains Marketplace - you do not need to reinstall to receive new versions.

***

## v1.22.0 - 2026-08-13

<Note>**feature** - RubyGems and NuGet dependency audits</Note>

### Ruby and .NET dependencies are audited like every other ecosystem

The Dependents Table, `iris deps`, `iris cve`, and `iris sbom` now read Ruby and .NET manifests alongside npm, Go, and Python. `Gemfile.lock` gives the full resolved tree, so transitive gems are covered; NuGet without `packages.lock.json` sees the packages a project declares. Where a version cannot be resolved, the package is reported as **not checked** rather than assumed clean. See [Dependents Table](/features/dependents-table).

* **Added** RubyGems support: `Gemfile.lock` for exact transitive versions, with `Gemfile` and `.gemspec` as fallbacks. A gem pinned to an exact version is checked; a range is reported as not checked, because an advisory verdict against a range is either a false clean or a false alarm.
* **Added** NuGet support: `.csproj` `PackageReference` entries aggregated across every project in a solution, plus Central Package Management (`Directory.Packages.props`), `packages.lock.json`, and legacy `packages.config`. Two projects pinning different versions of one package are reported as a conflict rather than silently resolved to one of them.
* **Added** prerelease filtering for NuGet, so a `9.0.0-preview` is never offered as an upgrade from a stable release.
* **Added** Ruby to the published accuracy benchmark on every shared rule, not only its three Ruby-specific ones. See [Accuracy benchmark](/trust/accuracy-benchmark).
* **Changed** the dependency-lookup disclosure to name RubyGems.org and NuGet.org, the two new registries contacted. Only package names and versions are sent, as before.
* **Fixed** native gems being reported as vulnerable when already patched. A gem built for your platform is locked as `1.19.4-x64-mingw-ucrt`, and that platform suffix was read as part of the version, sorting it below the plain release - so advisories already fixed in the installed version still matched, and up-to-date gems sat permanently in "outdated". This affected most Ruby projects, since Rails pulls in several native gems.
* **Fixed** a gem RubyGems cannot resolve - yanked, renamed, private, or mistyped - appearing as outdated with an upgrade target of "unknown" instead of being reported as not checked.
* **Fixed** SBOM components with no resolvable version carrying a package URL whose version was placeholder text. The form was structurally valid, so a vulnerability scanner reading the SBOM failed to match those components without reporting a problem. They now carry a version-less package URL and state why.
* **Fixed** "Update all outdated" offering a command that covered only part of what it listed in a project using more than one package manager.
* **Fixed** the CLI reporting "Running as Free" when the licence server was unreachable but a cached Pro licence was still valid, and emitting the CI notice about skipped Pro steps on runs where nothing was skipped.

***

## v1.21.0 - 2026-08-12

<Note>**feature** - C# and .NET analysis</Note>

### C# joins the same engine

C# is analysed everywhere Iris Code runs - the editor, the CLI, hooks, and CI - with the same scoring, secrets detection, security smells, duplicate detection and suppressions as every other language. A `.csproj` is read as a manifest rather than as code: it contributes the packages your project depends on, and it is scanned for secrets, but its language version and warning level are build settings. See [Language support](/features/language-support).

* **Added** C# analysis for `.cs` and `.csproj`, covering methods and constructors, nesting and complexity, `using` namespaces and `PackageReference` entries, security idioms, secrets in fields, properties, locals and project XML, test conventions, suppressions, file naming, scoring, and gates.
* **Added** four C#-specific checks: `async void` outside event handlers, where a thrown exception cannot be observed by the caller; catch-all exception handlers, with `when (...)` filters exempt; LINQ chains of five or more operators in one statement; and types carrying too many responsibilities.
* **Added** .NET build hooks. A project with a `.csproj` or `.sln` gets an `iris-check` Makefile target wired as a prerequisite of `build` or `all`, defaulting to `dotnet build`.
* **Added** a `csharp` key to the `languages` block in `.irisconfig.json`, and severity overrides plus `iris-ignore` support for the four new rule ids.
* **Fixed** a verbatim Windows path breaking the file it appeared in. `@"C:\logs\"` was read as an unterminated string, so every brace after it counted at the wrong depth and the file was reported as a parse error with no findings at all. Raw strings failed the same way in the other direction. Both are now understood, along with the interpolated and doubled-quote forms.
* **Fixed** .NET test projects being treated as production code. C# has no `_test` filename separator and its test directory is `<Project>.Tests`, so fixture credentials and localhost URLs in tests were reported as real findings.
* **Fixed** project files reporting their language version and warning level as unnamed numbers, and C# attributes, `const`/`readonly` declarations and enum members now count as naming their own values.
* **Fixed** constructors with a `: base(...)` or `: this(...)` initialiser being skipped entirely, so no length, parameter, or nesting check applied to them, and a positional `record` being counted as both a type and a method.
* **Fixed** the C# debug-output Code Lens appearing in JetBrains only, and the File tab, Problems entries and inline diagnostic using the JavaScript wording for a C# file.
* **Fixed** the Iris Code panel opening blank in IntelliJ 2026.2 and other current JetBrains IDEs. The IDE moved its embedded browser out of the platform into a bundled component that Iris Code did not ask for, so the panel and the table tabs had nothing to draw with. Where an IDE cannot provide an embedded browser at all - some platforms and architectures do not ship one - the panel now offers to open the same interface in your own browser, and everything you click there still acts on the IDE. Analysis, diagnostics and enforcement were never affected.
* **Fixed** a type written entirely on one line - `class C { public void M() { } }` - reporting no methods, which exempted its members from the length, parameter-count and nesting checks.
* **Fixed** the Problems list showing raw rule ids as group headings for the C# checks and, since 1.20.0, the Ruby ones.

<Note>C# reports no unused members or unused packages, and no NuGet advisories. Dependency injection, reflection, partial classes and source generators reference code in ways static analysis cannot see, so an unused verdict is not one that can be stood behind. Dependency and CVE scanning covers npm, Go, and Python manifests only.</Note>

***

## v1.20.0 - 2026-08-10

<Note>**feature** - Ruby, Rails, and ERB analysis</Note>

### Ruby joins the same engine

Ruby is analysed everywhere Iris Code runs - the editor, the CLI, hooks, and CI - with the same scoring, secrets detection, security smells, duplicate detection and suppressions as every other language. Ships alongside `@iris-code/cli` 1.12.0. See [Language support](/features/language-support).

* **Added** Ruby analysis covering `.rb` and the Ruby DSL extensions, plus the extensionless files Ruby projects actually use: `Gemfile`, `Rakefile`, `Vagrantfile`, `Capfile`, the Fastlane set, and `.irbrc`. A file's language is not always decidable from its extension, so these are matched by name.
* **Added** ERB template support. Ruby inside `<% %>` and `<%= %>` tags is analysed while the surrounding HTML is excluded from scoring and duplicate matching, and findings report the line number in the template file itself.
* **Added** three Ruby-specific checks: `method_missing` defined without `respond_to_missing?`, god classes, and Rails parameters reaching a model without `require` and `permit`.
* **Added** Ruby build hooks. A project with a `Gemfile` gets an `iris-check` Makefile target wired as a prerequisite of `build` or `all`.
* **Changed** file renaming to warn on Ruby as it already did on Python. A rename does not rewrite `require_relative` paths or the constant names Rails derives from a filename.
* **Fixed** a Ruby guard clause such as `return 0 if value.nil?` being read as a missing `end`, which scored the file 0 and skipped its analysis.
* **Fixed** analysis speed on large files containing many findings. Several checks repeated whole-file work per finding, so cost grew with the square of the file size; a large Rails controller that took over a minute now completes in a fraction of a second. Findings are unchanged.

<Note>Ruby reports no unused imports or unused gems. Constants resolve at runtime through `send`, `const_get` and Rails autoloading, so an unused verdict is not one that can be stood behind. Dependency and CVE scanning covers npm, Go, and Python manifests only.</Note>

***

## v1.19.0 - 2026-08-08

<Note>**feature** - Slack notifications and a responsive Config Studio</Note>

### Gate results where the team sees them

Iris Code can send `iris check` and `iris gate` results directly from your own CI to Slack. The message never passes through Iris Code servers, and notification delivery never changes the command's exit code. Ships alongside `@iris-code/cli` 1.11.0. See [Slack notifications](/enforcement/slack-notifications).

* **Added** Slack notifications controlled by the `IRIS_SLACK_WEBHOOK` CI secret. Messages contain file paths, scores, rule names and counts, but never source, finding text or secret values.
* **Added** the free `iris slack setup`, `iris slack test` and `iris slack manifest` commands for guided setup, delivery testing and creation of a pre-configured Slack app.
* **Added** `--slack-on always` to report passing runs and `--slack-dry-run` to inspect the payload without posting.
* **Changed** the Config Studio on narrow screens. **Preview config** opens the live `.irisconfig.json` preview in a centred, scrollable modal, and account navigation opens from an animated menu instead of occupying the bottom of each page.
* **Fixed** file-naming violations appearing twice in the VS Code Problems panel.

***

## v1.18.0 - 2026-08-05

<Note>**feature** - Vue and Svelte analysis, plus file naming that follows folder roles</Note>

### Components are code too

Iris Code reads `.vue` and `.svelte` components: their `<script>` blocks are analysed as JavaScript or TypeScript from the `lang` attribute, while template and style markup is excluded from both analysis and duplicate detection. Findings keep the component's own line numbers. Ships alongside `@iris-code/cli` 1.10.0. See [Language support](/features/language-support).

* **Added** Vue and Svelte single-file component analysis everywhere Iris Code runs - the editor, the CLI, hooks, and CI. Secrets, security smells, duplicate detection, suppressions, health scores, change review, and workspace scans all cover them, and root-level script blocks only: a `<script>` inside a template or an `{#if}` block is markup, not code.
* **Added** role-based file naming (Free): `fileNaming.overrides` takes an ordered list of path globs, so `components/**` can require `PascalCase` while `composables/**` requires `camelCase`. Both conventions could not be expressed before, because a `lang="ts"` component and an ordinary `.ts` module resolve to the same language. The last matching rule wins, workspace `ignore` globs stay absolute, and a config without `overrides` behaves exactly as before. See [File naming](/configuration/file-naming).
* **Added** inline file-naming diagnostics in JetBrains IDEs, matching VS Code.
* **Added** SvelteKit awareness: `+page.svelte`, `+layout.svelte`, `+server.ts` and their siblings are exempt from naming conventions, because the framework resolves them by exact filename.
* **Fixed** the `no-exports` check firing on essentially every Vue and Svelte component - a `<script setup>` block has no `export` by design.
* **Fixed** large-file analysis speed. Analysis time grew with the square of a file's line count, so a very long file - especially one with many blank lines, worse with Windows line endings - could stall the editor or a CI run for minutes. A 200,000-line file went from over two minutes to a fraction of a second, with no change to findings.
* **Fixed** an unusable file-naming glob stopping the scan. The offending pattern is now named with its exact location, the rest of the rule keeps working, and the pattern can never quietly excuse a file from its convention.
* **Changed** `iris report` and `iris sbom` to require `--output` to stay inside the current directory, matching `iris check`, `iris deps`, and `iris cve`.
* **Fixed** the Config Studio preview showing a config shape Iris cannot read. The panel described its own nested format (`thresholds`, `detections`, `diagnostics`, `severity`), so copying the preview instead of syncing produced a file where every threshold, detection toggle, inline-diagnostic setting, and severity override was silently ignored - and because `presetId` was honoured, it looked like it had worked. The preview, the Copy button, and Sync are now the same text: the exact file that gets written. Configs you synced were always correct; only copied ones were affected.

***

## v1.17.0 - 2026-07-30

<Note>**feature** - Iris Code for JetBrains IDEs, Open VSX distribution, and config docs on hover</Note>

### One engine, every editor

Iris Code now runs in JetBrains IDEs and installs from Open VSX, both driven by the same analysis engine as the VS Code extension. A file scores identically in each host, one sign-in covers your editors and the CLI, and analysis still never leaves your machine.

* **Added** Iris Code for JetBrains IDEs - IntelliJ IDEA, WebStorm, PyCharm, GoLand, PhpStorm, Rider, RubyMine, CLion, and Android Studio. Inline diagnostics, `iris-ignore` quick fixes, health scores on hover, code lenses, filename-convention renames, and the full Iris Code panel under **Tools > Iris Code**. Install the **LSP4IJ** plugin first and restart the IDE fully after installing.
* **Added** Open VSX distribution, so Cursor, Windsurf, VSCodium, and other Open VSX editors install the byte-identical extension and receive updates automatically instead of a manual `.vsix`.
* **Added** 25 searchable Iris Code commands in JetBrains: press `Ctrl+Shift+A` (`Cmd+Shift+A`), type `iris`, and run workspace scans, Review My Changes, trends, hooks, dependencies, history secrets, or report export. Any of them can be bound to a shortcut under **Settings > Keymap**.
* **Added** sign in and sign out from JetBrains under **Tools > Iris Code**. Analysis and the panel refresh in place, so Pro features activate without restarting the IDE.
* **Added** dashboard config sync for JetBrains: build a config in the Config Studio, choose **Sync to JetBrains**, and paste the one-time code into **Tools > Iris Code > Sync Config from Dashboard**. You review a diff before anything is written.
* **Added** GitHub Actions workflow and CI snippet generators to JetBrains, matching the VS Code commands.
* **Added** shared push-blocked history, so the Enforcement card shows the same blocked-push counts, Pro activation date, and score delta in either editor.
* **Changed** hover documentation for `.irisconfig.json` now comes from the schema bundled with your installed version. Hovering any setting explains what it does, works offline and behind a proxy, and always matches the version of Iris Code you are running.
* **Fixed** a Pro config could briefly be reported as Free in JetBrains while the licence was still being validated, which also scored files against Free thresholds until it settled.
* **Fixed** Gate Preview and the trend-history table are Free features but were refused on the Free plan in JetBrains.
* **Fixed** the GitHub Actions and CI snippet generators now require Pro in JetBrains, matching VS Code.
* **Fixed** `.irisconfig.json` is recognised as comment-tolerant JSON in JetBrains. If your IDE still reports "JSON standard does not allow comments", it holds a user-level override - see [Installation](/installation#json-standard-does-not-allow-comments).

***

## v1.16.0 - 2026-07-26

<Note>**feature** - Quality Signals, AI-assisted preset, and Free file naming conventions</Note>

* **Added** Quality Signals: recurring workspace issues ranked by density and impact, with raw counts and percentages linked to the corresponding finding surfaces. Code Health remains the single headline score.
* **Added** Free workspace-wide and per-language file naming checks with four conventions, framework-aware exemptions, custom ignore globs, rename suggestions, baseline-aware new-file rollout, Explorer/Problems decorations, an open-file rename hint, and a 50-result disclosure for first scans without a baseline.
* **Added** the `ai-assisted` preset for high-volume AI-assisted review. It tightens structural, security, suppression, and duplication defaults without choosing a team-specific naming style.
* **Added** the Pro gate field `gateMaxNamingViolations`, enforced consistently by the CLI, hooks, and CI.
* **Changed** Free config handling inside `languages`: Iris keeps `fileNaming` and squiggles each ignored Pro-only sibling instead of discarding the whole block.
* **Fixed** the bundled config schema now recognizes `trendRegressionThreshold` and `gateBaselineMode`.

***

## v1.15.0 - 20 Jul 2026

<Note>**feature** - per-rule accuracy benchmark and one-click finding feedback</Note>

### Accuracy you can check, and rate

Iris Code 1.15.0 makes its findings accountable: every analysis rule is measured against a labelled corpus of real code for per-rule, per-language precision and recall, a checked-in baseline blocks any release that regresses a rule, and every finding in the sidebar now carries a thumbs up / down so you can tell Iris Code when it is right or wrong. Ships alongside `@iris-code/cli` 1.8.0. See [Accuracy benchmark](/trust/accuracy-benchmark).

* **Added** a thumbs up / down control on every finding in the sidebar and Issues view. Feedback is count-only - the rule, the language, and your verdict, never source code, file paths, or line contents - and respects your account analytics setting. Rate once and change your mind anytime; the control remembers your choice.
* **Added** an accuracy benchmark: every rule is measured against a labelled corpus for per-rule, per-language precision and recall, with a checked-in baseline that fails the build on any regression. A public [methodology page](/trust/accuracy-benchmark) shows the enforcement-rule figures per rule - no single misleading global percentage.
* **Fixed** false positives found by the benchmark: `any` in a comment or string, `print(...)` in a Python docstring, CommonJS `module.exports` files reported as export-less, arithmetic like `(a + b) * c` mistaken for a risky regular expression, and the `eval(` token inside a string literal are no longer flagged. Each fix is guarded by a permanent test case.

***

## v1.14.0 - 19 Jul 2026

<Note>**feature** - per-language config overrides, six more secret formats, and a bounded hook timeout</Note>

### One config, honest thresholds for every language in the repo

Iris Code 1.14.0 lets mixed-language repos stop compromising: a `languages` block in `.irisconfig.json` overrides per-file thresholds for TypeScript, JavaScript, Go, and Python independently, applied identically by the sidebar, CLI, hooks, and CI. Ships alongside `@iris-code/cli` 1.7.0. See [Per-language overrides](/configuration/irisconfig#per-language-overrides-pro-1-14-0).

* **Added** per-language config overrides (Pro): per-file thresholds, `healthScoreWeights`, `severityOverrides`, and the per-file gate caps can differ per language; anything unstated falls back to the base config. Scan-total gates and toggles are rejected inside a block with a clear warning, and unknown language keys warn instead of breaking older installs. The file tab shows the applied override next to the config source, and `iris gate` prints the limit that actually governed each failing file.
* **Added** six more secret formats: Stripe live/restricted keys (`sk_live_`/`rk_live_`), GitHub fine-grained PATs, GitLab PATs, npm access tokens, SendGrid API keys, and PEM private-key headers - masked in output, as always.
* **Added** a bounded timeout to the installed pre-push hook: a hung analysis is stopped after 120 seconds (`IRIS_HOOK_TIMEOUT` to adjust) instead of blocking `git push` indefinitely. The push still fails closed with a bypass hint, so enforcement is never silently skipped. Reinstall the hook to pick this up.
* **Fixed** function-length measurement for functions with destructured parameters - which includes essentially every React component. Component-heavy files may score lower after updating: that is the analyser finally seeing them, not a scoring change.
* **Fixed** `--allow-network` so it reliably re-enables dependency lookups after `--revoke-network`, and hardened the remaining CLI commands (`report`, `sbom`, `config`, `auth`, `hook`, `todos`) against a Windows-only crash on exit.

***

## v1.13.0 - 15 Jul 2026

<Note>**feature** - interactive change review and a git history secrets scan</Note>

### Review my changes, and secrets that history still remembers

Iris Code 1.13.0 makes reviewing your own Git changes the primary workflow - free, interactive, and scoped to exactly what you touched - and adds a **git history secrets scan** that finds credentials which were committed and later removed. Ships alongside `@iris-code/cli` 1.6.0. See [Review My Changes](/features/change-review) and [Git History Secrets Scan](/features/git-history-secrets).

* **Added** Review my changes (free): when Git reports local changes, a count-aware strip appears above the sidebar tabs. Running it checks every supported staged, unstaged, and untracked file and opens a dedicated review - blockers first, severity filters, search, changed-file health, and click-to-open findings. The Issues and TODOs tabs show the review's evidence on Free.
* **Added** the git history secrets scan (Pro): walks past commits - committed `.env` files included - through the same two-layer secrets detection. Findings are deduplicated per distinct secret, always masked, and show first/last sighting, commit and file counts, and whether the secret is still in HEAD. Merge-commit content is covered; depth, size-cap, and shallow-clone limits are always disclosed. Runs entirely against local git.
* **Added** `iris secrets --history [--depth N]` (Pro): the same scan in the terminal, with JSON output for automation; exits `1` when any secret is found in the scanned range.
* **Changed** change reviews to stay honest about scope: they never create a workspace trend snapshot and never report unused dependencies, because that conclusion requires a full-project scan. The changed-file count only counts files the review will actually analyse.
* **Changed** git-aware discovery to include untracked files not excluded by `.gitignore`, and to scope to the workspace when it sits inside a larger repository.
* **Fixed** predictability in unusual environments: repositories with very large untracked sets no longer fail discovery, a missing Git installation is reported as exactly that, and the history panel shows distinct loading, error, and empty states.
* **Fixed** CLI exit-code reliability on Windows so free users and unlicensed CI runs stay green as documented.

***

## v1.12.0 - 13 Jul 2026

<Note>**feature** - duplicate code detection with a live diff view and gate rule</Note>

### Duplicate code detection: find the copy-paste, diff it, gate on it

Iris Code 1.12.0 finds copy-pasted blocks within and across files using normalised token-window matching - renamed identifiers, changed literals, reformatted whitespace, and comments do not hide a duplicate. Free for everyone, with a Pro side-by-side diff view and a new gate rule. Ships alongside `@iris-code/cli` 1.5.0. See [Duplicate Code Detection](/features/duplicate-detection).

* **Added** duplicate code detection (free): source is normalised before comparison (identifiers, literals, whitespace, and comments ignored; keywords kept verbatim), so two stretches of code that differ only in naming or values still match. Within-file blocks appear as a Duplicate blocks smell on the File tab and deduct `healthScoreWeights.duplicateCode` points (default `3`); cross-file blocks power a new Duplication section on the Workspace and Folder tabs with block count, the duplication percentage of total code lines, and the largest blocks with click-through to both locations.
* **Added** noise guards so results stay reviewable: import/require headers never match, uniform data literals (country lists, enum tables) are excluded, a block repeated many times reports as a minimal set of pairs instead of every combination, JSX-heavy files need twice the token evidence, and oversized or minified-looking files are excluded and disclosed as skipped.
* **Added** a full Duplicates table - filterable by cross-file or within-file, searchable, both locations clickable - that tracks live edits: line ranges update as you type and resolved pairs drop out without a rescan.
* **Added** an **Open diff** action on every duplicate (Pro), titled with both locations GitHub-style. Cross-file pairs open the two full files side by side, editable with normal saves; same-file pairs open the two blocks as editable extracts that write back to the real file. Iris Code toasts the moment the duplication is resolved.
* **Added** `gateMaxDuplicateBlocks` (Pro): caps the total duplicate blocks across the scan, enforced by `iris check`, `iris gate`, the git hook, and the build hook - a block spanning two files counts once. New config keys: `enableDuplicateDetection` (default on), `duplicateBlockMinTokens` (default `40`), the `duplicateCode` scoring weight, and an optional `inlineDiagnostics.duplicateCode` squiggle toggle.
* **Added** `duplicate-code` as a suppressible rule id: `// iris-ignore: duplicate-code -- <reason>`.
* **Added** `duplicateBlocks` arrays to `iris check --format json` file entries (additive; schema version unchanged) and a "Max duplicate blocks" rule row to `iris gate`.
* **Fixed** `.mjs` and `.cjs` files being skipped entirely - they are now analysed everywhere `.js` is: workspace scans, folder scans, and CLI directory checks.

***

## v1.11.0 - 9 Jul 2026

<Note>**feature** - inline suppressions and OSV.dev vulnerability lookups</Note>

### Inline suppressions with required reasons, and dependency lookups move to OSV.dev

Iris Code 1.11.0 lets you silence individual findings with a documented `iris-ignore` comment, and moves all dependency vulnerability lookups to the OSV.dev database - no token, no rate-limit setup. Ships alongside `@iris-code/cli` 1.4.0.

* **Added** inline suppressions (free): `// iris-ignore: <ruleId>[, <ruleId>...] -- <reason>` suppresses matching findings on the next line, and `// iris-ignore-file: ...` covers the whole file (`#` works for Python). The reason is required - a directive missing it, or naming an unknown rule, suppresses nothing and is reported as a Bare Ignore finding with its own score penalty (`healthScoreWeights.bareSuppression`, default `2`). Eighteen rule ids are suppressible; suppressed findings stop costing health-score points but stay counted and visible. See [Inline Suppressions](/enforcement/suppressions).
* **Added** suppression surfaces in the sidebar: a Suppressed section in the File tab, and a Suppressions section in the Workspace and Folder tabs with per-file counts and a **See all** button that opens a full filterable table with click-to-open at the exact line.
* **Added** `--show-suppressed` to `iris check` and `iris gate`: lists each suppressed finding with its reason. Suppressed counts always appear in the output, and JSON reports gain a per-file `suppressed` array (schema version unchanged).
* **Added** two Pro team controls: `gateMaxSuppressions` (per-file cap, enforced by `iris gate`, the git hook, and the build hook) and `ignoreSuppressions: true` (kill-switch that makes every directive inert so suppressed findings count as live).
* **Changed** the Dependents Table, `iris deps`, and `iris cve` to source vulnerability data from the [OSV.dev](https://osv.dev) database. No token or rate-limit setup is needed: the in-panel GitHub token button is gone, the `GITHUB_TOKEN` environment variable is no longer used, and `iris auth login` no longer prompts for a GitHub PAT. Only the package name, ecosystem, and version are sent - never code, file paths, or project names - and the consent flow is unchanged. Old advisory caches invalidate automatically.
* **Added** a confidence label on every advisory (`fix-available`, `direct`, `transitive`, or `manual-review`) plus the fixed-in version where one exists, in both the panel and CLI output.
* **Improved** advisory trustworthiness: records without a verifiable id or severity are never shown - they are dropped and the skip count is disclosed in the panel footer and CLI output - and dependencies whose lookup errored are marked "not checked" instead of being assumed clean.
* **Fixed** debug prints quoted inside comments being flagged as live debug prints in TS/JS, Go, and Python.
* **Fixed** `iris deps` and `iris cve` argument errors no longer risk a crash on exit on Windows.

***

## v1.10.0 - 5 Jul 2026

<Note>**feature** - dependency intelligence: CVE gate, SBOM export, lockfile-aware audits</Note>

### CVE severity gate, CycloneDX SBOM export, and lockfile-aware dependency audits

Iris Code 1.10.0 turns the dependency scanner into a full supply-chain toolkit: gate CI on advisory severity with `iris cve`, export a CycloneDX SBOM with `iris sbom`, and get audits that reflect what is actually installed thanks to lockfile resolution and monorepo workspace discovery. Ships alongside `@iris-code/cli` 1.3.0.

* **Added** `iris cve [path]` (Pro): runs the same dependency and CVE scan as `iris deps` (sharing its 24-hour cache and network consent), but exits `1` only when an advisory at or above the `--severity` threshold (`low`, `medium`, `high`, `critical`; default `high`) is found. Built for CI gates: block on critical or high advisories without failing the pipeline on low-severity noise.
* **Added** `iris sbom [path]` (Pro): exports a CycloneDX 1.5 software bill of materials across npm, Go, and Python manifests. Fully offline: no network requests, no consent prompt. Components carry the name, exact installed version, `purl`, and a required/optional scope (direct vs dev). If a cached `iris deps` scan exists, known vulnerabilities fold in as CycloneDX `vulnerabilities` entries cross-referenced by `purl`. Writes `iris-sbom.json` by default; `--stdout` prints instead.
* **Improved** `iris deps`: installed versions are now resolved from lockfiles (`package-lock.json` v1-v3, `pnpm-lock.yaml`, `yarn.lock` classic and Berry, `poetry.lock`, `Pipfile.lock`) instead of manifest ranges, and advisories are filtered to the installed version.
* **Improved** monorepo support in the dependency scanner: npm and yarn workspaces plus `pnpm-workspace.yaml` members are discovered and deduplicated, and internal `workspace:` / `file:` / `link:` dependencies are excluded.
* **Added** network consent for dependency lookups: the first lookup asks permission and discloses exactly what is sent (package names and versions, nothing else), persisted in `~/.iris/preferences.json`. `--revoke-network` disables lookups; `--allow-network` re-enables them. Cached results now print their age.
* **Added** a CVE summary badge (Pro) to the Dependencies section of the Workspace tab: a green "no known CVEs" pill, or the vulnerable package count plus the highest severity from the last cached scan. Cache-only: the badge never triggers a network request itself.
* **Added** a scope indicator to the Issues and TODOs tabs: each tab now labels which scan it is showing (for example, "Showing: folder · src") with a one-click **Show workspace** switch.

***

## v1.9.0 - 2 Jul 2026

<Note>**feature** - security smell enforcement</Note>

### Security smell enforcement: gate on it, scan for it from the CLI

Iris Code 1.9.0 closes the loop on 1.8.0's security smell detection: a new gate rule blocks pushes and CI runs on security smell count, and a dedicated CLI command scans for them independently of a full health check.

* **Added** `gateMaxSecuritySmells` to `.irisconfig.json` - the gate fails when the total number of security smells (eval usage, SQL injection risk, insecure RNG, disabled TLS, weak hashing, and the rest of the nine 1.8.0 patterns) across the workspace exceeds this value. Enforced by the CLI, the git hook, and the build hook alongside `gateMaxSecrets`, `gateMaxComplexity`, `gateMaxFileLength`, and `gateMaxSmellsPerFile`.
* **Added** `iris security [path]` - a free CLI command that scans JS/TS/Go/Python for the same nine security smell categories as the sidebar, independent of a full `iris check` run. Supports `--format pretty|json` and `--output`; exits 1 if any smell is found.
* **Added** a Security Posture section to the Workspace and Folder tabs in the VS Code sidebar - a collapsible count-by-category breakdown of security smells found in the current scan.
* **Added** the `gateMaxSecuritySmells` field to the Config Studio's Gate limits editor for Pro users.

***

## v1.8.0 - 30 Jun 2026

<Note>**feature** - security smell detection</Note>

### Security smell detection: nine patterns, every file, free

Iris Code 1.8.0 adds a second static-analysis tier below hardcoded secrets: security smells. Nine patterns catch the most common security anti-patterns before they reach production. The feature is on by default, free for all users, and emits Warning-severity squiggles in the editor when inline diagnostics are enabled.

* **Added** nine security smell detectors across TypeScript, JavaScript, Go, and Python:
  * **Eval / exec calls** - dynamic code execution via `eval()`, `exec()`, or similar constructs
  * **SQL built by string concatenation** - query strings assembled with `+` or template literals instead of parameterised queries
  * **Insecure random number generation** - `Math.random()`, `rand.Intn()`, `random.random()`, and other non-cryptographic RNG in a security-sensitive context
  * **ReDoS-prone regexes** - nested quantifiers in patterns that can cause catastrophic backtracking
  * **Disabled TLS verification** - `rejectUnauthorized: false`, `InsecureSkipVerify: true`, or `verify=False`
  * **Weak hashing** - MD5 or SHA-1 in contexts that suggest security use (passwords, tokens, signatures)
  * **Open redirects** - `res.redirect()` or equivalent called with unvalidated user-controlled input
  * **Debug flags in production** - `debug: true` flag objects left in non-test code
  * **Hardcoded localhost URLs** - `http://localhost` or `http://127.0.0.1` in production code paths (skipped in test files)
* **Added** `enableSecuritySmells` toggle in `.irisconfig.json` and VS Code settings (`iris.enableSecuritySmells`, default on). Turning it off suppresses all nine patterns.
* **Added** inline diagnostics support: when `enableInlineDiagnostics` is on, security smell findings appear as Warning squiggles in the editor and entries in the Problems panel. Controlled per-category via `inlineDiagnostics.securitySmells`.
* **Added** custom scoring weights for each of the nine patterns for Pro users - adjust the health-score penalty per pattern in `healthScoreWeights` (keys: `evalUsage`, `sqlConcatenation`, `insecureRandom`, `unsafeRegex`, `hardcodedLocalhost`, `disabledTlsVerification`, `debugFlagsEnabled`, `weakHashing`, `openRedirect`).

***

## v1.7.0 - 25 Jun 2026

<Note>**feature** - trend tracking and baseline enforcement</Note>

### Trend tracking, baseline enforcement, and dashboard redesign

Iris Code 1.7.0 ships health score history, a dedicated Trends panel with per-file comparison, and baseline-mode gate enforcement so existing debt never blocks your team.

* **Added** trend tracking: Iris Code automatically snapshots your workspace health score on every scan, stored in `.iris-snapshots/` (gitignored, 2 MB cap, same-day dedup, corrupt-entry hardening).
* **Added** Trends panel: compare any two snapshots with a sortable, filterable per-file score table. Click any row to jump directly to the file. Free tier: rolling 2-snapshot window. Pro: unlimited history.
* **Added** inline trend summary in the Workspace tab showing regressed files, recovered files, and net score change between the two most recent snapshots.
* **Added** baseline mode: lock a baseline with `iris.lockTrendBaseline`. Iris Code writes `.iris-baseline.json` to the workspace root (committable, diffable). Set `gateBaselineMode: true` and the gate only blocks new regressions above the accepted baseline.
* **Added** `iris.clearTrendHistory` command to remove all snapshots and the baseline file.
* **Added** trial plan type: the extension now surfaces `trial` as a distinct plan with an Iris Code Pro Trial badge and trial-end date. Trial users get full Pro access.

***

## v1.6.1 - 17 Jun 2026

<Note>**fix** - Python analysis correctness</Note>

### Python analysis fixes: multi-line signatures and test-file secrets

Two Python correctness fixes. Files using multi-line (Black-formatted) function or block signatures are no longer misreported as syntax errors, and test files no longer have their score penalised for fixture credentials.

* **Fixed:** a Python `def`/`class`/`if`/`for`/`with` header that wraps across multiple lines (e.g. a long Black-formatted signature) was being flagged as a syntax error, scoring the file 0 and skipping all analysis. These files now analyse normally.
* **Fixed:** the suspicious-name secret heuristic no longer fires in test files (`test_*.py`, `*_test.go`, `*.test.ts`, `tests/`, `__tests__/`, `conftest.py`, and similar), so fixture credentials like `password="secret123"` no longer reduce the score. Real provider token formats (AWS, Stripe, GitHub, and more) are still detected everywhere, including tests.

***

## v1.6.0 - 16 Jun 2026

<Note>**feature** - CI enforcement</Note>

### CI enforcement: GitHub Actions, inline PR annotations, and multi-CI snippets

Iris Code 1.6.0 takes the same health gate you run locally and enforces it in CI. Run `iris gate . --format github` on every pull request to block merges and annotate the exact failing lines inline on the diff. Everything runs on your own runners - your code never leaves your infrastructure.

* **Added** `--format github` to `iris check` and `iris gate`: emits GitHub Actions workflow commands so failing rules render as inline annotations on the pull request diff, and writes a pass/fail summary table to the run's job summary.
* **Added** the `Iris Code: Add GitHub Actions Workflow` command (Pro): generates a ready-to-commit `.github/workflows/iris.yml` in your repo, pre-filled with your configured threshold.
* **Added** the `Iris Code: Add CI Pipeline Snippet` command (Pro): generates an Iris Code step for GitLab CI, Bitbucket Pipelines, an npm/pnpm/yarn script, or a generic shell script.
* **Added** a versioned JSON schema: all `--format json` output now carries a `schemaVersion` field (currently `1`) so scripts can depend on the payload shape.
* **Changed** CI behaviour when no licence is present: Pro-only steps now skip and exit `0` instead of failing the build, with a non-blocking warning annotation inside GitHub runners, so a missing token does not turn the pipeline red with noise.
* **Added** an `iris-alpine-amd64` binary for musl-based (Alpine) containers. The `npm install -g @iris-code/cli` route was already musl-safe and works unchanged.
* **Published** `@iris-code/cli` 1.1.0 with the new `--format github` support, and bumped the example workflows to `actions/checkout@v5` and `actions/setup-node@v5` (Node 24).

***

## v1.5.0 - 10 Jun 2026

<Note>**feature** - analytics and reliability</Note>

### Analytics batching, push-blocked counter, and reliability improvements

Iris Code 1.5.0 ships reliable background analytics, a Pro push-blocked counter, CLI event tracking, and reliability improvements across the extension and backend.

* **Added** analytics batching: the extension buffers usage events in memory and flushes every 60 seconds. `push_blocked` events flush immediately. The buffer survives extension crashes via crash-safe persistence to `globalState`.
* **Added** exponential backoff on consecutive analytics flush failures, with a clean flush on extension deactivate so no events are dropped on VS Code quit.
* **Added** CLI analytics: `iris check`, `iris gate`, and `iris secrets` runs now emit a fire-and-forget event so hook-triggered runs appear in the Iris Code dashboard alongside extension activity.
* **Added** push-blocked counter: the Pro sidebar now shows monthly pushes blocked, total pushes blocked, and the health score delta since Pro was activated. Resets the monthly count automatically on month rollover.
* **Improved** reliability and hardening across the extension, backend, and web surfaces.

***

## v1.4.2 - 5 Jun 2026

<Note>**fix** - documentation</Note>

### Documentation and CLI reference updates

Documentation clarity improvements and expanded CLI command reference across the extension and landing site.

* **Improved** command reference documentation for the full CLI suite with clearer descriptions and examples.
* **Updated** landing site copy to reflect the published `@iris-code/cli` npm package.

***

## v1.4.1 - 4 Jun 2026

<Note>**fix** - welcome page</Note>

### Welcome page improvements

Enhanced welcome page layout with updated feature highlights and clearer onboarding paths.

* **Refreshed** the VS Code welcome page with a new feature section layout and updated quick-start links.

***

## v1.4.0 - 3 Jun 2026

<Note>**feature** - full CLI command suite</Note>

### Full CLI command suite and npm package

Iris Code 1.4.0 ships a complete command-line tool - available via `npm install -g @iris-code/cli`. Scan any project from your terminal, manage enforcement hooks without opening VS Code, audit dependencies for CVEs, and authenticate once with a persistent credentials file. No VS Code installation required.

* **Added** `iris auth`: sign in via browser or licence token, store credentials in `~/.iris/credentials` (chmod 600). Subcommands: `iris auth login`, `iris auth logout`, and `iris auth status`. Credentials are read from the `IRIS_LICENCE_TOKEN` environment variable first, then the credentials file.
* **Added** `iris secrets`: free hardcoded secret scanner across JS/TS/Go/Python. Two-layer detection - suspicious variable names and known token formats. Exits `1` if any findings. No licence required.
* **Added** `iris deps`: audit all dependencies (`package.json`, `go.mod`, `requirements.txt`) for outdated versions and CVEs via the GitHub Advisory API. Results are cached for 24 hours. Store a GitHub PAT via `iris auth login` for higher rate limits.
* **Added** `iris todos`: aggregate all `TODO`/`FIXME`/`HACK` comments across your codebase. Pro feature.
* **Added** `iris gate`: run the full enforcement gate and show each configured rule's threshold vs actual value with per-rule PASS/FAIL. Pro feature.
* **Added** `iris report`: generate a standalone dark-themed HTML scan report. Free. Defaults to `iris-report.html` in the current directory.
* **Added** `iris hook`: manage pre-push and pre-build hooks from the terminal without VS Code. `iris hook git|build install|uninstall|status`. Install/uninstall is Pro; status is free.
* **Added** `iris config`: `iris config init` generates a `.irisconfig.json` with interactive preset selection. `iris config validate` reports any problems in an existing config.
* **Updated** `iris check`: file scans remain free. Directory scans, `--staged`, and `--changed` now require Pro - consistent with workspace analysis in the extension.
* **Published** `@iris-code/cli` to npm with Linux and Windows self-contained binaries on each GitHub Release.
* **Added** GitHub Actions docs page at `iriscode.co/docs/enforcement/github-actions` covering the full CI workflow, gate variant, exit codes, and threshold configuration.
* **Improved** hook install messages in the extension to inform users to run `iris auth login` or set `IRIS_LICENCE_TOKEN` so the hook can validate at push or build time.

***

## v1.3.0 - 28 May 2026

<Note>**feature** - Gate Preview and custom scoring weights</Note>

### Gate Preview, preset cycling, and custom scoring weights

Iris Code 1.3.0 ships Gate Preview - a free, read-only view of how your workspace scores against all five preset thresholds. Cycle through presets with prev/next controls or jump directly from the chip strip, drill into failing files (Pro), and apply the chosen preset in one click. Also ships custom health score weights and four new gate enforcement config fields for Pro users.

* **Added** Gate Preview: open it from the bottom of the File tab. It runs a full workspace scan and shows pass/fail counts for each of the five preset thresholds (`legacy`, `balanced`, `typescript`, `strict`, `security`) with proportion bars, a threshold card, and a recommendation for the next enforcement step. Always read-only - no files are blocked and no config is written.
* **Added** preset cycling: use prev/next arrows or click any chip in the preset strip to jump between presets. The focused preset shows a full drilldown and an Apply button so you can lock in a threshold in one click without leaving the surface.
* **Added** per-file drilldown for Pro users: expand any preset row to see the exact files that would be blocked, their health scores, and the warning pills driving the failure.
* **Added** custom health score weights for Pro users: set `healthScoreWeights` in `.irisconfig.json` to change how many points each finding type deducts from the base 100. Supported keys: `hardcodedSecret`, `errorWarning`, `warningWarning`, `anyUsage`, `tsIgnore`, `consoleLog`, `deepNesting`, `longParamList`, `unusedVar`, `unusedFunction`.
* **Added** four gate enforcement config fields for Pro users: `gateMaxSecrets`, `gateMaxComplexity`, `gateMaxFileLength`, and `gateMaxSmellsPerFile`. Set these in `.irisconfig.json` and the CLI enforces them on every push alongside `minHealthScore`.
* **Improved** licence reliability: server errors (5xx) and network timeouts now apply an offline grace period instead of revoking Pro. Activation skips the network call if your licence was validated within the last 24 hours.

***

## v1.2.1 - 27 May 2026

<Note>**fix** - sidebar UX</Note>

### Collapsible Pro card

A small follow-up to 1.2.0 that adds a collapsible Pro-status card in the sidebar and detached panel.

* **Added** a collapsible Pro-status card in the sidebar and detached panel. Once signed in, the card collapses to a compact chip so it stays out of the way while still showing plan status at a glance.

***

## v1.2.0 - 20 May 2026

<Note>**feature** - config presets and billing</Note>

### Config presets, dashboard sync, and bank transfer billing

Iris Code 1.2.0 ships a complete config management flow - pick from five presets, tune on the dashboard, and push to VS Code in one click. Nigerian users can now also pay with a bank transfer instead of a card.

* **Added** preset configs: set `presetId` in `.irisconfig.json` to snap your whole team to a known baseline (`strict`, `balanced`, `legacy`, `security`, or `typescript`). Preset configs are free for all users.
* **Added** config enforcement for Free users: if a free user edits preset threshold values locally, those edits are ignored and marked with a yellow warning in the editor pointing to the preset as the source of truth.
* Pro users can start from any preset and override individual values - the preset acts as a baseline, not a lock.
* **Added** a Config page in the account dashboard for generating and customising Iris Code configs with a live preview.
* **Added** dashboard-to-VS Code sync: generate a config on the dashboard, click Sync to VS Code, review a diff preview in the editor, and confirm the write - no copy-pasting.
* **Added** Paystack bank transfer checkout for Nigerian users: choose a one-time transfer checkout from the billing page, pay to the transaction-specific account shown, and Pro activates on confirmation. A fresh checkout is opened each renewal cycle.
* **Fixed** config sync diff preview leaving behind unsaved Untitled files after confirmation.

***

## v1.1.0 - 18 May 2026

<Note>**feature** - onboarding and account setup</Note>

### Onboarding, docs, and account setup flow

Iris Code 1.1.0 turns the first-run experience into a complete product flow across the extension and the web account surfaces, with guided onboarding, embedded docs, and clearer setup follow-through.

* **Added** a guided first-run onboarding flow inside the extension sidebar, including skip, resume, restart, and a 15-step spotlight walkthrough across the live tabs.
* **Added** an in-flow docs surface inside Iris Code so setup help now lives in the extension instead of forcing users out to separate pages first.
* **Added** public and dashboard-nested getting-started flows covering install, first scan, sign-in, configuration, and enforcement setup.
* **Added** an account dashboard welcome banner and contextual driver.js tour to help new users land on billing, license, and quick-start actions faster.
* **Improved** onboarding state handling so returning users with existing config do not get dropped back into the first-run path unnecessarily.
* **Added** a free-user config nudge and clearer Pro gating cues so workspace scans, issue navigation, and setup boundaries are easier to understand.

***

## v1.0.9 - 11 May 2026

<Note>**fix** - VS Code fork compatibility</Note>

### Trae, Cursor, Windsurf and all VS Code forks

Sign-in now works correctly in Trae IDE and any other VS Code fork. The sidebar has also been rebuilt internally for better reliability.

* **Fixed** sign-in redirect failing in Trae IDE and other VS Code forks - the extension now auto-detects the correct URI scheme for any editor without needing manual updates.
* **Fixed** an inaccurate notification shown in the detached panel when a free user clicks a Pro-only feature.
* **Rebuilt** the sidebar and detached panel internals using React - the experience is identical but the foundation is now typed and maintainable.

***

## v1.0.x - Apr 2026

<Note>**major release** - Enforcement Update, build hook enforcement, stability and polish</Note>

### Stability and polish (25 Apr)

A follow-up update focused on smoothing rough edges after the main 1.0 rollout.

* **Improved** default configuration behavior for day-to-day use.
* **Fixed** smaller workflow issues and tightened overall stability.
* **Polished** supporting parts of the product for a cleaner experience.

### Enforcement Update (29 Apr)

Version 1.0.0 brings Iris Code together as a fuller code-health workflow inside VS Code, with stronger checks before code leaves your machine.

* **Added** pre-push enforcement so teams can catch failing code before it is pushed.
* **Improved** in-editor issue visibility with clearer diagnostics while you work.
* **Expanded** project-wide analysis and dependency review in the extension.
* **Included** a more complete release focused on enforcement, scanning, and review flows.

### Build hook enforcement (30 Apr)

Iris Code can now run a health check before your project builds, not just before you push. Failing files block the build early, before the language toolchain runs.

* **Added** pre-build health check for Node projects via the npm `prebuild` lifecycle script - runs automatically before `pnpm build`, `npm run build`, and `yarn build`.
* **Added** Makefile-based pre-build check for Go and Python projects, wired as a prerequisite on the `build` or `all` target.
* Iris Code creates a Makefile with sensible defaults if none exists in Go or Python projects.
* Build hook status appears alongside the existing Git Hook section in the sidebar File tab.
* Both install and uninstall are safe: markers guard the injected block and original hook content is preserved on removal.

***

## v0.2.0 - 13 Apr 2026

<Note>**version update**</Note>

### Version 0.2.0

Version 0.2.0 continued the early Iris Code rollout with another round of product polish and refinement.

* **Improved** the overall extension experience.
* **Shipped** another round of fixes and polish in the 0.x cycle.

***

## v0.1.x - 6 Apr 2026

<Note>**feature update**</Note>

### Panel and history improvements

This update expanded how results could be reviewed during longer coding sessions.

* **Added** a wider panel view for reviewing analysis results.
* **Improved** how scan history and progress were presented.

***

## v0.1.x - 12 Mar 2026

<Note>**project start** - initial release</Note>

### Initial rollout

The first Iris Code release introduced the foundation for local code-health analysis inside VS Code.

* **Launched** the first version of the Iris Code extension experience.
* **Introduced** the early scoring and analysis workflow.