[v4.6.5] - 2026-10-08
Added
- Agent-Scan: Support custom transforms for SSE responses (PR #600, f59fbe1)
- MCP-Scan: Support modern/legacy protocol auto-negotiation and record protocol version (PR #579, 890f21d)
- Agent-Scan: Add OrcaRouter as a first-class provider (PR #619, a7c9b00)
- Models: Send extra headers and body fields to the model API (PR #669, ae6fc0d)
- DeepTeam: Resume an interrupted red team run (PR #668, a2ac397)
- Data: Add vulnerability rules [2026-09-25] — 154 CVE rules + 9 fingerprints (PR #679, 1f8ab6f)
- Data: Add vulnerability rules [2026-10-02] — 117 CVE rules + 5 fingerprints (PR #685, 62a939e)
Fixed
- MCP-Scan: Rate-limit aware retry for LLM calls (PR #651, 874d05b)
- Agent-Scan: Tool.inputSchema renamed to input_schema in mcp 2.0 (PR #614, baa3ec5)
- Parser: Keep the pre-release label when normalizing versions (PR #626, 0f5bb1f)
- Skill-Scan: Keep fallback tool-call parameters with their own call (PR #684, 25e58f1)
- MCP-Scan, Agent-Scan: Bound stalled streaming responses (PR #678, 63c2bd8)
- SARIF: Preserve text remediation in valid results (PR #680, e9e6ed7)
- Scanners: Preserve findings during context compaction (PR #649, a468ee2)
- DeepTeam: RailFence crashes with IndexError when rails <= 1 (e39ec6e)
- Skill file: Fix formatting of description in SKILL.md (PR #580, 8f84377)
Changed
- CI: Run the Go test suite on push and pull requests (PR #677, ff82482)
- Test: Make agent websocket go test build and pass on main (PR #674, 51d63e2)
Contributors
ichaobuster, BeYoungD, Pawar Priyank, Elwood Zonghao Ying (NY1024), lovejones2914-spec, monem, helo060228, feiyang, Chen Yufeiyang, Jin, Linxiushen (林SO), BevKim, dvd233