Niro v0.1.63

Summary

This release improves how autonomous fix runs group and explain their work. Fixes are now organized as one pull request per distinct root cause, each backed by a concise root-cause note, so a reviewer can accept or reject each change as a self-contained unit. The Niro knowledge archive also now carries a complete configuration snapshot, fixing configuration proposals that could be rejected after an otherwise successful run.

Changes

• Autonomous fix runs now group findings into one pull request per distinct root cause — several findings that share one underlying flaw become a single fix, and independent flaws stay in separate pull requests — instead of splitting or collapsing by file. Each pull request reads as a coherent, reviewable security fix.
• Every confirmed finding now carries a short, developer-first root-cause note describing where the flaw lives and why it breaks the expected security behavior, so reviewers reach the cause without reverse-engineering the proof.
• The knowledge archive (niro-knowledge.tar) now contains the complete committable configuration snapshot rather than only changed files, so a proposal applies as a full replacement even when tracked configuration is unchanged.

Security

Configuration snapshots continue to exclude credentials, fixtures, findings, and harness run-state, and preserve the existing secret and symlink boundaries. The grouping change affects only how fixes are organized into pull requests; each confirmed finding still requires an executable proof and a regression test that fails on the unfixed code.

Compatibility and upgrade

No CLI flags or customer configuration keys changed.

Teams that consume niro-knowledge.tar as a configuration snapshot now receive the full committable configuration rather than a delta; importers that expected only changed files should treat the archive as a complete replacement.

Upgrade normally with niro upgrade or rerun the installer.

Known issues

• checksums.txt covers platform archives but not niro.mcpb.
• Release artifacts do not include detached signatures, public binary provenance attestation, or an SBOM.
• niro upgrade follows stable rather than dev or RC releases, and Windows users must rerun the installer to change versions.