Niro v0.1.65

Summary

This release changes how the customer pentest report PDF is delivered from the supplied GitHub Actions workflows and cleans up the pentest summary heading style. The PDF is now uploaded as a direct, single-file artifact that needs no archive extraction after download, and pentest summary headings are rendered without leading numbers. There are no configuration or agent-surface changes.

Changes

• The supplied GitHub Actions workflows now upload the pentest report PDF as a direct single-file artifact using archive: false. The download is the PDF itself rather than a zip that must be extracted, and the artifact is named after the report file instead of a fixed niro-pentest-report name.
• Pentest summaries now use unnumbered headings, keeping the rendered summary consistent across find, fix, and clean runs.

Security

No security-relevant behavior changed in this release. The report PDF, run ledger, and debug-log handling guidance from v0.1.64 still applies: continue treating niro-debug-logs.tar as an unsafe support artifact and share it only through an approved channel.

Compatibility and upgrade

• The GitHub Actions "Upload Niro penetration-test report" step now sets archive: false and no longer sets a fixed artifact name. As a result the report artifact is named after the report file rather than niro-pentest-report. If any downstream automation downloads the report by the niro-pentest-report artifact name, update it to the new name, and adopt the updated upload step from the supplied example workflows under examples/github-actions/.
• No customer configuration keys changed, and the developer agent and attacker agent MCP surfaces are unchanged.

Known issues

• If a requested PDF fails after the Markdown summary is generated, the run fails and the reason is written to the job log, but the published job summary may not include that failure explanation.
• checksums.txt covers platform archives but not niro.mcpb.
• Release artifacts do not include detached signatures, public binary provenance attestation, or an SBOM.
• niro upgrade follows stable rather than dev or RC releases, and Windows users must rerun the installer to change versions.