Niro v0.1.69

Summary

Fix runs prioritise a working application over pull request presentation, and a fix that cannot be published is delivered as a patch instead of being lost. Adds two usage metrics, covered by the existing telemetry opt-out.

Changes

• Fix-mode pull request bodies are shorter and less templated.
• A fix that cannot be pushed is written to findings/<TEST-CASE-ID>/pr.patch. Apply it with git am < findings/<TEST-CASE-ID>/pr.patch.
• The run summary's Fix column reads Fixed, not published — findings/<TEST-CASE-ID>/pr.patch for those fixes.
• Runs against a target with no source checkout no longer print a Git error; the knowledge bundle is skipped instead. niro collect knowledge still requires a checkout.
• Git credential and token requests are recorded in the opt-in niro-debug-logs.tar artifact, to support diagnosing push failures.
• New metrics repository_used and pentest_result. See Telemetry.

Security

• pr.patch contains your source code and ships inside the knowledge artifact. Treat that artifact as you would the repository. With --include-findings=false it is not exported, and the run reports the fix as undelivered.
• Credential records contain the repository, outcome, granted permission names, and expiry — never a token or key.
• The new metrics carry repository identity and vulnerability counts by severity: no source, findings, targets, or credentials. telemetry: false suppresses them.

Compatibility and upgrade

• No action required. No configuration, CLI flag, or MCP tool changed.
• pr.patch is a new file under findings/<TEST-CASE-ID>/; tooling that enumerates those directories should tolerate it.
• The run summary is human-facing Markdown with no stability guarantee; recheck anything parsing its Fix column.
• Existing telemetry: false settings already cover the new metrics.

Known issues

• checksums.txt covers platform archives but not niro.mcpb.
• Release artifacts have no detached signatures, provenance attestation, or SBOM.
• niro upgrade follows stable, not dev or RC; Windows users rerun the installer to change versions.