Bug Fixes
- JSON reporter duplicate token counts — was always reported as in JSON output; now computed from token positions () (#801).
- Gitignore parent-directory walk — files in parent directories up to the repo root are now read and combined with scan-directory files. Also reads and the global for full parity with Git's ignore resolution (#741).
- Commander v15 migration — CLI option parsing migrated from direct property access (, etc.) to the API required by Commander v8+. The / flag handling was rewritten to use Commander's native negation support instead of inspection.
- Vitest 4.1.0 — bumped from 3.2.4 to address CVE-2026-47429.
- Commander v15 — bumped from v5 to v15, enabling modern Node.js compatibility.
- Pug 3.0.4, node-sarif-builder 4.1.0, nodemon 3.1.14 — dependency bumps for security and compatibility.