What's Changed
- Fix LiteLLM cost model resolution by @bearsyankees in #1069
- feat: place caller-provided files into the sandbox workspace (
extra_files,--workspace-file) by @yoni-at-strix in #1085 - feat(reporting): contextual CVSS breakdown on dependency reports by @devin-ai-integration[bot] in #1091
- feat(reporting): require contextual CVSS and usage evidence on dependency reports by @devin-ai-integration[bot] in #1092
- handle resume tokens gracefully by @bearsyankees in #1097
- Add OWASP LLM Top 10 2026 skill coverage by @bearsyankees in #1115
- Add Azure and Entra security skill by @bearsyankees in #1119
- Add argument injection security skill by @bearsyankees in #1120
- Add ecosystem supply-chain security skills by @bearsyankees in #1121
- Add Hurl and Hypothesis security playbooks by @bearsyankees in #1122
- Add semantic browser and Electron security skills by @bearsyankees in #1123
- Expose viewer host option by @kusonooyasumi in #1127
- Drop strict tool schemas on Claude routes by @devin-ai-integration[bot] in #1136
- fix(tui): preserve cost when state is truncated by @kusonooyasumi in #1086
- fix(tui): use single space after ordered-list marker by @OpenPay-App in #1043
- fix(report): raise RuntimeError on non-object run.json (fixes #1109) by @vardhans07 in #1116
- better skills by @bearsyankees in #1139
- perf: take heavy imports off the startup path and pre-warm them in the background by @devin-ai-integration[bot] in #1141
- perf: bootstrap Caido concurrently with the scan start by @devin-ai-integration[bot] in #1143
- feat(agents): evidence discipline, and coverage as a first-class artifact by @devin-ai-integration[bot] in #961
- Add MCP server support by @yoni-at-strix in #1137
- Treat literal 'null'/'none' strings as absent for optional tool args by @bearsyankees in #1164
- fix(update): re-exec runs the new binary after self-update (endless update-prompt loop) by @devin-ai-integration[bot] in #1168
- fix(tui): restore base foreground after ANSI resets by @bearsyankees in #1169
- Scope threat models to the current run instead of caching them on disk by @devin-ai-integration[bot] in #1178
- Reach MCP tools on demand instead of registering every one by @yoni-at-strix in #1175
- Isolate MCP connections per task and surface connection status in the UIs by @yoni-at-strix in #1181
- fix(llm): only attach prompt-cache points on routes LiteLLM serves by @devin-ai-integration[bot] in #1186
- fix(llm): bind dedupe credentials to a provider; send reasoning=max via extra_body by @devin-ai-integration[bot] in #1187
- fix(report): keep strix.report import-light so it never races the warm-up thread into the agents SDK graph by @devin-ai-integration[bot] in #1188
- Fix user message retry lifecycle and TUI sync by @0xallam in #1193
- csv injection hardening by @bearsyankees in #1203
- fix(viewer): harden PDF report rendering by @kusonooyasumi in #1192
- fix(runtime): stage extra-file bind mounts where a remote docker daemon can see them by @devin-ai-integration[bot] in #1211
- Make MCP connections survive transient transport failures by @devin-ai-integration[bot] in #1184
- feat(cli): strix cloud — managed platform CLI (login, scans, billing, and the rest of the API) by @bearsyankees in #1177
- pentest skill cloud cli by @bearsyankees in #1220
- Forward the workspace header through cli by @bearsyankees in #1221
- report: add update_vulnerability_report so an agent can revise a filed finding by @bearsyankees in #1210
- chore: release v1.6.0 by @devin-ai-integration[bot] in #1223
New Contributors
- @OpenPay-App made their first contribution in #1043
- @vardhans07 made their first contribution in #1116
Full Changelog: v1.5.3...v1.6.0