Skip to content

chore: add changelog entries for CLI v2.48.1 and v2.48.2 #468

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mbevc1 merged 1 commit into from
Oct 26, 2026
Merged

chore: add changelog entries for CLI v2.48.1 and v2.48.2 #468

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions changelog/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,39 @@ description: "Release notes for Kosli products."
rss: true
---

<Update label="October 23, 2026" description="v2.48.2" tags={["CLI"]}>

## Updates

- **Go 1.26.10** — the CLI is now built with Go 1.26.10, which fixes a high-severity vulnerability in Go's `crypto/x509` (CVE-2026-111943).

## Bug fixes

- **SonarQube Cloud short-lived branches** — `kosli attest sonar --sonar-branch` now works for feature branches on SonarQube Cloud, instead of failing with "Branch '...' is not of type LONG". The attestation fails if a newer analysis replaces the commit while it is being read. See the [`kosli attest sonar` reference](/client_reference/kosli_attest_sonar).

@claude claude Bot Oct 26, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: "fails if a newer analysis replaces the commit while it is being read" makes it sound like a rare race condition. The kosli attest sonar reference says something stricter: on SonarQube Cloud, a short-lived branch keeps only its latest analysis, so --sonar-revision must be the latest commit analyzed on that branch. A reader who attests an older commit after the branch has moved on would expect it to work, and it won't.

Consider rewording it to match the reference, for example: "On SonarQube Cloud, the revision must be the latest commit analyzed on that branch."

- **Readable error messages** — messages containing `%`, such as URL-encoded paths, are no longer garbled (for example, `%2F` printed as `%!F(MISSING)`).

[View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.48.2)

</Update>

<Update label="October 20, 2026" description="v2.48.1" tags={["CLI"]}>

## New features

- **Every pull request review recorded** — pull request attestations now include a list of all reviews, not only approvals, for GitHub, GitLab, Bitbucket, and Azure DevOps. States are `APPROVED`, `CHANGES_REQUESTED`, `COMMENTED`, and on GitHub, `DISMISSED`. Policies can now see a change request made after an approval. See the [`kosli attest pullrequest github` reference](/client_reference/kosli_attest_pullrequest_github).

## Updates

- **No duplicate GitHub approvers** — a reviewer who approves the same commit twice is listed once. Approvals of different commits are still both kept.

## Bug fixes

- **Commits signed by GitHub Apps** — `kosli attest pullrequest github` no longer fails when a pull request contains commits signed by a GitHub App such as Renovate. The signer username is left empty for those commits.

[View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.48.1)

</Update>

<Update label="October 15, 2026" description="v2.48.0" tags={["CLI"]}>

## New features
Expand Down
Loading