Changelog

Neu in Agnes

Jede Woche, was sich für dich geändert hat: neue Prüfungen, neue Funktionen und Korrekturen.

Die Einträge sind auf Englisch.

  1. Alerts, an SBOM for every run, what changed since the last analysis, and three more ways to sign in.

    • NeuSign in with Bitbucket, next to GitHub, GitLab, Google and Microsoft. FAQ →
    • VerbessertThe sign-in buttons show each service's logo in its own colours.
    • NeuA sample report to explore without signing up: a real analysis of shadcn-ui/taxonomy, linked from the homepage.
    • VerbessertError pages of our own: a page that isn't there, or that fails to load, says so in plain words, with a way back.
    • NeuSign in with GitLab, Google or Microsoft, next to GitHub, email and passkeys. FAQ →
    • NeuEmail alerts for new vulnerable packages and for a score that drops below your threshold.
    • NeuAlerts in a Slack or Microsoft Teams channel, and a weekly digest every Monday (paid plans). Preise →
    • NeuWhat changed since the last analysis: the new and the fixed findings of every run.
    • NeuWhat to fix first: the rules ranked by the points their findings cost.
    • NeuA software bill of materials (CycloneDX 1.6) to download from every run, and get_sbom for AI agents. SBOM →
    • NeuA licence overview for npm, yarn, pnpm and bun lockfiles, broken down by kind of licence.
    • NeuAccessibility findings grouped by WCAG 2.2 success criterion, as a page you can print.
    • NeuScore history per category, next to the overall score.
    • VerbessertVulnerable packages show the version that fixes them, and the command to upgrade a direct dependency.
    • VerbessertUnused files and exports come as lists you can copy.
    • VerbessertThe run page shows the dependency step live; a recheck shows which tools' results it reused.
    • VerbessertFaster dependency step: licences already looked up for a package version are reused.
    • VerbessertThe project page says when the branch was last checked for new commits.
    • VerbessertIntentional side-effect imports (polyfills, styles) are allowed by import/no-unassigned-import, per project too. Tools →
    • NeuAgnes is in the official MCP registry, and MCP clients can see its tools before you add a token. Agenten →
    • NeuConnect Claude, ChatGPT and other MCP apps by signing in to Agnes instead of pasting a token; disconnect them in Settings. Agenten →
    • NeuFree for open source: up to 10 public repositories per team are analysed for free on every plan, with up to 100,000 lines each. Preise →
    • NeuA README badge and a public report page for public repositories: switch them on in the project's settings.
    • NeuA page about the SBOM: what's in it, which lockfiles it reads, where to get it, and what it means for the Cyber Resilience Act. SBOM →
    • NeuThis changelog: what changed for you, every week.
    • VerbessertSBOM licences: an SPDX id, a valid SPDX expression, or the licence's name, with the export tested against the official CycloneDX 1.6 schema. SBOM →
    • BehobenAI agents no longer keep reconnecting to the MCP server. Agenten →

  2. Sign-up opens, paid plans arrive, and every analysis now has a run page like CI.

    • NeuSign-up is open, with the Free plan, for repositories on GitHub and Bitbucket.
    • NeuPaid plans: Essentials from 3 November, and all four plans from 7 November. Preise →
    • NeuA run page for every analysis, like a CI pipeline, with live progress while it runs.
    • NeuPaid plans re-check dependencies for new advisories on days without new commits; Free gets 3 manual re-runs a day. Preise →
    • NeuSign in with a passkey: a fingerprint, your face or your device PIN.
    • NeuIgnore rules per project, picked from a finding or edited in the settings.
    • NeuA security check for XSS sinks, with Mozilla's no-unsanitized rules. Tools →
    • NeuSearch your projects, re-run several at once, and add several repositories in one go.
    • VerbessertA wider, GitHub-style layout, with a project's pages as tabs.
    • VerbessertChoose what the dashboard's project cards show, and how big they are.
    • VerbessertThe app fits phones and tablets.
    • VerbessertKnip understands monorepo workspaces, Expo and React Native. Tools →
    • BehobenOne oversized or vendored file no longer fails the complexity check.
    • BehobenA deleted branch says so and offers another branch, instead of asking to reconnect.

  3. agnes.dev goes live, with templates, PHP dependencies and AI agents covered before the doors open.

    • Neuagnes.dev is live, first as a preview while sign-up was still closed.
    • NeuServer-rendered templates are checked too: Blade, Twig, Nunjucks and Handlebars. Frameworks →
    • Neucomposer.lock is checked for known vulnerabilities, for PHP projects. Frameworks →
    • NeuAI agents read your reports through an MCP server and an improve-score skill, with API tokens per team. Agenten →
    • NeuA FAQ, in five languages. FAQ →
    • NeuAccount emails: welcome, team, subscription and security changes.