This release fixes issues for SREs watching stability and regressions.
✓ No known CVEs patched in this version
Topics
+12 more
Summary
AI summaryFixed auto-pass router false‑positive on dotfiles and ambient TypeScript declaration files.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Bugfix | Medium |
Fixes false-positive classification of .gitignore, .dockerignore, .editorconfig, .npmrc, and *.d.ts files as source in get_autopass_verdict. Fixes false-positive classification of .gitignore, .dockerignore, .editorconfig, .npmrc, and *.d.ts files as source in get_autopass_verdict. Source: llm_adapter@2026-07-18 Confidence: high |
— |
Full changelog
Fixed
- The auto-pass router (
get_autopass_verdict) counted VCS/tooling dotfiles
(.gitignore,.dockerignore,.editorconfig,.npmrc, ...) and ambient
TypeScript declaration files (*.d.ts, e.g. a regeneratednext-env.d.ts)
as "files outside profiled archetypes", elevating a routine PR to needs-human
for the wrong reason._is_non_source_fileclassified them as authored source
because its extension check never matches an extensionless dotfile
(.gitignore.rfind(".") == 0) or the.tstail of a.d.ts. It now excludes
ambient.d.tsdeclarations and a curated set of non-source dotfiles from both
theunarchetyped_filesandsource_files_changedfacts, the same
false-positive class the v4.4.12-v4.4.14 version-bump/manifest/docs work
addressed. Real source is unaffected. See_NON_SOURCE_DOTFILESand
_is_non_source_fileinautopass.py.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Chameleon
All releases →Beta — feedback welcome: [email protected]