v1.1.0Android
Added 14
- Weak-password detection security skill
- LLM prompt-injection security skill
- GCP and Auth0 reconnaissance skills
- Five new security skills for OAuth, AWS, prototype pollution, deserialization, and Django
- Skill-directory registration
- SARIF 2.1.0 emitter for GitHub code-scanning and ASPM ingestion
- STRIDE tagging of SARIF rules derived from CWE
- New dependency reporting fields
- Configurable token and cost usage limits with --max-budget-usd option
- Bind-mount option for large target repositories
- --target list-file CLI option
- force_required_tool_choice setting and routed OpenAI required tool choice
- Scan-agent tool registration and root scan prompt options
- Warning when configured LLM is not a recommended or frontier model
Changed 8
- Use core LiteLLM dependency and cap openai<2.45 with litellm[proxy]
- Require advisory_cvss for dependency findings with SCA TUI renderer
- Omit SARIF version-control provenance for multi-repo scans
- Attribute OpenRouter usage to the Strix app
- Route ollama models through ollama_chat for tool calling support
- Provider import-error hints for Bedrock and Vertex with full exception-chain walk
- Environment variables win over persisted JSON across all aliases
- Report cost for streamed OpenRouter calls
Fixed 9
- Default sandbox exec commands to Bash so source works
- Graceful stop with resume hint on persistent RateLimitError
- Collapse child-agent initial input into a single user message
- Atomic CSV and MD writes to prevent corruption on crash
- Swallow torn-down docker socket on sandbox delete
- Strip ANSI escapes and control bytes from terminal tool output
- Reduce scroll stutter via throttled refresh and render caching
- Restore snappy sweep and progress animation frame rate
- Lower Linux release glibc baseline
Strix v1.1.0
First release since v1.0.4. Highlights below (~56 merged PRs).
New security skills
- Weak-password detection skill (#621, #654)
- LLM prompt-injection skill (#616)
- GCP and Auth0 reconnaissance skills
- Five new skills: OAuth, AWS, prototype pollution, deserialization, Django (#617)
- Skill-directory registration (#746)
SARIF / CI integration
- SARIF 2.1.0 emitter for GitHub code-scanning / ASPM ingestion (#626)
- STRIDE tagging of SARIF rules derived from CWE (#708)
- Omit SARIF version-control provenance for multi-repo scans (#726)
Dependency / SCA reporting
- New dependency reporting fields (#751)
- Require
advisory_cvssfor dependency findings + SCA TUI renderer (#753)
Cost & scope controls
- Configurable token / cost usage limits,
--max-budget-usd(#576) - Bind-mount option for large target repos (#577)
--targetlist-file CLI option (#711)
LLM / provider
- Use core LiteLLM dependency (#752); cap
openai<2.45+litellm[proxy]so fresh installs run (#748) force_required_tool_choicesetting (#730) and routed OpenAI required tool choice (#732)- Scan-agent tool registration (#733); root scan prompt options (#750)
- Attribute OpenRouter usage to the Strix app (#760)
- Warn when the configured LLM is not a recommended/frontier model (#586)
- Route ollama models through
ollama_chatso tool calling works (#562) - Report cost for streamed OpenRouter calls (#634)
Reliability / fixes
- Default sandbox exec commands to Bash so
sourceworks (#764) - Provider import-error hints for Bedrock/Vertex, full exception-chain walk (#588)
- Env vars win over persisted JSON across all aliases (#689)
- Graceful stop with resume hint on persistent RateLimitError (#593)
- Collapse child-agent initial input into a single user message (#589)
- Atomic CSV/MD writes to prevent corruption on crash (#628, #631); csv_path indentation (#637); avoid note-ID collisions (#630)
- Swallow torn-down docker socket on sandbox delete (#721); Caido HTTPS scheme (#722) + configured UI domains (#723)
- Keep verbose
openai.agentsDEBUG off sandbox stdout (#704) - Strip ANSI escapes / control bytes from terminal tool output (#554)
TUI
- Reduce scroll stutter via throttled refresh + render caching (#687)
- "More content available" hint for long views (#687)
- Restore snappy sweep/progress animation frame rate (#759)
CI / telemetry / chores
- Lower Linux release glibc baseline (#707)
- Deduplicate scan-ended telemetry (#758); minor telemetry updates (#761); drop unhandled-exception collection (#585)
- Config-loader tests (#596); report-writer artifact tests (#667); uv.lock refresh (#606); README/docs updates
Contributors
Thanks to everyone who contributed to this release:
@0xallam @AtifAssari @Ayush7614 @Hardik-369 @Rome-1 @RudraDudhat2509 @Sonai124 @Stark-SK @ViperDroid @Zizouk22 @bastitva0-blip @bearsyankees @chirag127 @dpersek @e345ee @mhspektr @ousamabenyounes @sean-kim05 @seanturner83 @singe