Skip to content

Release 2.1.170 (2026-08-05)

Bug fixes

  • switch AUDIT to OSV-Scanner, fix Conan build_type + gcovr paths (#2573)
  • fix(cpp): switch AUDIT to OSV-Scanner, fix Conan build_type + gcovr paths

T11 validation (#2558) surfaced three C++ config gaps in the registry and packaged configs. Fix all three:

  • AUDIT now runs OSV-Scanner over a conan.lock (tokenless, scalable) instead of conan audit (SaaS token, rate-limited). INSTALL writes the lockfile via 'conan lock create'. Decision: vergil-project/.github#209; tool added image-side in vergil-containers#487.
  • Conan resolves deps with -s build_type=Debug so dependency binaries match the CMake Debug coverage/sanitizer builds (was defaulting to Release -> fmt/format.h not found on cold rebuild). Fixed in both the languages registry INSTALL and the container-test default command.
  • gcovr --root/--filter move to the command line so they resolve against the repo root; config-relative paths resolved against the packaged config dir and filtered all coverage out. gcovr.cfg keeps only path-independent settings.

Docs and unit tests updated to match.

CI Evidence: All gates passed — full audit bundle available. Download →