Release 2.1.205 (2026-08-24)

Bug fixes

• skip conan audit scan when no ConanCenter token is set (#2895) (#2896) The cpp audit stage ran 'conan audit scan .' unconditionally. It authenticates against ConanCenter's advisory API and hard-fails with 'Missing authentication token' when no provider token is set - an empty token does not degrade it either. So every cpp repo whose org has not set CONAN_AUDIT_PROVIDER_TOKEN_CONANCENTER failed the audit gate.

ci-audit.yml already documents the intended behavior: it passes the token from a repo/org secret and states that vrg-validate skips this gate with a notice when the secret is unset - 'a per-language decision that lives in vrg-validate, not here'. But vrg-validate never implemented it: the only reference to the token was a comment in languages.py, and the AUDIT command list was unconditional. This makes the documented contract real.

_skip_conan_audit_scan drops the 'conan audit scan' command (matched by shape, so only the cpp conan audit is affected) when the token env var is empty or unset, printing a notice to stderr. The rest of the audit stage (conan graph info) still runs, and if the filtered list empties, _build_stages omits the stage. A real token restores the scan unchanged. language_commands stays a pure registry expander - the environment-dependent decision lives in the runner, exactly where ci-audit.yml says it does.

CI Evidence: All gates passed — full audit bundle available. Download →