Release 2.1.228 (2026-10-06)

Bug fixes

• honor SARIF result suppressions in the security gate (#3108) evaluate_findings now moves results that carry an effective SARIF suppression into a separate EvaluationResult.suppressed list instead of counting them as gate failures. A suppression is effective when its kind is inSource or external and its status is absent or accepted. underReview, rejected, unknown kinds and malformed arrays fail closed.

format_summary renders suppressed findings in their own table, with rule, level, file, line, suppression kind and justification, so they stay visible. vrg-sarif-evaluate, vrg-semgrep-scan and vrg-trivy-scan write that summary whenever suppressions exist. The two scan wrappers also emit a suppressed_count output.

The ci-architecture guide documents how to write a justified nosemgrep suppression.

CI Evidence: All gates passed — full audit bundle available. Download →