Skip to content

Release 2.1.229 (2026-10-07)

Bug fixes

  • keep Python bytecode off the bind mount in vrg-container-run (#3113) Every container launch now sets PYTHONPYCACHEPREFIX=/tmp/pycache (container-local) so CPython and pytest never write pycache into the bind-mounted /workspace. Concurrent xdist writes over the macOS-to-container mount left truncated .pyc files that broke later validation runs. A non-empty host value wins; the explicit -e is emitted after env-prefixes passthrough so a matching prefix cannot override it.

Features

  • add vrg-sarif-filter to drop accepted-suppressed results for code-scanning upload (#3115) GitHub code scanning alerts on every SARIF result, even ones carrying an accepted in-source suppression, while the SARIF gate honors them (#3107). Add filter_suppressed() to lib/sarif.py, reusing effective_suppression(), and a vrg-sarif-filter INPUT OUTPUT console script that writes the filtered copy atomically (INPUT may equal OUTPUT) and reports the removed count. Invalid or unreadable SARIF is a hard error (exit 1). Document that the uploaded SARIF omits accepted-suppressed results while the evidence bundle keeps the full SARIF.

CI Evidence: All gates passed — full audit bundle available. Download →