Skip to content

Release 2.1.273 (2026-10-27)

Bug fixes

  • retarget finishes an interrupted run when re-run (#3708)
  • fix(security): retarget finishes an interrupted run when re-run

retarget now also unmarks security-labelled issues in the home's org whose advisory line names this GHSA ID (REST listing via security_issues, never search), so a re-run after a failure in any step finishes the job even though the tracking lines were already rewritten. unmark_issue posts its comment first and then drops the line and label in one PATCH, so an interrupted unmark never leaves an issue that the listing can no longer attribute to the advisory. Ref #3702

  • fix(security): unmark only the issue line naming this advisory

unmark_issue now takes the GHSA ID and leaves an issue whose body does not name it (another advisory, or none) entirely untouched: no body edit, no label change, no comment. When it does name it, only that one line is removed rather than every advisory line. Ref #3702

Documentation

  • list paad/security/ in the managed base and link the paad usage policy (#3706) The config-audit reference enumerates the managed base fragment's contents; add the paad/security/ pattern that epic vergil-project/.github#500 Task 1 added. Point the epic-create section of the GitHub issues standard at the paad usage policy in vergil-claude-plugin. Ref #3658

  • document security records, vrg-security-record and the advisories permission (#3707)

  • docs(security): document security records, vrg-security-record and the advisories permission

Add the security-records guide (policy and about-a-day target, paad's definition, neutral wording, severity mapping, managing a record through its issue, planning handoff, pre-flip checklist, accepted trade-offs) and the vrg-security-record CLI reference, both in the mkdocs nav. Add Repository security advisories: Read and write to the user App in account-setup, with the org automation App needing it too and the audit App deferred, and reflect it in identity-architecture, credential-management and the CLI tools overview. Ref #3682.

  • docs(security): describe retarget as finishing an interrupted run on re-run

Matches the fix in vergil-tooling#3702, which lands in the same batch: retarget also finds dropped issues by listing, and never touches an issue naming a different advisory.

CI Evidence: All gates passed — full audit bundle available. Download →