Skip to content

Release 2.1.274 (2026-10-27)

Bug fixes

  • count-aware plurals in the held note and the show refusal (#3739) Choose the noun and verb from the advisory count instead of printing advisory(ies): 1 advisory still tracks / 2 advisories still track, and advisory ... does not exist / advisories ... do not exist. Tests cover singular and plural of both messages. Refs vergil-project/vergil-tooling#3736

  • count-free wording for the held note's retarget hint (#3744) One advisory can be retargeted to several tasks, so there is no count to pick a noun from. The planning hold note now says 'the task or tasks that fix it' instead of 'its fix task(s)'. Refs #3738.

Chores

  • uv lock --upgrade

Documentation

  • describe the three-queue model (intake, planning, deferred) (#3713) Document the deferred queue alongside intake and planning: a Deferred state and standing-epic row, the deferral rules and record, how items move between queues, the three review skills, and the deferred label and archives. Update the CLI reference refusals, the visibility-flip guide and the epics.py summary to match.

  • reflect security records in issue standards and CLAUDE.md (#3716) Doc-review bookend for epic vergil-project/.github#517. Add the security and security-disclosed labels to the label table, document the sweep's security-records pass, the intake-route advisory retarget, and the planning-queue advisory hold in the GitHub issue standards, and note the latter three in the CLAUDE.md tool list.

  • align the security-boundaries register with the security-records policy (#3717) Mark entry 3 resolved by vergil-claude-plugin#719 and add the rule for how register entries relate to security records. Ref #3714.

  • add the vrg-epic-audit overview section (#3718) Document the read-only drift and invariant report, --window-days, --repo and --epic, and the ordered --close passes (drift closes, standing-epic drains, orphan pass, security-records pass), checked against vrg-epic-audit's argparse and source. Ref #3715.

  • document several advisories per issue (#3745) Guide, vrg-security-record reference and the vrg-intake-route / vrg-queue overview sections: several advisory lines per issue, the per-advisory sequential handoff and docs-task rule, the design-review and agentic-review recipes, the migration check, the split refusal, and the count-free held note, quoted as the merged code prints them. Refs vergil-project/vergil-tooling#3732.

Features

  • several advisories per issue in the library, the sweep and show (#3734) An issue may now name any number of advisories, one Security advisory: line each (epic vergil-project/.github#573, Task 1):

  • parse_advisory_refs returns every GHSA ID a body names, in order, without repeats; parse_advisory_ref stays (first entry) until Task 2 moves intake routing and the planning hold.

  • unmark_issue acts when any line names the advisory, removes that line only, and drops the security label only with the last line.
  • SecurityIssue carries ghsa_ids; classify checks every line both ways, and retarget's dropped-issue scan is a membership test.
  • vrg-security-record show prints every pair in body order, and refuses, printing nothing, if any named advisory is missing.

Refs vergil-project/vergil-tooling#3730

  • routing and the planning hold over every advisory (#3735) vrg-intake-route transfer and recreate now retarget every advisory an item names, in body order, and a failure names each advisory still pending with its recovery command. A split of an item naming several advisories is refused before any change. vrg-queue planning holds an item while any advisory it names still tracks it. parse_advisory_ref is removed now that no caller remains.

CI Evidence: All gates passed — full audit bundle available. Download →