Enhance/package metadata hardening#21

Merged

RalianENG merged 11 commits into

mainfrom

enhance/package-metadata-hardening

May 8, 2026

Commits on May 8, 2026

fix(sandbox,depfile): harden against attacker-controlled package metadata

RalianENG
and
claude
committed
feat(action): expose config, quiet, no-color as Action inputs

RalianENG
and
claude
committed
docs: backfill changelog for severity tiering, caller-aware hook + path count

RalianENG
and
claude
committed
fix(sandbox,cmd): close root-in-container heredoc injection on --local scans

RalianENG
and
claude
committed
fix(sandbox): sanitize getHostUsername to match getHostHostname

RalianENG
and
claude
committed
fix(config): warn on stderr when lenient mode honors kojuto.yml excludes

RalianENG
and
claude
committed
fix(report,hooks): escape control bytes in attacker-controllable strings

RalianENG
and
claude
committed
fix(cmd): owner-only mode for scan report and pinned manifest outputs

RalianENG
and
claude
committed
fix(probe,analyzer): close three detection-bypass paths in strace + eBPF

RalianENG
and
claude
committed
fix: clear golangci-lint violations from the hardening series

RalianENG
and
claude
committed
fix(cmd): split file-mode tests behind !windows build tag

RalianENG
and
claude
committed