Pipeline Changelog
Each report published here is stamped with the version of the analysis
pipeline that produced it — visible as a small v1.x.y chip on the
issues list card and in the report footer. This page summarizes what
changed between versions.
Version scheme:
- MAJOR (
x.0.0) — structural changes to how a report is laid out. - MINOR (
0.x.0) — meaningful improvements in analysis quality. - PATCH (
0.0.x) — small refinements and copy adjustments.
Older reports keep their original stamp; new versions apply only to reports generated after the release date.
v1.3.2 — 2026-08-11
- Contributor profile summaries no longer cite specific commit counts in the prose. Those numbers already appear as live badges and a component bar on the same page — leaving them out of the narrative means the summary stays accurate as new commits land, instead of drifting behind the badges over time.
- Summaries also refresh automatically now for contributors who stay active — either every four weeks or after ten new commits land, whichever comes first. Previously each summary was written once at the contributor's first appearance and never updated.
v1.3.1 — 2026-08-11
- Reports now clearly distinguish "browser chrome" (the UI framing — toolbar, tabs, URL bar) from the Chrome browser, avoiding a term collision that was reading as the Chrome browser in earlier reports — especially in Korean translation, where the English word "chrome" is naturally parsed as the brand.
v1.3.0 — 2026-08-02
- Dev-commit entries in the Notable Development section now show the affected component and a direct link to the commit on GitHub, matching what security fixes already carry. Earlier reports could ship dev commits with neither, so the meta page's component badges were blank for dev items and there was no jump-off to the diff.
- Report validation now rejects dev items missing the component label or commit link, so the regression that produced blank entries in earlier reports can't ship silently.
v1.2.0 — 2026-07-27
- Reports now warm the reader up on general concepts before diving into WebKit-specific type names. The first sentence of each security-fix write-up frames the kind of bug and kind of subsystem, rather than opening with unfamiliar class names the reader hasn't seen defined yet.
- The one-line "angle" that names what an attacker gains is now written in plain terms — canvas rendering, IPC, thread races — instead of five internal type names strung together.
- For broad changes that touch many files, the technical patch section now opens with a one-sentence outline of what the change is doing in 2-3 pieces, so the flood of function and class names that follows has a small map to sit against.
v1.1.0 — 2026-07-26
- Audit suggestions now honestly acknowledge when a bug's underlying pattern is tied to WebKit-specific machinery — instead of forcing a weak "this also applies to other browsers" bullet when no meaningful analog exists, the report names the boundary and stops there. Directions with genuine cross-engine reach still generalize as before; only the ones that don't extend get to opt out.
v1.0.0 — 2026-07-26
Initial versioned baseline.