release: SkillSpector 2.12.0

CHANGELOG.md

@@ -1,3 +1,44 @@
+### 2.12.0 (Unreleased)
+### Features/Bug Fixes
+* fix(hooks): fail closed on unmodeled payload analysis (#573)
+* perf(security): cache pure security-view predicates (#570)
+* perf(security): accelerate token-gap classification with ASCII fast paths (#569)
+* fix(input): download raw content for GitHub and GitLab blob URLs (#566)
+* fix(cli): emit recursive SARIF reports to stdout (#565)
+* fix(security): keep line breaks out of letter-spacing runs (#564)
+* feat(cli): add streamed progress, file discovery, and Gemini 3.5 Flash metadata (#7)
+* fix(providers): honor model registry overrides for CLI providers (#463)
+* test(input): inject secure-open failures on the primitive the platform uses (#503)
+* feat(analyzer): add OpenCode-native SkillSpector invocation skill and tool (#537)
+* fix(input): expand 8.3 short DOS names before the opened-handle check (#484)
+* test(build-context): write fixture content with the newlines the assertions pin (#505)
+* test(build-context): guard the second FIFO case on mkfifo availability (#502)
+* test(build-context): read the nested OMS fixture without newline translation (#518)
+* test(yara): write the non-ASCII malformed-rule fixture as UTF-8 (#504)
+* fix(security): account for excluded executables (#548)
+* feat(providers): add opencode_cli semantic-scan provider (#536)
+* fix(llm): retarget the deadline on the existing client instead of rebuilding it (#520)
+* fix: preserve Markdown context during JSON command recovery (#559)
+* fix(batch-scan): reuse validated cache for multilingual analysis (#558)
+* fix(as3): ignore current-skill self references (#506)
+* fix: classify companion CLI documentation by context (#547)
+* fix(security): enforce discovery and requested analysis completeness (#410)
+* fix(security): add bounded reconstruction for letter-spaced P3/P4 instructions with an AE6 fallback for some ambiguous reconstructions (#470)
+* feat(cli): add opt-in --fail-on-findings across single-skill, recursive, and MCP registry scans (#469)
+* fix(security): preserve exact finding identity, evidence, and occurrence locations (#409)
+* fix: report oversized-file coverage gaps as AE7 and bound their LLM input (#509)
+* fix: avoid false analysis limits in documentation (#516)
+* fix: scan JSON quote candidates in linear time (#521)
+* feat: configure the static analysis time allowance (#522)
+* fix(cli): emit recursive JSON reports to stdout (#467)
+* fix(analyzer): project manifest version for RP3 (#474)
+* fix(supply-chain): prefer exact known-package matches in SC6 (#530)
+* Fix false local references from slash-separated prose (#451)
+* test(build-context): skip symlink cases where the platform refuses symlinks (#501)
+* docs(providers): align setup guidance (#434)
+* docs(readme): add HVTrust badge (#428)
+* docs(readme): clarify research background counts (#543)
+---
 ### 2.11.2 (Thursday, September 10, 2026)
 ### Features/Bug Fixes
 * fix: prevent duplicate reference coverage from causing fatal scan-accounting errors (#507)