chore: release v2.0.0

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to develop, this PR will be updated.

Releases

layne@2.0.0

Major Changes

• #116 d09bca0 Thanks @julio-rocketchat! - Introduce explicit scanner completion statuses, typed Git diffs, cooperative cancellation, startup configuration validation, and global scanner inheritance. Extend Dep Doctor lockfile health checks and baseline handling. Add bounded Spectre analysis with provider governors, validated response repair, opt-in signed caching, and opt-in AST routing. Replace count-based chat notifications with configurable final-state delivery. Add evidence-bound finding IDs and head-scoped bulk exception approvals.

  Incomplete scans now normally finish neutral instead of passing; unscanned high-risk Spectre overflow fails the check. Notifications default to high/critical findings, internal errors, and approvals; coverage notifications require opt-in. Custom adapters must adopt the structured result contract. Node 22.19 or newer is required.

• #113 2460a1d Thanks @julio-rocketchat! - Skip draft pull requests by default across direct and deferred triggers, and handle ready_for_review events. Set trigger.scanOnDraft to true globally or per repository to preserve scanning drafts. Deferred CI workflows should subscribe to ready_for_review.

• #90 c891508 Thanks @julio-rocketchat! - Replace Pi Agent with Spectre and add Dep Doctor scanner.

  • Spectre replaces Pi Agent as the multi-provider LLM malicious-intent scanner. It makes a single direct LLM call per file (no agent session) and supports Anthropic, OpenAI, Google, Mistral, and Amazon Bedrock via @mariozechner/pi-ai. Configurable file cap, diff line cap, min severity, skip paths/extensions, and concurrency.
  • Dep Doctor is a new dependency health scanner that fires when a lockfile changes. It detects newly-added packages with known CVEs (via OSV-Scanner), abandoned packages, and deprecated packages. Supports npm, PyPI, and Go lockfiles.
  • PR comments now use GitHub alert blocks ([!CAUTION] / [!WARNING]) with a severity-sorted findings table linking directly to the affected file and line. The {{findings}} and {{severitySummary}} template variables are now available for custom templates.
  • Dockerfile now installs osv-scanner alongside trufflehog and semgrep.

Minor Changes

• #59 53cdffc Thanks @julio-rocketchat! - Adds a new feature that allows Pi Agent to lazy fetch repo files

• #62 c3fa184 Thanks @julio-rocketchat! - Ensure that Pi Agent retries once if the run returns buggy results

Patch Changes

• #115 f9e5ae8 Thanks @julio-rocketchat! - Upgrade documentation tooling to Docusaurus 3.10.0, refresh the Claude illustration, and repair local development links.

• #61 f92ecc6 Thanks @julio-rocketchat! - Ensures that custom prompts can be used with Pi Agent

• #114 c91fa3f Thanks @julio-rocketchat! - Install and remove temporary native build dependencies for Semgrep in Alpine images. Include build-time scripts required by the TypeScript build.

• #112 eafd3d3 Thanks @julio-rocketchat! - Run Semgrep on complete selected HEAD files in diff-only mode, preserving syntax and enclosing context while filtering reported findings to changed lines.

• #111 496f508 Thanks @julio-rocketchat! - Validate HTTPS github.com clone destinations before attaching installation credentials or invoking Git. Reject existing credentials, non-default ports, query strings, and fragments.