# CommitBrief v1.21.0

> guard and leaks can now write SARIF logs for Code Scanning, remote pr honours inline suppression markers, and the go-git diff backend is gone.

Released October 21, 2026

Canonical URL: https://commitbrief.com/changelog/v1.21.0/

---

## Added

- **`commitbrief guard --sarif`** writes the policy's offending findings as a
  SARIF 2.1.0 log (category `commitbrief/guard/`), so a Code Scanning upload
  shows exactly what blocked the gate. Waived findings are not written; a
  passing policy writes `results: []`. The verdict goes to stderr and the exit
  code is unchanged. It fails closed: a review that degraded (a response that
  never parsed into structured findings, fresh or replayed from cache, or a
  `--from-json` document marked as degraded) produces an error and no file,
  because an empty `results[]` would tell Code Scanning every open alert is
  fixed. See [SARIF export](/docs/1.x/sarif/).
- **`commitbrief leaks --sarif`** writes credential hits as a SARIF 2.1.0 log
  (category `commitbrief/leaks/`, rule `sec.hardcoded-secret`; pattern names in
  the message and in `properties["commitbrief/patterns"]`, the commit in
  `properties["commitbrief/commit"]` for history hits). The matched text,
  snippets and author e-mail are never written. It is exclusive with
  `--patterns` and with the other output modes (`--json`, `--markdown`,
  `--suggest-commit`, `--cli`, `--show-prompt`), and it fails closed on
  anything that would make the log incomplete: a narrowing flag
  (`--no-history`, `--no-worktree`, `--file`, `--dir`, `--exclude-file`,
  `--exclude-dir`, the commit filters or a git range) is a usage error, and a
  history scan cut short by `--max-commits` or by the 10000-commit walk
  ceiling writes no file and exits 1. See [Leaks](/docs/1.x/leaks/).
- `leaks` reports when the commit walk hit the 10000-commit ceiling, and
  `leaks --json` carries it as `meta.walk_truncated`.
- A cached review that degraded now reports `meta.degrade_reason` on a cache
  hit too (additive; the cache key and `schema` are unchanged).

## Changed

- **`remote pr` honours inline suppression markers.**
  `commitbrief-ignore: reason` and
  `commitbrief-ignore[<rule_id>|<severity>]: reason` silence findings in the
  posted review exactly as they do in the local run, including `--no-post`
  previews, which also print the suppressed count. The baseline is not applied
  to `remote pr`. When a finding becomes suppressed, its previously posted
  thread is resolved by the usual sync. Suppressed findings no longer count
  toward `--fail-on` or the request-changes verdict. See
  [Signal control](/docs/1.x/signal-control/).
- `leaks` truncation notices (`--max-commits` and the walk ceiling) are now
  printed under `--quiet` as well; they used to stay silent.
- The "git is not installed" and "not inside a git repository" errors are
  localized (EN `Not inside a git repository.`, replacing
  `git: not inside a git repository`), including on the progress `[fail]`
  line.

## Fixed

- Commands that read a diff no longer panic with a nil-pointer dereference
  when `git` is not on `PATH`; they exit with the localized "git not found"
  error. This also affects already released versions.
- A history of exactly 10000 commits was treated as truncated by the commit
  walk (off-by-one at the walk limit), which made the `leaks` truncation check
  report a false positive.

## Removed

- The go-git diff backend: `git` on `PATH` is now the only diff backend. go-git
  stays in use for ignore-pattern matching only.