# CommitBrief v1.21.1

> guard now fails closed on a degraded review, gemini-cli rejects oversized prompts with a clear message, and four small leaks and error-language defects are fixed.

Released October 25, 2026

Canonical URL: https://commitbrief.com/changelog/v1.21.1/

---

## Fixed

- **`guard` now fails closed on a degraded review without `--sarif`.** When
  the review degraded (an unparsable model response, live, replayed from
  cache, or a `--from-json` document carrying `meta.degrade_reason`), `guard`
  exits 1 with a "policy cannot be verified" error instead of reading the
  empty result as zero findings and passing. The `--sarif` path already
  refused a degraded review. `review` and `diff --fail-on` keep their
  graceful-degrade behavior. See
  [Policy gate](/docs/1.x/policy-gate/).
- **`gemini-cli` rejects an oversized prompt before starting `gemini`.** The
  prompt travels as a command-line argument, so a large diff used to fail with
  an opaque `E2BIG`-shaped error. It now returns a localized message with the
  prompt size and the limit, and suggests narrowing with `--file`/`--dir` (or
  `--exclude-file`/`--exclude-dir`). An `argument list too long` error from the
  OS is mapped to the same message for every CLI-backed provider.
- `leaks` no longer reports a missing `git` binary as an invalid
  `guard.secret_patterns` entry; it shows the localized "git not found" / "not
  a repository" message.
- The early `Error:` prefix follows the same language order as every other
  message (`--lang`, repo config, user config, English) instead of `--lang`
  only.
- `leaks --json` sets `meta.truncated: true` when `--max-commits` cut the
  history short (additive; `meta.walk_truncated` is unchanged). See
  [Leaks](/docs/1.x/leaks/).
- `--text` branch-name matching is bounded by the commit walk ceiling instead
  of `--max-commits`, so a cut is reported as truncation rather than dropped
  silently.

## Changed

- **Building from source now requires Go 1.26 or later** (`go install`,
  `make build`). Prebuilt binaries (Homebrew, Scoop, GitHub Releases) are
  unaffected.
- Dependency updates: `anthropic-sdk-go`, `genai`, `go-git`, and the
  `golang.org/x` modules. The Anthropic SDK links the OpenTelemetry API;
  CommitBrief configures no tracer or exporter, so it stays a no-op and sends
  nothing.