PeerAI Trust Center

Added

• Code Bench v1 — Multi-model consensus evaluator for code quality, sibling to Doc Bench under Testing & QA → Evaluators
  • Project types: Spring Boot, FastAPI, React, Generic
  • Languages: Python, TypeScript, JavaScript, Java, Other
  • Per-file, classification-aware rubrics keyed by (language, project_type, classification)
  • 5-step wizard: Scan → Select → Classify → Configure → Results
  • Tri-state file tree, per-file dimension + model breakdown
  • Mongo-backed rubric authoring with in-app wizard editor
  • Markdown / PDF / CSV export
  • SSE streaming evaluation with cancel support
• Markview DMN/DRL viewers — Native rendering for DMN decision tables and Drools DRL files
• Code Insights user scoping — Runs now scoped by user email and machine ID for multi-user installations

Changed

• Evaluators grouping — Doc Bench and Code Bench unified under a single Evaluators section
• Code Bench results UX — Refined per-file results presentation, distinct navigation icon
• LLM-only recommendations — Code Bench recommendations now strictly LLM-provided (no rule-based fallback)
• Model registry — Tightened to latest model options across providers
• Progressive markdown rendering — Improved rendering performance for large markdown documents

Fixed

• License activation reliability with v2 safeguards
• Code Bench evaluation progress now visible after page refresh (server-side fallback when SSE hook is cold)
• Code Bench evaluation hook: cancel correctly resolves stuck evaluating state
• Code Bench list page: runs sorted by recency, Space-key activation works for keyboard users
• Code Insights spec tree fixes

Security

• Vulnerable dependency upgrades across the stack
• Tightened release vulnerability gates in CI

Security

• ⬆️ Dependency CVE patches — upgraded packages across all lockfiles to resolve critical/high vulnerabilities reported by Aikido:
  • Python: cryptography 46.0.7, aiohttp 3.13.5, pillow 12.2.0, lxml 6.1.0, nltk 3.9.4, langchain-core ≥ 1.3.0 (in src-python, src-datamigration, peerai-sdk)
  • Rust: openssl / openssl-sys / aws-lc-rs (GHSA-hppc-g8h3-xhp3 and related)
  • JS: undici ≥ 8.1.0, flatted, basic-ftp, picomatch ≥ 2.3.2, next ≥ 16.2.3, vite ≥ 8.0.5, rollup ≥ 4.59.0, minimatch 10.2.4, dompurify ≥ 3.3.2 across root, portal, and marketplace lockfiles
• 🔥 Replace GPL-3 html2text with MIT markdownify — removed GPL-3 html2text from src-python to eliminate proprietary-distribution license risk; product_backlog_import_service.py now uses markdownify

Fixed

• 🐛 SQL injection via unsafe identifier concatenation — added _qi() helper in postgresql.py to safely double-quote PostgreSQL identifiers; fixed SQL export in StepResults.tsx to quote table and column names (Aikido SAST: AIK_python_B608, AIK_ts_sql_injection_template_literal)
• 🐛 Vite 8 build failure — converted manualChunks from object to function form required by rolldown (Vite 8's bundler); chunk groupings are unchanged
• 🐛 Doc-bench CI evaluator — moved get_tracked_llm() inside the rubric-evaluation phase guard so it is not called when rubric eval is skipped; guarded both llm.get_usage_summary() call sites against an unbound llm
• ✅ Doc-bench test fixes — updated TestCompositeScore to unpack the 3-tuple from _compute_composite_score; updated ALL_DIMENSIONS count assertion to 10; patched get_tracked_llm / resolve_api_keys_for_agent in TestPhaseSkipIntegration so tests pass in CI without API keys configured

Added

• ✨ Azure Blob Storage support for Coder published file browsing (#490) — the Coder editor's Published source toggle now reads from Azure Blob publications in addition to GitHub, matching the universal publisher's multi-backend shape
• ✨ Specs activity + activity-aware navigation (#488) — new Specs activity in the project lifecycle, a custom project picker, and contextual navigation that follows the current activity
• ✨ Proactive OpenCode install guidance — Coder launch now shows install instructions up front when the binary isn't detected, instead of failing late

Fixed

• 🐛 Backend test expectation — aligned non-GitHub published-source error handling with what the runtime actually returns
• 🐛 OpenCode install command — runtime contract parity test + alignment so the install path matches what the harness invokes

Changed

• 📝 CHANGELOG — restored the v0.75.0-alpha.1 entry that was accidentally removed by a main-branch sync; reference links now point at v0.75.0-alpha.1 → v0.75.0-alpha.2