Strix v1.1.0

First release since v1.0.4. Highlights below (~56 merged PRs).

New security skills

• Weak-password detection skill (#621, [#654])
• LLM prompt-injection skill (#616)
• GCP and Auth0 reconnaissance skills
• Five new skills: OAuth, AWS, prototype pollution, deserialization, Django (#617)
• Skill-directory registration (#746)

SARIF / CI integration

• SARIF 2.1.0 emitter for GitHub code-scanning / ASPM ingestion (#626)
• STRIDE tagging of SARIF rules derived from CWE (#708)
• Omit SARIF version-control provenance for multi-repo scans (#726)

Dependency / SCA reporting

• New dependency reporting fields (#751)
• Require advisory_cvss for dependency findings + SCA TUI renderer (#753)

Cost & scope controls

• Configurable token / cost usage limits, --max-budget-usd (#576)
• Bind-mount option for large target repos (#577)
• --target list-file CLI option (#711)

LLM / provider

• Use core LiteLLM dependency (#752); cap openai<2.45 + litellm[proxy] so fresh installs run (#748)
• force_required_tool_choice setting (#730) and routed OpenAI required tool choice (#732)
• Scan-agent tool registration (#733); root scan prompt options (#750)
• Attribute OpenRouter usage to the Strix app (#760)
• Warn when the configured LLM is not a recommended/frontier model (#586)
• Route ollama models through ollama_chat so tool calling works (#562)
• Report cost for streamed OpenRouter calls (#634)

Reliability / fixes

• Default sandbox exec commands to Bash so source works (#764)
• Provider import-error hints for Bedrock/Vertex, full exception-chain walk (#588)
• Env vars win over persisted JSON across all aliases (#689)
• Graceful stop with resume hint on persistent RateLimitError (#593)
• Collapse child-agent initial input into a single user message (#589)
• Atomic CSV/MD writes to prevent corruption on crash (#628, [#631]); csv_path indentation (#637); avoid note-ID collisions (#630)
• Swallow torn-down docker socket on sandbox delete (#721); Caido HTTPS scheme (#722) + configured UI domains (#723)
• Keep verbose openai.agents DEBUG off sandbox stdout (#704)
• Strip ANSI escapes / control bytes from terminal tool output (#554)

TUI

• Reduce scroll stutter via throttled refresh + render caching (#687)
• "More content available" hint for long views (#687)
• Restore snappy sweep/progress animation frame rate (#759)

CI / telemetry / chores

• Lower Linux release glibc baseline (#707)
• Deduplicate scan-ended telemetry (#758); minor telemetry updates (#761); drop unhandled-exception collection (#585)
• Config-loader tests (#596); report-writer artifact tests (#667); uv.lock refresh (#606); README/docs updates

Contributors

Thanks to everyone who contributed to this release:

@0xallam @AtifAssari @Ayush7614 @Hardik-369 @Rome-1 @RudraDudhat2509 @Sonai124 @Stark-SK @ViperDroid @Zizouk22 @bastitva0-blip @bearsyankees @chirag127 @dpersek @e345ee @mhspektr @ousamabenyounes @sean-kim05 @seanturner83 @singe