[{"url":"https://api.github.com/repos/yamadashy/repomix/releases/392799044","assets_url":"https://api.github.com/repos/yamadashy/repomix/releases/392799044/assets","upload_url":"https://uploads.github.com/repos/yamadashy/repomix/releases/392799044/assets{?name,label}","html_url":"https://github.com/yamadashy/repomix/releases/tag/v1.18.1","id":392799044,"author":{"login":"yamadashy","id":5019072,"node_id":"MDQ6VXNlcjUwMTkwNzI=","avatar_url":"https://avatars.githubusercontent.com/u/5019072?v=4","gravatar_id":"","url":"https://api.github.com/users/yamadashy","html_url":"https://github.com/yamadashy","followers_url":"https://api.github.com/users/yamadashy/followers","following_url":"https://api.github.com/users/yamadashy/following{/other_user}","gists_url":"https://api.github.com/users/yamadashy/gists{/gist_id}","starred_url":"https://api.github.com/users/yamadashy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yamadashy/subscriptions","organizations_url":"https://api.github.com/users/yamadashy/orgs","repos_url":"https://api.github.com/users/yamadashy/repos","events_url":"https://api.github.com/users/yamadashy/events{/privacy}","received_events_url":"https://api.github.com/users/yamadashy/received_events","type":"User","user_view_type":"public","site_admin":false},"node_id":"RE_kwDOMVwZR84XaaNE","tag_name":"v1.18.1","target_commitish":"main","name":"v1.18.1","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-09-21T06:09:54Z","updated_at":"2026-09-21T08:34:49Z","published_at":"2026-09-21T08:34:49Z","assets":[],"tarball_url":"https://api.github.com/repos/yamadashy/repomix/tarball/v1.18.1","zipball_url":"https://api.github.com/repos/yamadashy/repomix/zipball/v1.18.1","body":"This patch release fixes a security issue in the CLI's git handling, along with the Windows `.gitignore` crash and a set of contributor bug fixes!\n\n## Security Fix 🔒\n\n### Repository-Level Git Config Is No Longer Executed (GHSA-4p5g-gh74-q524)\n\nRepomix runs `git log` in the target directory to sort files by change frequency, and `git diff` / `git log` for `--include-diffs` / `--include-logs`. Git honors settings from the repository's own `.git/config` that name an executable, such as `gpg.program`, `diff.external`, textconv drivers, and `core.fsmonitor`. A directory shipped with a crafted `.git` (for example inside a zip archive) could therefore run arbitrary commands when Repomix was invoked inside it. A normal `git clone` does not carry the remote's `.git/config`, and `--remote` removes the clone's `.git` before processing, so those paths were not affected.\n\nAll git commands Repomix runs in a target directory now disable these settings. Output for a normal repository is unchanged.\n\nSee the security advisory for details. Thanks to @kinehoo77-debug for the report! 🙏\nhttps://github.com/yamadashy/repomix/security/advisories/GHSA-4p5g-gh74-q524\n\n## Bug Fixes 🐛\n\n### Windows Crash on `.gitignore` with Backslash Escapes (#1765, #1775)\n\nOn Windows, packing failed with ``path should be a `path.relative()`d string`` when a `.gitignore` mixed a backslash-escaped rule with a negation rule. The bug was in globby and is fixed in globby 16.2.3, which this release picks up. Thanks to @iki for the report and for sticking with it! 🙏\n\n### `--remove-comments` No Longer Corrupts Shell and YAML Files (#1752)\n\nShell and YAML files were stripped with the Perl profile, which treats every unquoted `#` as a comment. In these languages `#` only starts a comment at the beginning of a line or after whitespace, so constructs like `${name##*/}`, `$#`, and URL fragments were being cut. Shell and YAML now use a dedicated handler that respects this rule, heredocs, and block scalars. Thanks @serhiizghama!\n\n### `--include-full-directory-structure` Keeps Non-Included Files (#1749)\n\nWhen combined with `--include`, the Directory Structure section is meant to show the whole repository tree while packing only the included files' contents. Non-included files were being dropped from the tree. Thanks @serhiizghama!\n\n### Split Output Shows Each Part's Own Directory Tree (#1815, #1822)\n\nWith `--split-output`, every part listed the directory tree of the entire output instead of the files in that part. Each part now renders only its own files. Thanks @Elioooon!\n\n### Remote URLs Whose Repository Name Starts with a Dot (#1772)\n\n`https://github.com/microsoft/.github` and similar org profile repositories were rejected as invalid. Thanks @serhiizghama!\n\n### Data URI Parameters Preserved When Truncating Base64 (#1819, #1820)\n\nTruncating long base64 payloads kept only the last `;param` before `;base64,`, dropping the others. Thanks @cyphercodes!\n\n### Small CLI Fixes (#1808, #1809, #1810)\n\n- `--split-output` sizes that round down to zero bytes (such as `0.5b`) are now rejected instead of looping forever.\n- Output and skill paths are classified by real directory boundaries, so a sibling directory with a matching prefix is no longer treated as inside the base.\n- Remote skill names are derived from the owner and repository of GitHub URLs.\n\nThanks @Whxuan0701!\n\n## How to Update\n\n```bash\nnpm update -g repomix\n```\n","mentions_count":6},{"url":"https://api.github.com/repos/yamadashy/repomix/releases/367109544","assets_url":"https://api.github.com/repos/yamadashy/repomix/releases/367109544/assets","upload_url":"https://uploads.github.com/repos/yamadashy/repomix/releases/367109544/assets{?name,label}","html_url":"https://github.com/yamadashy/repomix/releases/tag/v1.18.0","id":367109544,"author":{"login":"yamadashy","id":5019072,"node_id":"MDQ6VXNlcjUwMTkwNzI=","avatar_url":"https://avatars.githubusercontent.com/u/5019072?v=4","gravatar_id":"","url":"https://api.github.com/users/yamadashy","html_url":"https://github.com/yamadashy","followers_url":"https://api.github.com/users/yamadashy/followers","following_url":"https://api.github.com/users/yamadashy/following{/other_user}","gists_url":"https://api.github.com/users/yamadashy/gists{/gist_id}","starred_url":"https://api.github.com/users/yamadashy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yamadashy/subscriptions","organizations_url":"https://api.github.com/users/yamadashy/orgs","repos_url":"https://api.github.com/users/yamadashy/repos","events_url":"https://api.github.com/users/yamadashy/events{/privacy}","received_events_url":"https://api.github.com/users/yamadashy/received_events","type":"User","user_view_type":"public","site_admin":false},"node_id":"RE_kwDOMVwZR84V4aWo","tag_name":"v1.18.0","target_commitish":"main","name":"v1.18.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-08-04T15:23:03Z","updated_at":"2026-08-08T04:31:26Z","published_at":"2026-08-08T04:31:26Z","assets":[],"tarball_url":"https://api.github.com/repos/yamadashy/repomix/tarball/v1.18.0","zipball_url":"https://api.github.com/repos/yamadashy/repomix/zipball/v1.18.0","body":"This release introduces sandbox mode for the MCP server, confining it to a single workspace directory, along with a set of security hardening changes across the MCP tool surface and remote repository processing!\n\n## What's New 🚀\n\n### MCP Sandbox Mode (#1753, #1754)\n\nThe MCP server can now be confined to a single workspace directory with the `--sandbox` flag:\n\n```bash\n# Confine to the current working directory\nrepomix --mcp --sandbox\n\n# Confine to a specific directory\nrepomix --mcp --sandbox path/to/project\n```\n\nBy default the MCP server can read any path the host user can, which is convenient for a trusted local assistant but too broad when the server is exposed to an untrusted client or agent, such as when embedding Repomix in a hosted application. In sandbox mode:\n\n- Every path is relative to the workspace root. Absolute paths, `~`, `..`, and Windows drive/UNC paths are refused, and paths that resolve outside the root (including through symlinks) are dropped.\n- Results and error messages are virtualized, so host paths are never exposed.\n- Only the read-only, root-confined tools are registered: `pack_codebase`, `read_repomix_output`, `grep_repomix_output`, `file_system_read_file`, and `file_system_read_directory`. Remote packing, skill generation, and attaching external outputs are disabled.\n\nThis is an application-level confinement of the tool surface, not an OS-level sandbox: when hosting the server for untrusted clients, still run it under your platform's usual isolation (containers, dedicated users).\n\nSee [MCP Server – Sandbox Mode](https://repomix.com/guide/mcp-server#sandbox-mode) for details.\n\nSpecial thanks to @huy-trn for designing and implementing this feature. Great to have a long-time contributor back! 🎉\n\n## Security Hardening 🔒\n\n### MCP File System Tools Are Now Sandbox-Only\n\nThe `file_system_read_file` and `file_system_read_directory` tools are now registered **only in sandbox mode**. Outside `--sandbox` they could read any path the process can, while their built-in Secretlint scan was presented as more protection than it provides: it recognizes known secret formats in file content, and nothing else. In sandbox mode the workspace root gives these tools a real access boundary, with the secret scan kept as an additional heuristic safeguard.\n\nIf your MCP setup relied on these two tools, add `--sandbox [dir]` to the server arguments to keep using them, confined to that workspace.\n\nTool descriptions and documentation have also been reworded across the board to describe the Secretlint scan as what it is: a best-effort content heuristic, not an access boundary.\n\nSee the security advisory for details. Thanks to @rafaelfiguereod-stack for the report! 🙏\nhttps://github.com/yamadashy/repomix/security/advisories/GHSA-rpmv-562j-qxrv\n\n### Credentials in Repository URLs Are Redacted Before Logging\n\nRemote URLs are routinely written with credentials inline (`https://<token>@github.com/owner/repo.git`), especially in CI. Repomix previously echoed such URLs as-is into console output, trace logs, error messages (git repeats the full command line in its failure output), and the MCP `pack_remote_repository` response, persisting the credential in terminal scrollback, CI build logs, and log aggregation systems. All of these paths now redact userinfo credentials and known credential query parameters (`token`, `private_token`, `access_token`, and similar) before the URL is written anywhere.\n\nSee the security advisory for details. Thanks to @kakashi-kx for the report! 🙏\nhttps://github.com/yamadashy/repomix/security/advisories/GHSA-w8cw-mgw9-74h7\n\n### Cloud Metadata Endpoints Are Refused as Clone Targets\n\nRemote packing now refuses to clone from cloud instance metadata endpoints (`169.254.0.0/16`, `fd00:ec2::254`, `100.100.100.200`, `metadata.google.internal`), which serve credentials and host no git repository. Through the MCP server an AI agent chooses the URL, so an injected instruction could otherwise aim a clone at an address the user never asked for. Private networks (RFC1918) remain allowed, since cloning from self-hosted git servers is normal.\n\n## How to Update\n\n```bash\nnpm update -g repomix\n```\n\n---\n\nAs always, if you have any issues or suggestions, please let us know on GitHub issues or our [Discord community](https://discord.gg/wNYzTwZFku).\n","reactions":{"url":"https://api.github.com/repos/yamadashy/repomix/releases/367109544/reactions","total_count":3,"+1":0,"-1":0,"laugh":0,"hooray":3,"confused":0,"heart":0,"rocket":0,"eyes":0},"mentions_count":3},{"url":"https://api.github.com/repos/yamadashy/repomix/releases/357447559","assets_url":"https://api.github.com/repos/yamadashy/repomix/releases/357447559/assets","upload_url":"https://uploads.github.com/repos/yamadashy/repomix/releases/357447559/assets{?name,label}","html_url":"https://github.com/yamadashy/repomix/releases/tag/v1.17.0","id":357447559,"author":{"login":"yamadashy","id":5019072,"node_id":"MDQ6VXNlcjUwMTkwNzI=","avatar_url":"https://avatars.githubusercontent.com/u/5019072?v=4","gravatar_id":"","url":"https://api.github.com/users/yamadashy","html_url":"https://github.com/yamadashy","followers_url":"https://api.github.com/users/yamadashy/followers","following_url":"https://api.github.com/users/yamadashy/following{/other_user}","gists_url":"https://api.github.com/users/yamadashy/gists{/gist_id}","starred_url":"https://api.github.com/users/yamadashy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yamadashy/subscriptions","organizations_url":"https://api.github.com/users/yamadashy/orgs","repos_url":"https://api.github.com/users/yamadashy/repos","events_url":"https://api.github.com/users/yamadashy/events{/privacy}","received_events_url":"https://api.github.com/users/yamadashy/received_events","type":"User","user_view_type":"public","site_admin":false},"node_id":"RE_kwDOMVwZR84VTjeH","tag_name":"v1.17.0","target_commitish":"main","name":"v1.17.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-07-21T15:18:45Z","updated_at":"2026-07-22T13:40:39Z","published_at":"2026-07-21T15:25:07Z","assets":[],"tarball_url":"https://api.github.com/repos/yamadashy/repomix/tarball/v1.17.0","zipball_url":"https://api.github.com/repos/yamadashy/repomix/zipball/v1.17.0","body":"This release introduces custom file processors, an interactive confirmation before a remote repository's config is trusted, and per-file inclusion levels for the MCP pack tools!\n\n## What's New 🚀\n\n### Custom File Processors (#1720, #933)\n\nYou can now run an external command on matching files **before** they are packed, so the packed output contains the transformed content. This opens the door to token-saving conversions like JSON→TOON, SVG minification, or notebook→script conversion.\n\n```json5\n{\n  \"input\": {\n    \"processors\": [\n      { \"pattern\": \"**/*.json\", \"command\": \"npx @toon-format/cli {file}\" }\n    ]\n  }\n}\n```\n\nEach entry is `{ pattern, command, timeout?, onError? }`, matched the same way as `include` / `ignore` and evaluated in array order (first match wins, one processor per file). The required `{file}` placeholder is replaced with a temporary copy of the file, and the command's stdout becomes the new content, which then flows through the security check, token counting, and output like any other file.\n\n- `timeout`: per-command timeout in ms (default `60000`)\n- `onError`: `\"fail\"` (default, aborts the pack) or `\"skip\"` (warn and keep the original content)\n\nBecause processors run **arbitrary commands**, execution is default-deny: they run only when you invoke the repomix CLI directly. The library API, the MCP server, and the hosted website never run them, and a cloned remote repository's processors are honored only with `--remote-trust-config`. Active processors are printed at startup.\n\nSee [File Processors](https://repomix.com/guide/configuration#file-processors) for details.\n\n### Confirm Before Trusting a Remote Repository's Config (#1747)\n\nA `repomix.config.*` is code, not just data: a `.ts` / `.js` config is executed when loaded, `input.processors` runs external commands, and path options can read files outside the repository. A cloned repository's config is still never loaded by default, but when you opt in with `--remote-trust-config`, Repomix now shows you the config that is about to run and asks before loading it:\n\n```\n⚠ user/repo ships a config file that will be trusted: repomix.config.json\n  A trusted config can run arbitrary commands (input.processors) and read local files.\n────────────────────────────────────────────────────────────────────────\n| { \"output\": { \"style\": \"xml\" } }\n────────────────────────────────────────────────────────────────────────\n\n? Trust and run this config from user/repo? It can run arbitrary commands on your machine.\n❯ Yes, once\n  Yes, and don't ask again for this repository\n  No, do not run\n```\n\n\"Don't ask again\" is pinned to the config's contents, so you are asked again if that repository later ships a different one, the same model as `direnv allow`. The safe answer is the default, and the displayed config is escaped and capped so a repository cannot repaint your terminal or hide part of what you are approving.\n\n> [!NOTE]\n> **`REPOMIX_REMOTE_TRUST_CONFIG=true` now prompts on an interactive terminal.** Non-interactive shells such as CI are unchanged and keep trusting the config as before, so existing automation keeps working. Passing `--force` also skips the prompt.\n\nThanks to @nuc13us and @sumo166, whose reports on how much `--remote-trust-config` hands over prompted this work and the accompanying documentation. 🙏\n\n### MCP: Per-File Inclusion Levels for Pack Tools (#1719, #608)\n\nThe `pack_codebase` and `pack_remote_repository` MCP tools now accept an `outputPatterns` parameter, so an AI agent can decide per file whether to include full content, compressed content, or the directory structure only, on a per-call basis.\n\nThis is especially useful for remote repositories: a remote repository's own config (including its `output.patterns`) is never loaded, so `outputPatterns` is the way to control inclusion levels there.\n\nSee [MCP Server](https://repomix.com/guide/mcp-server) for details.\n\n## Improvements ⚡\n\n### Split Output for Repositories with One Oversized Directory (#1724, #1134)\n\n`repomix --split-output 1mb` failed with `Cannot split output: root entry 'src' exceeds max size` on any repository where a single top-level directory was larger than the part limit — a common layout. Oversized directories are now subdivided instead of aborting.\n\nSpecial thanks to @serhiizghama for this contribution! 🎉\n\n### Markdown Output Fixes\n\n- Language hints are now resolved for extensionless filenames in subdirectories (for example `docs/Makefile`), instead of falling back to no hint. (#1727)\n- Code fences are widened so a git diff containing a triple-backtick block can no longer break out of its fence. (#1725)\n\nSpecial thanks to @serhiizghama for these contributions! 🎉\n\n### Correct Output-File Ignoring on Windows (#1748)\n\nRepomix excludes its own output file from packing, but the ignore pattern used the OS separator while the matcher expects forward slashes. On Windows, a nested output path such as `--output docs/out.xml` therefore never matched and the output file was packed into itself on the next run. The pattern is now normalized to POSIX separators.\n\nSpecial thanks to @serhiizghama for this contribution! 🎉\n\n### Skip Legacy Config Migration for Remote Repositories (#1726)\n\nPacking a remote repository that still ships legacy Repopack config files triggered an interactive migration prompt and rewrote files inside the temporary clone. Remote runs now skip migration entirely.\n\nSpecial thanks to @ShiroKSH for their first contribution! 🎉\n\n## Documentation 📚\n\nThe trust model for `--remote-trust-config` is now documented explicitly (#1746, #1747): what a trusted config can do, what the confirmation prompt protects against, and where the \"don't ask again\" decision is stored, including the limits of that pin. See [Remote Repository Config Trust](https://repomix.com/guide/security#remote-repository-config-trust).\n\n## How to Update\n\n```bash\nnpm update -g repomix\n```\n\n---\n\nAs always, if you have any issues or suggestions, please let us know on GitHub issues or our [Discord community](https://discord.gg/wNYzTwZFku).\n","mentions_count":4},{"url":"https://api.github.com/repos/yamadashy/repomix/releases/352511354","assets_url":"https://api.github.com/repos/yamadashy/repomix/releases/352511354/assets","upload_url":"https://uploads.github.com/repos/yamadashy/repomix/releases/352511354/assets{?name,label}","html_url":"https://github.com/yamadashy/repomix/releases/tag/v1.16.1","id":352511354,"author":{"login":"yamadashy","id":5019072,"node_id":"MDQ6VXNlcjUwMTkwNzI=","avatar_url":"https://avatars.githubusercontent.com/u/5019072?v=4","gravatar_id":"","url":"https://api.github.com/users/yamadashy","html_url":"https://github.com/yamadashy","followers_url":"https://api.github.com/users/yamadashy/followers","following_url":"https://api.github.com/users/yamadashy/following{/other_user}","gists_url":"https://api.github.com/users/yamadashy/gists{/gist_id}","starred_url":"https://api.github.com/users/yamadashy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yamadashy/subscriptions","organizations_url":"https://api.github.com/users/yamadashy/orgs","repos_url":"https://api.github.com/users/yamadashy/repos","events_url":"https://api.github.com/users/yamadashy/events{/privacy}","received_events_url":"https://api.github.com/users/yamadashy/received_events","type":"User","user_view_type":"public","site_admin":false},"node_id":"RE_kwDOMVwZR84VAuV6","tag_name":"v1.16.1","target_commitish":"main","name":"v1.16.1","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-07-11T12:26:38Z","updated_at":"2026-07-11T12:36:28Z","published_at":"2026-07-11T12:36:28Z","assets":[],"tarball_url":"https://api.github.com/repos/yamadashy/repomix/tarball/v1.16.1","zipball_url":"https://api.github.com/repos/yamadashy/repomix/zipball/v1.16.1","body":"This release is a bug-fix patch: it plugs a WebAssembly memory leak, extends comment removal to more JavaScript/TypeScript module files, and fixes the token count tree for underscore-prefixed directories and the directory tree on Windows. Updating to 1.16.1 is recommended for all users.\n\n## Improvements ⚡\n\n### Fixed a WebAssembly Memory Leak (#1681)\n\nParsed `web-tree-sitter` `Tree` objects were not released after use, leaking WebAssembly heap memory when parsing or compressing many files — noticeable on large repositories. Each tree is now freed right after parsing, keeping memory usage stable.\n\nSpecial thanks to @isaka1022 for their first contribution! 🎉\n\n### Comment Removal for More Module Files (#1683)\n\n`--remove-comments` now strips comments from JavaScript/TypeScript module files that were previously skipped — `.mjs`, `.cjs`, `.mts`, `.cts`, and their JSX variants `.mjsx` / `.mtsx`.\n\n```bash\nrepomix --remove-comments\n```\n\nSpecial thanks to @serhiizghama for this contribution! 🎉\n\n### Token Count Tree: Count Underscore-Prefixed Directories (#1710)\n\nDirectories whose names start with an underscore (for example `__tests__` or `__mocks__`) were dropped from the `--token-count-tree` output and excluded from the token totals. They are now rendered and counted like any other directory.\n\n```bash\nrepomix --token-count-tree\n```\n\nSpecial thanks to @serhiizghama for this contribution! 🎉\n\n### Correct Directory Tree and File Ordering on Windows (#1712)\n\nOn Windows, the `<directory_structure>` section collapsed into a flat list of full paths and file sorting fell back to a plain string comparison, because already-normalized (`/`-separated) paths were being split on the OS separator (`\\`). Paths are now normalized before splitting, so the tree nests correctly and files sort in directory-aware order on every platform.\n\nSpecial thanks to @serhiizghama for this contribution! 🎉\n\n## How to Update\n\n```bash\nnpm update -g repomix\n```\n\n---\n\nAs always, if you have any issues or suggestions, please let us know on GitHub issues or our [Discord community](https://discord.gg/wNYzTwZFku).\n","mentions_count":2},{"url":"https://api.github.com/repos/yamadashy/repomix/releases/346324408","assets_url":"https://api.github.com/repos/yamadashy/repomix/releases/346324408/assets","upload_url":"https://uploads.github.com/repos/yamadashy/repomix/releases/346324408/assets{?name,label}","html_url":"https://github.com/yamadashy/repomix/releases/tag/v1.16.0","id":346324408,"author":{"login":"yamadashy","id":5019072,"node_id":"MDQ6VXNlcjUwMTkwNzI=","avatar_url":"https://avatars.githubusercontent.com/u/5019072?v=4","gravatar_id":"","url":"https://api.github.com/users/yamadashy","html_url":"https://github.com/yamadashy","followers_url":"https://api.github.com/users/yamadashy/followers","following_url":"https://api.github.com/users/yamadashy/following{/other_user}","gists_url":"https://api.github.com/users/yamadashy/gists{/gist_id}","starred_url":"https://api.github.com/users/yamadashy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yamadashy/subscriptions","organizations_url":"https://api.github.com/users/yamadashy/orgs","repos_url":"https://api.github.com/users/yamadashy/repos","events_url":"https://api.github.com/users/yamadashy/events{/privacy}","received_events_url":"https://api.github.com/users/yamadashy/received_events","type":"User","user_view_type":"public","site_admin":false},"node_id":"RE_kwDOMVwZR84UpH24","tag_name":"v1.16.0","target_commitish":"main","name":"v1.16.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-06-29T14:18:24Z","updated_at":"2026-06-29T14:42:02Z","published_at":"2026-06-29T14:42:02Z","assets":[],"tarball_url":"https://api.github.com/repos/yamadashy/repomix/tarball/v1.16.0","zipball_url":"https://api.github.com/repos/yamadashy/repomix/zipball/v1.16.0","body":"This release adds **per-file inclusion levels** via `output.patterns` for fine-grained control over how each file is packed, a new **cwd-relative output path style**, and a **`--skill-project-name`** option, along with compression-robustness and file-matching fixes.\n\n## What's New 🚀\n\n### Per-file Inclusion Levels (`output.patterns`) (#1653, #608)\n\nYou can now control the detail level **per glob** from your configuration file. `output.patterns` is an ordered array of `{ pattern, compress?, directoryStructureOnly? }` entries; the first matching glob wins and overrides the global `output.compress` for that file. Each file resolves to one of three levels:\n\n- **Full content** (default)\n- **Compressed** (`compress: true`) — passed through the same Tree-sitter pipeline as `output.compress`\n- **Directory-structure-only** (`directoryStructureOnly: true`) — listed in the directory structure, but its content is omitted\n\nFor example, compress `docs/**` while reducing `website/**` to structure only:\n\n```json5\n{\n  \"output\": {\n    \"compress\": false,\n    \"patterns\": [\n      { \"pattern\": \"docs/**/*\", \"compress\": true },\n      { \"pattern\": \"website/**/*\", \"directoryStructureOnly\": true }\n    ]\n  }\n}\n```\n\nThis option is config-file only. See [Per-file Inclusion Levels](https://repomix.com/guide/configuration#per-file-inclusion-levels).\n\nSpecial thanks to @PAMulligan for designing and implementing this feature! 🎉\n\n### cwd-relative Output Path Style (#1646)\n\nA new output path style renders file paths relative to the current working directory instead of the target directory — handy for multi-root runs and clearer paths. Set `output.filePathStyle: \"cwd-relative\"` in your config, or pass `--output-file-path-style cwd-relative` (default remains `target-relative`).\n\nSpecial thanks to @Samsen879 for this contribution! 🎉\n\n### `--skill-project-name` Option (#1649)\n\nSkill generation now exposes a `--skill-project-name` option so you can set the project name explicitly.\n\nSpecial thanks to @WilliamK112 for this contribution! 🎉\n\n## Improvements ⚡\n\n- `--compress` is now resilient: a single file that Tree-sitter cannot parse — including pathological files that trigger a WASM runtime abort — no longer aborts the whole pack. It falls back to uncompressed output with a warning, and the rest of the run completes normally (#1679, #1668).\n- File extensions are now matched case-insensitively when selecting the comment manipulator, so files like `.PY` or `.TS` are handled correctly (#1632).\n- Split-output files are now copied correctly after remote packing (#1631).\n\nSpecial thanks to @serhiizghama and @Samsen879 for these fixes! 🎉\n\n## How to Update\n\n```bash\nnpm update -g repomix\n```\n\n---\n\nAs always, if you have any issues or suggestions, please let us know on GitHub issues or our [Discord community](https://discord.gg/wNYzTwZFku).\n","mentions_count":4},{"url":"https://api.github.com/repos/yamadashy/repomix/releases/341488614","assets_url":"https://api.github.com/repos/yamadashy/repomix/releases/341488614/assets","upload_url":"https://uploads.github.com/repos/yamadashy/repomix/releases/341488614/assets{?name,label}","html_url":"https://github.com/yamadashy/repomix/releases/tag/v1.15.0","id":341488614,"author":{"login":"yamadashy","id":5019072,"node_id":"MDQ6VXNlcjUwMTkwNzI=","avatar_url":"https://avatars.githubusercontent.com/u/5019072?v=4","gravatar_id":"","url":"https://api.github.com/users/yamadashy","html_url":"https://github.com/yamadashy","followers_url":"https://api.github.com/users/yamadashy/followers","following_url":"https://api.github.com/users/yamadashy/following{/other_user}","gists_url":"https://api.github.com/users/yamadashy/gists{/gist_id}","starred_url":"https://api.github.com/users/yamadashy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yamadashy/subscriptions","organizations_url":"https://api.github.com/users/yamadashy/orgs","repos_url":"https://api.github.com/users/yamadashy/repos","events_url":"https://api.github.com/users/yamadashy/events{/privacy}","received_events_url":"https://api.github.com/users/yamadashy/received_events","type":"User","user_view_type":"public","site_admin":false},"node_id":"RE_kwDOMVwZR84UWrPm","tag_name":"v1.15.0","target_commitish":"main","name":"v1.15.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-06-18T15:23:03Z","updated_at":"2026-06-18T15:33:36Z","published_at":"2026-06-18T15:23:22Z","assets":[],"tarball_url":"https://api.github.com/repos/yamadashy/repomix/tarball/v1.15.0","zipball_url":"https://api.github.com/repos/yamadashy/repomix/zipball/v1.15.0","body":"This release adds **Watch Mode** for continuous re-packing, **GitHub shorthand auto-detection** so you can run `repomix owner/repo` without `--remote`, and a **`--token-budget` guard** for CI and agent workflows, along with several ignore-handling fixes.\n\n## What's New 🚀\n\n### Watch Mode (`-w`, `--watch`) (#1643, #1647, #1429)\n\nRepomix can now watch your codebase and automatically re-pack on every change. New, changed, and deleted files are detected, rapid bursts are debounced (300 ms), and a timestamp is printed after each rebuild. Press `Ctrl+C` to stop. Watch mode honors your usual ignore rules (`.gitignore`, `.repomixignore`, default patterns, `--ignore`) and skips ignored directories to stay efficient on large projects. It is local-only, so it cannot be combined with `--remote`, `--stdout`, `--stdin`, `--split-output`, `--skill-generate`, or `--copy`. See the new [Watch Mode guide](https://repomix.com/guide/watch-mode).\n\nSpecial thanks to @PAMulligan for designing and implementing the entire watch mode feature! 🎉\n\n### GitHub Shorthand Auto-Detection (#1628, #1120)\n\nYou can now run `repomix owner/repo` directly, without the `--remote` flag. When the argument matches the `owner/repo` shorthand and no local path of that name exists, Repomix probes GitHub (a lightweight HEAD-only check) and packs the remote repository if it is reachable. A matching local path always wins; prefix with `./` to force local handling.\n\nSpecial thanks to @serhiizghama for this contribution! 🎉\n\n### `--token-budget <number>` Guard (#1621, #1616)\n\nA new `--token-budget` option exits with a non-zero code when the packed output exceeds N tokens. The output is still generated; only the exit code signals the overflow, making it a useful guard in CI pipelines and agent workflows to keep output within a target model's context window.\n\n## Improvements ⚡\n\n- Fixed `.gitignore` handling edge cases: ignored `.gitignore` rules stay active, trailing-slash ignore-control patterns no longer leak the file, and descendants of a directory literally named `.gitignore` are excluded (#1622, #624).\n- Fixed duplicate relative paths when packing multiple roots (#1618).\n- Updated root dependencies, including major bumps to v15 (#1641).\n\nSpecial thanks to @Samsen879 for the ignore-handling and multi-root fixes! 🎉\n\n## How to Update\n\n```bash\nnpm update -g repomix\n```\n\n---\n\nAs always, if you have any issues or suggestions, please let us know on GitHub issues or our [Discord community](https://discord.gg/wNYzTwZFku).","reactions":{"url":"https://api.github.com/repos/yamadashy/repomix/releases/341488614/reactions","total_count":1,"+1":0,"-1":0,"laugh":0,"hooray":1,"confused":0,"heart":0,"rocket":0,"eyes":0},"mentions_count":3},{"url":"https://api.github.com/repos/yamadashy/repomix/releases/330307076","assets_url":"https://api.github.com/repos/yamadashy/repomix/releases/330307076/assets","upload_url":"https://uploads.github.com/repos/yamadashy/repomix/releases/330307076/assets{?name,label}","html_url":"https://github.com/yamadashy/repomix/releases/tag/v1.14.1","id":330307076,"author":{"login":"yamadashy","id":5019072,"node_id":"MDQ6VXNlcjUwMTkwNzI=","avatar_url":"https://avatars.githubusercontent.com/u/5019072?v=4","gravatar_id":"","url":"https://api.github.com/users/yamadashy","html_url":"https://github.com/yamadashy","followers_url":"https://api.github.com/users/yamadashy/followers","following_url":"https://api.github.com/users/yamadashy/following{/other_user}","gists_url":"https://api.github.com/users/yamadashy/gists{/gist_id}","starred_url":"https://api.github.com/users/yamadashy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yamadashy/subscriptions","organizations_url":"https://api.github.com/users/yamadashy/orgs","repos_url":"https://api.github.com/users/yamadashy/repos","events_url":"https://api.github.com/users/yamadashy/events{/privacy}","received_events_url":"https://api.github.com/users/yamadashy/received_events","type":"User","user_view_type":"public","site_admin":false},"node_id":"RE_kwDOMVwZR84TsBYE","tag_name":"v1.14.1","target_commitish":"main","name":"v1.14.1","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-05-26T15:45:16Z","updated_at":"2026-05-27T15:29:48Z","published_at":"2026-05-27T15:29:48Z","assets":[],"tarball_url":"https://api.github.com/repos/yamadashy/repomix/tarball/v1.14.1","zipball_url":"https://api.github.com/repos/yamadashy/repomix/zipball/v1.14.1","body":"This release patches two security advisories and continues the performance work from v1.14.0 with a persistent token-count cache, plus expanded Dart parsing and Nix support. Updating to 1.14.1 is recommended for all users.\r\n\r\n## Security 🔒\r\n\r\n### Argument Injection via `--remote-branch` (GHSA-9mm9-rqhj-j5mx)\r\n\r\nA crafted `--remote-branch` value could be passed to `git` as an option rather than a ref, enabling argument injection (CWE-88, High). Repomix now validates refs and inserts `--end-of-options` before the ref in `git fetch` and `git checkout`, so a branch value can never be interpreted as a git option.\r\n\r\nSpecial thanks to @kakashi-kx (Abhijith S) for the responsible disclosure! 🎉\r\n\r\n### MCP `attach_packed_output` Secret-Scan Bypass (GHSA-hwpp-h97w-2h3j)\r\n\r\nThe MCP `attach_packed_output` flow could register an arbitrary local file and read it back through `read_repomix_output` / `grep_repomix_output` without the secret scan that `file_system_read_file` applies (CWE-200, Moderate). Those tools now run the same secret scan on attach-sourced files before returning content, closing the bypass.\r\n\r\nSpecial thanks to @dodge1218 for the responsible disclosure! 🎉\r\n\r\n## Improvements ⚡\r\n\r\n### Expanded Dart Code Parsing (#1515)\r\n\r\nThe Dart Tree-sitter query now captures mixins, typedefs, getters, setters, and factory constructors. Compressed output (`--compress`) for Dart files now preserves more of the file's structure.\r\n\r\n### Content-Addressed Token-Count Disk Cache (#1562, #1580)\r\n\r\nToken counts are now cached on disk, keyed by content hash. Re-packing a repository reuses counts for unchanged files instead of re-tokenizing them, and the eager metrics warm-up is skipped when the cache is already populated — speeding up repeated runs on the same repository.\r\n\r\n### Faster Binary Detection (#1542)\r\n\r\nRepomix now attempts a UTF-8 decode before the binary-file check, avoiding a pathological slow path in the protobuf detector on certain inputs.\r\n\r\n### Node.js Support Update (#1556)\r\n\r\nNode.js 20 is no longer supported and Node.js 26 is now supported. Repomix requires Node.js 22 or later.\r\n\r\n### Available on nixpkgs\r\n\r\nRepomix is available in [nixpkgs](https://search.nixos.org/packages?query=repomix), so Nix users can install it directly:\r\n\r\n```bash\r\nnix-shell -p repomix\r\n```\r\n\r\n## Development 🛠️\r\n\r\n### Nix Flake with Development Shell (#1525)\r\n\r\nAdded a `flake.nix` providing a development shell (Node.js 24 + Git) for contributors using Nix:\r\n\r\n```bash\r\nnix develop\r\n```\r\n\r\n## How to Update\r\n\r\n```bash\r\nnpm update -g repomix\r\n```\r\n\r\n---\r\n\r\nAs always, if you have any issues or suggestions, please let us know on GitHub issues or our [Discord community](https://discord.gg/wNYzTwZFku).\r\n","reactions":{"url":"https://api.github.com/repos/yamadashy/repomix/releases/330307076/reactions","total_count":2,"+1":0,"-1":0,"laugh":0,"hooray":2,"confused":0,"heart":0,"rocket":0,"eyes":0},"mentions_count":2},{"url":"https://api.github.com/repos/yamadashy/repomix/releases/313763716","assets_url":"https://api.github.com/repos/yamadashy/repomix/releases/313763716/assets","upload_url":"https://uploads.github.com/repos/yamadashy/repomix/releases/313763716/assets{?name,label}","html_url":"https://github.com/yamadashy/repomix/releases/tag/v1.14.0","id":313763716,"author":{"login":"yamadashy","id":5019072,"node_id":"MDQ6VXNlcjUwMTkwNzI=","avatar_url":"https://avatars.githubusercontent.com/u/5019072?v=4","gravatar_id":"","url":"https://api.github.com/users/yamadashy","html_url":"https://github.com/yamadashy","followers_url":"https://api.github.com/users/yamadashy/followers","following_url":"https://api.github.com/users/yamadashy/following{/other_user}","gists_url":"https://api.github.com/users/yamadashy/gists{/gist_id}","starred_url":"https://api.github.com/users/yamadashy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yamadashy/subscriptions","organizations_url":"https://api.github.com/users/yamadashy/orgs","repos_url":"https://api.github.com/users/yamadashy/repos","events_url":"https://api.github.com/users/yamadashy/events{/privacy}","received_events_url":"https://api.github.com/users/yamadashy/received_events","type":"User","user_view_type":"public","site_admin":false},"node_id":"RE_kwDOMVwZR84Ss6eE","tag_name":"v1.14.0","target_commitish":"main","name":"v1.14.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-04-26T14:04:36Z","updated_at":"2026-04-26T14:46:56Z","published_at":"2026-04-26T14:36:04Z","assets":[],"tarball_url":"https://api.github.com/repos/yamadashy/repomix/tarball/v1.14.0","zipball_url":"https://api.github.com/repos/yamadashy/repomix/zipball/v1.14.0","body":"This release is a major performance overhaul — packing the Repomix repository now takes **about 1.4 seconds (down from 3.3 seconds in v1.13.1) — roughly 2.4× faster, a 58% reduction**. Faster startup, lighter dependencies, and a smarter pipeline that overlaps work across stages.\r\n\r\n## What's New 🚀\r\n\r\n### Monorepo-Aware Tech Stack Detection (#1310, #1317)\r\n\r\nThe skill generator (`--skill-generate`) now detects dependency files in subdirectories and groups results by package directory. Monorepos with packages under `packages/*/package.json`, `apps/*/package.json`, etc. now produce a `tech-stacks.md` with a separate section per workspace, each listing its own languages, frameworks, dependencies, and runtime versions. Previously only the root-level dependency file was inspected.\r\n\r\n## Improvements ⚡\r\n\r\nThe 58% pack-time reduction is the cumulative result of dozens of optimizations across startup, the pipeline, worker IPC, and remote downloads — no single change accounts for the full speedup. The most impactful changes are highlighted below.\r\n\r\n<img width=\"1184\" height=\"596\" alt=\"image\" src=\"https://github.com/user-attachments/assets/dbab50ae-1308-4b0e-847b-94a46496a596\" />\r\n\r\n### Replaced tiktoken WASM with gpt-tokenizer (#1350)\r\n\r\nToken counting now uses [gpt-tokenizer](https://github.com/niieani/gpt-tokenizer), a pure-JavaScript tokenizer, in place of the previous WASM-based `tiktoken`. This eliminates ~200 ms of WASM initialization overhead from startup and works in environments where WASM is restricted. Token counts are preserved — `gpt-tokenizer` is configured to match `tiktoken`'s default behavior.\r\n\r\n### Eliminated Child Process in Default Action (#1372)\r\n\r\nThe default `repomix` action no longer spawns a child process for the main pack flow. This removes process startup overhead — most noticeable on smaller repositories where startup was a meaningful fraction of total time.\r\n\r\n### Wrapper-Extraction Fast Path for Token Counting (-13.2%) (#1457)\r\n\r\nFor non-parsable XML/Markdown/Plain output, Repomix now reuses per-file token counts and tokenizes only the output \"wrapper\" (header, separators, footer) instead of re-tokenizing the entire ~MB-scale output. This delivers a **~13% reduction in total pack time** on typical repositories.\r\n\r\n### Pipeline Parallelization\r\n\r\nThe pack pipeline now overlaps stages that don't depend on each other:\r\n- Security check and file processing run concurrently (#1359)\r\n- Output generation overlaps with metrics calculation (#1359)\r\n- Git sort data is prefetched alongside file search and collection (#1467)\r\n- Wrapper tokenization runs in parallel with file metrics (#1469)\r\n- CLI actions are lazy-loaded so each command imports only what it needs (#1346)\r\n\r\n### Faster Startup\r\n\r\n- Removed Zod from the startup path (#1306)\r\n- Lazy-loaded `handlebars`, `fast-xml-builder`, and `@clack/prompts` (#1436)\r\n- Lazy-loaded `jschardet` and `iconv-lite` for encoding detection (#1401)\r\n- Removed `gpt-tokenizer` from the config schema's import chain (#1500)\r\n- Skipped the worker pool when only lightweight transforms are needed (#1338)\r\n- Eliminated a redundant `stat()` syscall in file reading (#1400)\r\n\r\n### Worker & IPC Optimizations\r\n\r\n- Batched token counting IPC (#1411)\r\n- Batched security check tasks (#1380)\r\n- Warmed up metrics worker threads in parallel (#1374)\r\n- Capped security worker threads at 2 to reduce contention (#1409)\r\n- Cached empty-directory paths across pipeline stages (#1356)\r\n- Combined file and directory globby walks into a single traversal (#1506)\r\n\r\n### Faster Remote Repository Downloads\r\n\r\n- Used codeload.github.com URLs directly to skip the 302 redirect (#1375)\r\n- Skipped binary files during tar extraction (#1392)\r\n\r\n### `@secretlint/profiler` Overhead Removed (-6.5%)\r\n\r\nDisabling the profiler in the security worker reduced pack time by ~6.5% (#1453). A follow-up patch to `perf_hooks.performance.mark` handles duplicate `@secretlint/profiler` singletons that survive across hoisted/nested copies (#1456).\r\n\r\n## How to Update\r\n\r\n```bash\r\nnpm update -g repomix\r\n```\r\n\r\n---\r\n\r\nAs always, if you have any issues or suggestions, please let us know on GitHub issues or our [Discord community](https://discord.gg/wNYzTwZFku).\r\n","reactions":{"url":"https://api.github.com/repos/yamadashy/repomix/releases/313763716/reactions","total_count":3,"+1":1,"-1":0,"laugh":0,"hooray":0,"confused":0,"heart":0,"rocket":2,"eyes":0}},{"url":"https://api.github.com/repos/yamadashy/repomix/releases/301917834","assets_url":"https://api.github.com/repos/yamadashy/repomix/releases/301917834/assets","upload_url":"https://uploads.github.com/repos/yamadashy/repomix/releases/301917834/assets{?name,label}","html_url":"https://github.com/yamadashy/repomix/releases/tag/v1.13.1","id":301917834,"author":{"login":"yamadashy","id":5019072,"node_id":"MDQ6VXNlcjUwMTkwNzI=","avatar_url":"https://avatars.githubusercontent.com/u/5019072?v=4","gravatar_id":"","url":"https://api.github.com/users/yamadashy","html_url":"https://github.com/yamadashy","followers_url":"https://api.github.com/users/yamadashy/followers","following_url":"https://api.github.com/users/yamadashy/following{/other_user}","gists_url":"https://api.github.com/users/yamadashy/gists{/gist_id}","starred_url":"https://api.github.com/users/yamadashy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yamadashy/subscriptions","organizations_url":"https://api.github.com/users/yamadashy/orgs","repos_url":"https://api.github.com/users/yamadashy/repos","events_url":"https://api.github.com/users/yamadashy/events{/privacy}","received_events_url":"https://api.github.com/users/yamadashy/received_events","type":"User","user_view_type":"public","site_admin":false},"node_id":"RE_kwDOMVwZR84R_uaK","tag_name":"v1.13.1","target_commitish":"main","name":"v1.13.1","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-03-26T14:43:35Z","updated_at":"2026-03-26T14:52:20Z","published_at":"2026-03-26T14:52:19Z","assets":[],"tarball_url":"https://api.github.com/repos/yamadashy/repomix/tarball/v1.13.1","zipball_url":"https://api.github.com/repos/yamadashy/repomix/zipball/v1.13.1","body":"This release fixes a false positive in base64 detection and brings a lighter clipboard dependency!\r\n\r\n## Bug Fixes 🐛\r\n\r\n### Fixed Base64 Detection False Positives (#1307, #1298)\r\n\r\nThe `truncateBase64` feature was incorrectly truncating XPath and path-like strings (e.g., `postTransactionAmounts/sharesOwnedFollowingTransaction/value`) that contained only letters and `/` characters.\r\n\r\nTwo improvements were made:\r\n- Raised the minimum standalone base64 detection threshold from 60 to 256 characters\r\n- Added a digits requirement to the heuristic — real base64-encoded binary data virtually always contains digits, while path-like strings typically don't\r\n\r\nSpecial thanks to @NaustudentX14 for the detailed bug report! 🎉\r\n\r\n## Improvements ⚡\r\n\r\n### Migrated to tinyclip for Clipboard Operations (#1296)\r\n\r\nReplaced `clipboardy` with `tinyclip`, a zero-dependency clipboard library. This removes 41 transitive dependencies and reduces clipboard-related install size from ~4 MB to ~24 KB.\r\n\r\nSpecial thanks to @florian-lefebvre for their first contribution! 🎉\r\n\r\n## How to Update\r\n\r\n```bash\r\nnpm update -g repomix\r\n```\r\n\r\n---\r\n\r\nAs always, if you have any issues or suggestions, please let us know on GitHub issues or our [Discord community](https://discord.gg/wNYzTwZFku).\r\n","reactions":{"url":"https://api.github.com/repos/yamadashy/repomix/releases/301917834/reactions","total_count":1,"+1":0,"-1":0,"laugh":1,"hooray":0,"confused":0,"heart":0,"rocket":0,"eyes":0},"mentions_count":2},{"url":"https://api.github.com/repos/yamadashy/repomix/releases/300466320","assets_url":"https://api.github.com/repos/yamadashy/repomix/releases/300466320/assets","upload_url":"https://uploads.github.com/repos/yamadashy/repomix/releases/300466320/assets{?name,label}","html_url":"https://github.com/yamadashy/repomix/releases/tag/v1.13.0","id":300466320,"author":{"login":"yamadashy","id":5019072,"node_id":"MDQ6VXNlcjUwMTkwNzI=","avatar_url":"https://avatars.githubusercontent.com/u/5019072?v=4","gravatar_id":"","url":"https://api.github.com/users/yamadashy","html_url":"https://github.com/yamadashy","followers_url":"https://api.github.com/users/yamadashy/followers","following_url":"https://api.github.com/users/yamadashy/following{/other_user}","gists_url":"https://api.github.com/users/yamadashy/gists{/gist_id}","starred_url":"https://api.github.com/users/yamadashy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yamadashy/subscriptions","organizations_url":"https://api.github.com/users/yamadashy/orgs","repos_url":"https://api.github.com/users/yamadashy/repos","events_url":"https://api.github.com/users/yamadashy/events{/privacy}","received_events_url":"https://api.github.com/users/yamadashy/received_events","type":"User","user_view_type":"public","site_admin":false},"node_id":"RE_kwDOMVwZR84R6MCQ","tag_name":"v1.13.0","target_commitish":"main","name":"v1.13.0","draft":false,"immutable":true,"prerelease":false,"created_at":"2026-03-23T15:12:44Z","updated_at":"2026-03-24T01:27:36Z","published_at":"2026-03-24T01:27:35Z","assets":[],"tarball_url":"https://api.github.com/repos/yamadashy/repomix/tarball/v1.13.0","zipball_url":"https://api.github.com/repos/yamadashy/repomix/zipball/v1.13.0","body":"This release strengthens security with remote config sandboxing and a cleaner dependency footprint, while delivering significant performance improvements across the core pipeline!\r\n\r\n## What's New 🚀\r\n\r\n### Prevent Remote Config File Execution (#1292)\r\n\r\nPreviously, when packing a remote repository, Repomix would automatically load and execute any `repomix.config.ts` or `repomix.config.js` found in the repository. Since TypeScript/JavaScript configs are executed via `jiti`, a malicious repository could embed arbitrary code in its config file, leading to remote code execution (RCE) on the user's machine.\r\n\r\nRemote config files are now **skipped by default**. If you trust a remote repository and want to use its config, you can opt in with the new `--remote-trust-config` flag:\r\n\r\n```bash\r\n# Remote config is now safely ignored by default\r\nrepomix --remote https://github.com/user/repo\r\n\r\n# Explicitly trust the remote config\r\nrepomix --remote https://github.com/user/repo --remote-trust-config\r\n```\r\n\r\n## Improvements ⚡\r\n\r\n### Replace fast-xml-parser with fast-xml-builder (#1253, #1219)\r\n\r\nRepomix only uses `XMLBuilder` for output generation, not the XML parser. Switched to `fast-xml-builder` directly to eliminate recurring CVEs from the parser side, bringing `npm audit` to **0 vulnerabilities** and reducing dependency size from 831KB to 176KB.\r\n\r\n### Performance Optimizations (#1234, #1235, #1255)\r\n\r\nSeveral performance improvements across the core pipeline:\r\n- **File tree generation**: Map-based O(1) child lookups and single-pass sorting — `generateFileTree` **~82% faster**, `treeToString` **~70% faster** on 10,000 files\r\n- **Path sorting**: Decorate-sort-undecorate pattern with pre-computed `path.split()` — **6-7x faster**. `Set.has()` for `filterOutUntrustedFiles` — **up to 30x faster** at 10K files\r\n- **Compile cache propagation**: V8 compile cache (introduced in v1.12.0) now extends to Tinypool worker processes via environment variables, not just the main process\r\n\r\n### Fix Closure Memory Leaks (#1233)\r\n\r\nReplaced arrow functions with `.bind()` in `setTimeout`/`setInterval` callbacks to prevent closures from capturing scope and retaining references to large objects. Added proper `dispose()` methods and `.unref()` calls for cleanup.\r\n\r\n## Website Enhancements 🌐\r\n\r\n### Turkish Language Support (#1194)\r\n\r\nAdded Turkish (Türkçe) translation to [repomix.com](https://repomix.com), based on Google Analytics data showing strong engagement from Turkish-speaking users.\r\n\r\n### LLMO Optimization with JSON-LD and llms.txt (#1236)\r\n\r\nAdded JSON-LD structured data (schema.org `WebSite` and `SoftwareApplication` markup) and generated `llms.txt`/`llms-full.txt` for LLM-friendly documentation discovery.\r\n\r\n## How to Update\r\n\r\n```bash\r\nnpm update -g repomix\r\n```\r\n\r\n---\r\n\r\nAs always, if you have any issues or suggestions, please let us know on GitHub issues or our [Discord community](https://discord.gg/wNYzTwZFku).\r\n","reactions":{"url":"https://api.github.com/repos/yamadashy/repomix/releases/300466320/reactions","total_count":4,"+1":0,"-1":0,"laugh":0,"hooray":4,"confused":0,"heart":0,"rocket":0,"eyes":0}}]