release: v0.7.0 — signetry-core

[bkd-dotcom]

Version bump + changelog for the work merged since v0.6.0. The release workflow validates that the pushed tag matches pyproject version, so this has to land before tagging.

What's in it

Detection breadth

• Kotlin (.kt/.kts) — previously not scanned at all (Detection: add Kotlin support (SQLi + command injection) #52, feat(detection): add Kotlin support (SQLi + command injection) #93)
• go.taint.ssrf (CWE-918) (feat(detection): Go SSRF + Go/Java path traversal + PHP XXE #95)
• go.taint.path_traversal + java.taint.path_traversal (CWE-22) (feat(detection): Go SSRF + Go/Java path traversal + PHP XXE #95)
• php.xxe (CWE-611) (feat(detection): Go SSRF + Go/Java path traversal + PHP XXE #95)
• SinkSpec.skip_if negative guard (fix(detection): a constant host with a tainted query string is not Go SSRF #97)

Executors

• AiderExecutor — ported from @adity982's feat(executors): add Aider adapter #55 (Executor: add an Aider adapter behind the Executor protocol #53, feat(executors): add Aider adapter behind the Executor protocol #96)

SSRF precision

• keyword/positional URL resolution; requests.request was checking the HTTP method — thanks @AdvaitVarhade (Detection: add SSRF (CWE-918) rule for Python (requests/urllib/httpx) #86, feat(detection): add SSRF (CWE-918) rule for Python (#86) #89)
• urllib.request.Request dropped from the sink list — was double-reporting (fix(detection): report the urllib SSRF flow once, at the sink #94)
• constant host + tainted query string is no longer flagged (fix(detection): a constant host with a tainted query string is not Go SSRF #97)

CI

• advisory reviewer could never comment on a fork PR (403) (fix(ci): advisory reviewer could never comment on a fork PR (403) #92)
• the advisory step's exit 0 had never run under bash -e (fix(ci): advisory reviewer could never comment on a fork PR (403) #92)

Why minor, not patch

New detection rules and a new executor are features, so 0.6.0 → 0.7.0 rather than 0.6.1.

Also updated

The pinned install references in README.md and docs/ (6 files) move v0.6.0 → v0.7.0 so the documented command matches the tag.

After merge

git tag v0.7.0 && git push origin v0.7.0, then bump the signetry-core pin in Signetry/eval — its corpus additions for eval#11/#12/#29 depend on the new rules.

[github-actions]

Signetry Reviewer — 🟡 Needs human review

A human should decide — the required check is pending; 1 advisory finding(s) to weigh.

Deterministic gates (the authority)

Gate	Status
Required status check	⏳ pending
Secret scan	✅ clean
CI permission / OIDC	✅ no forbidden change
Dependency skew	✅ ok
All green	❌

Findings (1, 0 blocking)

• 🟡 Change touches a protected path: pyproject.toml pyproject.toml (via cross-check)
  • pyproject.toml matches a protected pattern (pyproject.toml). Changes here alter shared/foundational surface and warrant a designated reviewer.
  • Fix: Route to a code owner / architecture reviewer.

Merge

A human should review and merge.

This review is advisory. It never merges on its own judgement — the deterministic gates + a human are the authority. Findings can have false negatives; a green bot verdict is not a guarantee.