Changelog

All notable changes to Mira are documented here. The format follows Keep a Changelog and the project uses Semantic Versioning. The canonical changelog lives at CHANGELOG.md in the repo; this page mirrors it.

0.9.1 (2026-09-22)

Added

• Codex CLI provider. Deployments with an OpenAI Codex login can set llm.provider: codex-cli and run reviews without an HTTP API key. Each invocation gets an isolated temporary home and workspace, a minimal environment, and a read-only sandbox. See Codex CLI.
• PR-description summaries. review.pr_summary can add an AI-generated release-notes block to a PR or MR description. append preserves author text and updates the marked block idempotently; replace intentionally replaces the body. The default is disable.
• xhigh review reasoning. llm.review_reasoning_effort now accepts xhigh directly alongside off, low, medium, high, and max.
• Richer blast-radius reporting. Walkthroughs show in-repository callers alongside cross-repository dependents, including source paths and referenced targets where available.
• Natural review-thread replies. Mira can classify plain replies in its own GitHub review threads, answer questions, resolve disagreements, and avoid unnecessary acknowledgements when it was not mentioned.
• Draft-aware GitHub reviews. Draft pull requests are skipped and reviewed when they become ready for review.

Changed

• More concise review output. Inline findings use a compact severity-and-title header with shorter explanations, while walkthroughs focus on the overall summary, merge confidence, and optional sequence diagram instead of repeating per-file changes and effort estimates.
• Stricter noise filtering. Security findings can use a category-specific confidence floor, and plausible blocker findings require at least 0.90 confidence.
• Fork-safe source lookup. Review context and fix verification fetch pull-request content by head SHA when available.
• Generated review summaries are capped so unusually verbose model output cannot overflow provider limits.

Fixed

• GitHub App tokens are resolved for each provider API call, avoiding stale installation credentials in long-lived provider instances.
• Mermaid diagrams are hardened before posting. Unsafe or malformed directives, labels, identifiers, edges, and excessive graph sizes are rejected or sanitized so a model-generated diagram cannot break the walkthrough.
• PR-description summaries are idempotent and gated. Re-reviews update the existing marked block instead of duplicating it, and summary generation is skipped when the feature or walkthrough is disabled.
• Forgejo incremental diffs use the web compare URL, fixing compare requests on instances where the API route does not expose the .diff representation.
• Outdated review threads are resolved before fix verification, avoiding unnecessary LLM checks for comments whose diff anchors no longer exist.
• Merge-learning metadata survives the compact comment format by preferring metadata recorded when comments were posted.

0.9.0 (2026-08-27)

Added

• Layered security review. A dedicated security-model tier combines a focused LLM pass, optional agentic read_file / grep_repo verification, a deterministic regex-and-entropy secrets scan, and review-time OSV checks for dependencies added or upgraded by a PR. The security model can be configured independently in mira.yaml or the Settings UI. See Deployment config.
• OpenAI Responses API support. OpenAI-compatible providers can set llm.api_style: responses to use the /responses protocol instead of Chat Completions, including JSON output, tool calling, reasoning, fallback models, and usage accounting.
• Broader indexing support. A shared file-type registry keeps review and indexing language detection consistent and adds Lua to the indexed languages.

Fixed

• Very large GitHub PRs remain reviewable. When GitHub rejects the complete diff with HTTP 406, Mira reconstructs a unified diff from per-file patches, including valid added, removed, and renamed-file headers.
• Responses JSON mode includes the required object-output hint, preventing compatible endpoints from rejecting walkthrough and review requests.
• Dashboard cards no longer clip overflowing content.

0.8.1 (2026-08-13)

Added

• Agentic tools on indexed repositories. The main reviewer can use read_file and grep_repo even when an index already exists, allowing it to verify callers and dispatch paths beyond pre-fetched context.

Fixed

• Walkthrough parsing tolerates malformed model output, including leaked tool-call XML, malformed optional fields, and incomplete JSON structures.
• Review failures update the in-progress placeholder comment instead of leaving a PR appearing permanently stuck.
• Repository indexes remain platform-isolated when the same owner/repository name exists on more than one provider.
• Incremental indexing reports the stored repository total rather than only the number of files processed in the latest update.
• Large repository tarballs avoid out-of-memory extraction by discarding non-indexable and oversized files before loading their contents.
• Contributor backfill uses PyGithub's current rate-limit API.

0.8.0 (2026-07-27)

Added

• Opt out of per-commit reviews. review.review_on_synchronize (default true) controls whether every push to an open PR triggers a review. Turn it off and Mira only reviews on open/reopen — later commits wait for an explicit @bot review. Saves tokens and cuts noise when you batch commits before pushing. Works on GitHub, GitLab, and Forgejo; toggleable in Settings. See review.review_on_synchronize.
• Duplicate-dependency warnings. A dependency-review pass flags when a PR adds a package that overlaps a dependency the repo already has (e.g. react-table present and the PR adds @tanstack/react-table). It runs only when the PR changes a manifest (package.json, pyproject.toml, go.mod, …), compares against the repo's indexed package names, tags findings category=dependency, and sends them through the normal noise filter and self-critique. Lockfiles are excluded. Gated by review.dependency_overlap (default on), admin-toggleable in Settings.
• Configurable LLM retry and timeout. New llm keys — max_retries, request_timeout, retry_min_wait, retry_max_wait — read at runtime. Raise them for flex-tier models or proxied endpoints under load. See llm retry & timeout.
• Concurrent-review de-duplication. An in-memory review tracker skips starting a second review when one is already running for the same PR (rapid push + comment, webhook redeliveries), and surfaces in-flight status to the dashboard across all three platforms.

Changed

• LLM retries only fire on transient failures. The retry predicate now covers timeouts, network errors, and 5xx/429 responses; 4xx client errors raise immediately instead of consuming the retry budget.

Security

• Webhook SSRF via DNS names is closed. Outbound webhook delivery now resolves the target host and rejects it if any resolved address is private/loopback/link-local/reserved/metadata — previously only raw IP literals were screened. Allow specific internal hosts with MIRA_WEBHOOK_ALLOWED_HOSTS.
• No default admin password. The dashboard no longer ships an admin / admin account. Unset ADMIN_PASSWORD → a random password generated on first start and written to <MIRA_INDEX_DIR>/initial_admin_password (mode 0600), never logged. Password storage moves to PBKDF2-HMAC-SHA256 with per-user salts; old hashes upgrade on next login.
• Dashboard endpoints that were missing auth are gated. GitLab/Forgejo sync + repo-register, model-settings update, uninstall keep/delete, and setup-complete now require an admin session.
• Public-path auth bypass narrowed. The middleware treated the whole /api/repos/ prefix and any .svg path as public; it now matches only the blast-radius badge exactly.
• Session cookie marked Secure over HTTPS, and the SPA static fallback no longer allows ../ traversal out of the UI dist directory.

0.7.0 (2026-07-24)

Added

• Forgejo support. Mira now auto-reviews pull requests on Forgejo (including Codeberg, the default endpoint) with the same pipeline as GitHub and GitLab: inline comments, walkthroughs, @mention commands, push-triggered incremental indexing, and automatic repo discovery. Authentication is an access token — set MIRA_FORGEJO_TOKEN + MIRA_FORGEJO_WEBHOOK_SECRET and point a webhook at /forgejo/webhook; self-hosted instances set MIRA_FORGEJO_API_URL. Any combination of platforms works. See Set up Forgejo.
• Cross-PR overlap detection. While reviewing a PR, Mira compares it against the repo's other open PRs and flags the ones stepping on it in the walkthrough — same files (merge-conflict risk) or same goal (duplicate effort). A cheap deterministic pre-filter runs first, so only genuine candidates cost a single batched LLM call. Tune or disable under review.overlap.
• PR author allow / deny lists. filter.allowed_authors restricts auto-review to the named authors and filter.blocked_authors always wins over it — handy for muting bots (dependabot matches dependabot[bot]). An explicit @miracodeai review still works on a filtered author's PR.
• Review dashboard. A new admin-only Review page focused on keeping a human in the loop on PR reviews: stale / waiting PRs (how long open, how long idle, who they're waiting on), a reviewer-responsiveness leaderboard that surfaces the bottleneck (pending review queue + median time to respond once requested), throughput trends (median time-to-first-review and time-to-merge, this week vs last), an approved-&-merged count, rubber-stamp detection (approvals with no substantive review — empty/"LGTM" body and no real inline comments — surfaced org-wide and per reviewer), and an open-PR status board (approved / changes-requested / awaiting). Review timing is captured live from webhooks and seeded by a light GitHub backfill of open PRs + existing reviews on repo add, admin Refresh, or the mira backfill-contributors CLI.
• Contribution analytics. Each contributor's detail page also shows authoring stats (commits, PRs opened/merged, lines), a GitHub-style year-long contribution heatmap, and Mira's differentiated review-quality signal (blockers/warnings their PRs triggered + the accept rate of Mira's feedback). Contributors are keyed provider-agnostically (provider, login) so non-GitHub providers can be added later.
• Threaded PR activity timeline. Review comments and the human replies to them are stored, and the dashboard's Activity detail renders them as threaded conversations grouped under each review pass — replies nested under the exact Mira comment they answer, newest first.

Fixed

• Review comments always anchor to the PR's own diff. A merge commit's round-2 incremental diff no longer drags in the base branch's changes, and inline comments that GitHub can't anchor (lines outside the PR diff) are dropped before posting with the Key Issues table re-synced — no more 🔴 rows with no inline comment attached.
• Postgres writes for review comments and PR replies survive stale connections — two write paths missed by 0.6.0's reconnecting-cursor fix now route through it.
• Long learned-rule text truncates with an ellipsis in the dashboard's pending-learnings card instead of overflowing.

0.6.0 (2026-07-10)

Added

• GitLab support — full parity with GitHub. Mira auto-reviews merge requests via webhooks, posts inline comments anchored to diff positions (with a plain-note fallback when GitLab rejects a position), and answers @mention commands on MRs: review, review-rest, pause/resume, inline reject, free-form questions, and merge-time learning. Incremental re-review, thread auto-resolution, JIT cross-file context, file history, indexing, push indexing, and vulnerability/package search all match GitHub. Auth is a group or project access token — set MIRA_GITLAB_TOKEN + MIRA_GITLAB_WEBHOOK_SECRET and point a webhook at /gitlab/webhook; self-managed sets MIRA_GITLAB_API_URL. GitHub credentials are optional when GitLab is configured. See Set up GitLab.
• Dynamic platform layer. Adding a git host is data, not code: a platforms.json registry (mirroring providers.json for LLMs) carries each platform's API URL, webhook route, signature scheme, and terminology, overridable via MIRA_PLATFORMS_JSON_PATH. The repo data model extends to (platform, owner, repo); existing GitHub rows migrate automatically.
• Mira answers to both its handles. On either platform, a mention of the configured MIRA_BOT_NAME or the bot's real account username triggers a command — whichever a teammate types.

Changed

• Review comment headers use one severity marker instead of two emojis. The category line is now plain bold text above the severity badge. Cleaner, still scannable, and renders correctly on both GitHub and GitLab.

Fixed

• Malformed LLM JSON is recovered instead of dropped. Responses that leak tool-call XML or arrive with an unbalanced brace are repaired before parsing, so a chunk's comments are no longer lost when output strays from clean JSON.
• Stale PostgreSQL connections after idle. Long-lived psycopg handles can go dead behind poolers or idle_session_timeout; queries now retry once on OperationalError (dashboard API, indexing, vulnerability poller) instead of failing.
• /health reflects Postgres availability. When DATABASE_URL is Postgres, the endpoint runs a one-shot SELECT 1 and returns HTTP 503 if the database is unreachable.
• Creating or editing a learning requires authentication. The learned-rule create and update endpoints return 401 for unauthenticated requests instead of proceeding with an anonymous author.
• Dashboard setup and repo sync respect a repo's platform. Setup writes index mode and status to the correct (platform, owner, repo) row (GitLab repos could previously not be opted out of initial indexing), and the GitHub repo sync no longer targets GitLab rows when pruning stale repos.

0.5.1 (2026-07-09)

Fixed

• One malformed walkthrough entry no longer drops the whole walkthrough. When the LLM omits a required path or label on a single change_groups entry (plausible on large diffs), that entry is now skipped with a warning instead of failing the entire response, so the walkthrough comment still posts.
• The walkthrough placeholder is always finalized. When a review produces no walkthrough (all files matched exclusion rules, empty diff, size limits, or walkthrough generation failed), the "Reviewing this PR…" placeholder comment is now updated with the reason instead of staying stuck forever.

0.5.0 (2026-07-06)

Added

• Learnings quarantine — approve before they apply. Auto-synthesized learnings (from accept/reject signals and human review comments) now land in a pending state and only inject into reviews once approved on the Learnings page. Declining a learning suppresses it permanently — future feedback keeps its evidence count fresh but can't resurrect it. Existing learnings are grandfathered as approved, so upgrading changes nothing until you triage.
• Learnings are editable and deletable. Reword a learning's rule text inline (manual edits survive re-synthesis) or delete it outright; a deleted learning can return as pending if the same feedback pattern re-emerges. Declined learnings sit in a collapsed section with one-click restore.
• Newest frontier models in the registry. Claude Sonnet 5, Claude Opus 4.8, Claude Fable 5, GPT-5.2, Gemini 3.1 Pro Preview, DeepSeek V4 Flash/Pro, and MiniMax M3, with pricing and ids verified against the live OpenRouter catalog.

Changed

• Superseded registry entries removed. GPT-4o and GPT-4o mini, GPT-4.1 Mini, Gemini 2.5 Flash/Pro, MiniMax M2.7, and the OpenRouter Claude Opus 4.6 id (the Bedrock profile remains). Deployments still configured with these keep working — the dashboard accepts any id the configured backend serves; they just lose curated pricing metadata.
• Recommended defaults unchanged. Claude Sonnet 4.6 for reviews and Claude Haiku 4.5 for indexing were benchmarked on the review-quality baseline and keep the badge until a newer model measurably beats them.

0.4.1 (2026-07-06)

Added

• Activity page. An org-wide feed of PR reviews with a filterable table and a per-PR detail timeline.
• Backend-aware, searchable model pickers. The dashboard's model dropdowns are now search bars listing the configured backend's live catalog — OpenRouter's tool-capable models, your Bedrock account's inference profiles, or a generic endpoint's /models — cached for an hour with the bundled registry as fallback. Any free-form model id can be typed directly, and an Inherit from deployment config choice clears the dashboard override so mira.yaml is authoritative again. The effective model and its source are logged on every review.
• Current-generation models in the registry. GPT-5 Nano/Mini, GPT-5.1 Codex/Codex Mini, GPT-4.1 Mini, Gemini 3 Flash (Preview), and Gemini 3.1 Flash Lite, with pricing verified against the live OpenRouter catalog.

Changed

• llm.base_url is validated at config load. Non-http(s) schemes are rejected, and plain http:// is allowed only for local endpoints (localhost, private IPs, dotless hostnames like docker-compose services); public hosts must use https://.

Fixed

• Discord webhooks work via the Slack-compatible endpoint. A discord.com/api/webhooks/…/slack URL is now detected as Slack format instead of falling through to generic JSON, which Discord rejects. Bare Discord URLs stay generic so the test button surfaces the mismatch loudly.
• Dependency-bump pushes refresh the vulnerability inventory. Push-triggered incremental indexing skipped manifests/lockfiles (they're excluded from code indexing), so merging a lockfile-only PR left the package inventory stale and the Vulnerabilities page kept flagging already-fixed advisories until a full re-index. Manifest changes now refresh the inventory and trigger an immediate vulnerability poll.
• Global rules now reach reviews on Postgres deployments. The review engine read global rules from a throwaway SQLite database instead of the configured DATABASE_URL backend, so dashboard-stored rules were silently ignored and a stray _app.db was created on every review.

0.4.0 (2026-06-14)

Added

• Provider profiles — adding an LLM provider is now data, not code. The OpenAI-compatible client's per-provider quirks (attribution headers, whether the model id keeps its vendor/ prefix, reasoning-effort remapping) moved out of hardcoded OpenRouter branches into a declarative providers.json, matched by base_url. OpenRouter's quirks are now a profile entry rather than code branches; an endpoint with no matching profile gets the portable default, so most OpenAI-compatible providers work with only base_url + api_key_env. Override the bundled list at runtime via MIRA_PROVIDERS_JSON_PATH. No behaviour change for existing configs.
• Exclude patterns now apply to indexing. filter.exclude_patterns governs the index as well as review, so committed vendor dirs, generated SDKs, and test data stay out of indexing without burning tokens — the same globs that exclude a file from review exclude it from indexing, and the per-repo file count reflects them.
• Indexing file-size limit. New index.max_file_size (bytes, default 1 MB) skips any file above the limit before it reaches the summarizer. Lower it to keep indexing cheap on large codebases with big fixtures or generated files; 0 disables the limit.

Fixed

• Indexing no longer drops a whole batch on one malformed file. Summarization responses with unescaped backslashes (e.g. DeepSeek emitting PHP namespaces like \App\Models inside JSON strings) are repaired before parsing, so a single bad string no longer fails the parse and discards every file in the batch.
• Indexing no longer crashes on a null symbol field. A model emitting an explicit "signature": null was inserting NULL into a NOT NULL column and aborting the file; those fields now fall back to their defaults and nameless symbols are skipped.

0.3.1 (2026-06-11)

Added

• Review thinking mode. An extended-reasoning budget for reviews (off / low / medium / high / max) so a model reasons more before commenting. Set it in mira.yaml (llm.review_reasoning_effort) or on the Settings page; reviews only, defaults to off. Works on OpenRouter (DeepSeek, Claude, OpenAI reasoning models) and Bedrock (Claude); dropped automatically where unsupported so the review still runs.
• Runtime-adjustable model registry. Point MIRA_MODELS_JSON_PATH at your own models.json to add custom models or override bundled ones without reinstalling — entries overlay the bundled list by id, and a missing/invalid file is ignored with a warning.

Changed

• Eval suite hardened for reliable release gating: a pinned filter config (immune to ambient overrides), retrying catch tests, and the noisy comment-count metric moved to the nightly benchmark.

0.3.0 (2026-06-11)

Added

• Outbound webhooks. POST to Slack, Microsoft Teams, or a generic JSON endpoint when a review finishes, fails, surfaces a high-severity finding, or a repo finishes indexing. Configured on the admin Settings page. Delivery is best-effort and SSRF-guarded, so a slow or misconfigured endpoint can't delay or break a review.
• User management. Self-service password change and admin password reset (proper pages, not modals), a sidebar user dropdown with account switching, avatars, and last-sign-in tracking.
• Per-page browser tab titles. Each dashboard page sets its own title.

Fixed

• Thinking-mode models no longer fail reviews. Models that reject a forced tool_choice (e.g. deepseek thinking mode) are detected and retried with tool_choice: "auto", then remembered so later calls skip the doomed attempt.

Changed

• Evals gate the release build. The LLM eval suite runs on a release tag and the container only ships if it passes; the noisy quality scorecard moved to a separate nightly benchmark job.
• Dashboard API client split into per-domain modules (internal refactor).

0.2.3 (2026-06-08)

Added

• MiniMax M2.7 support with think-block stripping. <think>…</think> reasoning blocks (MiniMax and similar "thinking" models) are stripped before JSON parsing, so those models work for indexing and review. New minimax/MiniMax-M2.7 model entry.
• Dynamic bot @mention in the dashboard. The UI shows the App's real handle (auto-detected from its GitHub slug, default @miracodeai) instead of a hardcoded placeholder.

Fixed

• Blast Radius no longer leaks private repos. A public repo's review never names a dependent repo that isn't known-public. Visibility is tracked in the registry, backfilled automatically, and unknown visibility is treated as private (safe by default).
• No more duplicate review comments on re-review. Findings that already have an open bot thread are skipped, so each push stops re-posting the same suggestion.
• Resilient indexing. A duplicate symbol name no longer crashes the index (conflict-safe upsert on Postgres + SQLite), and a single failed file is skipped instead of aborting the whole repo — which also stops runaway token spend after a failure.
• Thread-resolution failures are logged instead of silently swallowed.
• Sidebar navigation active state — cleaner active-item styling, driven off aria-current.

Changed

• Dependency bumps (Vite 8, Tailwind 4.3, eslint 10, lucide-react, react-dom, and others).

0.2.2 (2026-06-03)

Added

• Blast Radius toggle. New review.blast_radius setting (default on) with a Review-settings switch in the dashboard. Turns the walkthrough's cross-repo "Blast Radius" section on or off; when off, the relationship-store lookup is skipped entirely.
• Loading skeletons on the Dashboard, Repositories, and Vulnerabilities pages, so a slow data fetch no longer looks identical to an empty result.
• Light-mode logo. The dashboard logo now swaps with the theme across the sidebar, login, and setup.

Fixed

• Learned rules now survive self-critique. The self-critique pass was discarding review comments that enforced a team's own learned/custom rules (e.g. "we always want tests") as style nits. The critic now sees the active rules and keeps comments that enforce them.
• Dashboard version indicator. The version under the sidebar logo never rendered (it queried /api/version without credentials); now fixed.

Changed

• Internal code-hygiene pass: trimmed redundant comments and split the review passes out of engine.py into core/passes.py and core/threads.py. No behaviour change.

0.2.1 (2026-06-02)

Added

• AWS Bedrock provider. Set llm.provider: "bedrock" to run reviews against Claude (or other models) on Amazon Bedrock via the Converse API, instead of an OpenAI-compatible endpoint. Auth uses the standard AWS credential chain (env vars, instance profile, ECS task role, SSO), with an optional aws_profile. Configurable region and fallback_model. See Choosing a model.

Changed

• Dependency bumps (recharts, lucide-react, prettier, typescript-eslint, eslint-plugin-react-hooks, shadcn, docker/metadata-action) and README updates.

0.2.0 (2026-05-14)

Added

• Custom LLM endpoints. llm.base_url and llm.api_key_env in mira.yaml let you point Mira at any OpenAI-compatible chat-completions API. Out-of-the-box examples for vLLM, Ollama, LiteLLM proxy, LocalAI, llama.cpp server, Together, Fireworks, Groq, and Cerebras. Defaults still target OpenRouter, so existing configs keep working unchanged. Set api_key_env: "" for local endpoints that need no auth. See Custom endpoints.
• @miracodeai help command. Posts an inline command list on the PR. Aliases: ?, commands. New Commands page documents every verb.
• Benchmark section in README. Mira's speed/quality position on the public Code Review Bench, with a Pareto-frontier scatter plot and per-tool speed bars.
• docs.miracode.ai badge in the README, next to the Discord badge.

0.1.1 (2026-05-11)

Added

• Layered config: mira serve --config /path/to/mira.yaml. Deployment-wide YAML defaults loaded once at startup. Per-repo .mira.yaml deep-merges over it; admin UI overrides layer between the two. Replaces the env-var grab-bag for non-secret settings; secrets stay in env. (MIRA_CONFIG env var also accepted.) See Deployment config.
• Admin Settings → Review behaviour overrides. DB-backed runtime overrides for filter and review knobs (confidence threshold, max comments, walkthrough, self-critique, security pass, max concurrent chunks). Editable from the dashboard with field-level validation, inline error messages, bounded inputs, and "Overrides mira.yaml" badges.
• /api/admin/settings GET/PUT (admin-only) and /api/version endpoints.
• Version chip under the dashboard logo. Shows the running Mira version at a glance.
• Auto-detected bot @mention. mira serve reads the GitHub App's slug from GET /app at startup; MIRA_BOT_NAME is now optional and only needed for overrides or when the lookup fails.
• LiteLLM-style Docker invocation. ENTRYPOINT ["mira", "serve"] so docker run … image --config /app/mira.yaml passes through cleanly.
• TLS termination examples in the docs: Caddy, nginx + Let's Encrypt, Cloudflare Tunnel. See Deploying with Docker.
• Vulnerabilities page collapses repeats by package. Multiple advisories against the same (repo, package, version) collapse to one row with the highest required upgrade target in a new "Upgrade to" column and an advisory-count chip. Click to expand for the individual GHSAs.
• Changelog button next to the docs logo. History-icon chip linking to this page.

Changed

• @miracodeai is the canonical bot mention. Docs/README updated everywhere from the old @mira-bot placeholder.
• Walkthrough nudge no longer fires on indexed repos. Split _index_was_empty (whole-repo signal) from _jit_needed (per-PR signal). PRs that touch only files the indexer skips (e.g. README.md) no longer falsely tell users "this repo isn't indexed."
• Inline review comments stopped failing with 422. Reverted forced side: RIGHT / start_side: RIGHT on review-comment payloads; let GitHub auto-infer side from the diff.
• Mermaid sequence diagrams render cleanly. Removed the duplicate sanitizer in models.to_markdown that was re-introducing the nested-quote bug _sanitize_mermaid had just fixed.
• agentic_tools._grep_repo capped at 15 files (was 60) to bound the per-grep network spend.
• Postgres set_last_reviewed_sha got an explicit commit() mirroring the SQLite branch (defense in depth: the connection is autocommit, but explicit is safer).
• .mira.yml → .mira.yaml everywhere in docs and code paths; legacy .mira.yml is still read for backward-compat.
• Dashboard "Repositories" card subtitle reads "N repository relationships" (was "N cross-repo edges"), clearer wording, same underlying count.
• Repo detail page stat cards. "Symbols" replaced with "Lines of code" (sums per-file loc); "External Refs" renamed "External references" (the metric covers npm/pip/go packages, Docker images, Terraform modules, and outbound API endpoints, not just package calls).
• Breadcrumb owner segment on /repos/{owner}/{repo} now links to /repos?owner={owner}; the repos page seeds its filter from that query param.

Fixed

• Validation errors from /api/admin/settings now surface as humanized, field-keyed messages (Confidence threshold must be ≤ 1.0) instead of raw Pydantic stacks.
• Number inputs on the Settings page handle decimal entry, backspace, and arrow-key stepping correctly.
• Setup modal stops re-appearing after "Skip for now". The popup trigger now also checks index_mode !== "none", so an explicit skip persists across reloads instead of nagging on every refresh.
• _run_initial_indexing no longer re-indexes already-ready repos when a later install lands; it filters by status in ("pending", "indexing") rather than blindly walking every repo with a non-none index mode.

0.1.0 (2026-04-29)

Initial public release.

Changed

• Mira is fully open source. All features, including org-wide package search, vulnerability scanning, global rules, and learned rules, are available to every self-hosted user with no purchase required.

Added

• Decision archaeology. Review prompt now includes recent commit history for files touched by the PR, so the LLM can explain why code exists before suggesting deletion.
• Learned rules dashboard at /learned-rules, surfacing what Mira has synthesized from feedback signals across the org.
• Vulnerability scanning via OSV.dev with hourly polling and per-repo CVE badges.
• Org-wide package search at /packages, answering "which repos use lodash@4.17.20?" for incident response.
• Manifest parsing for package.json, requirements.txt, pyproject.toml, go.mod, and Dockerfile. Extracts declared dependency versions deterministically (no LLM cost).
• Streaming walkthrough comments. Placeholder posts within ~1s, narrative walkthrough at ~10s, final review with stats once chunk review completes.
• Confidence clamping. Walkthrough confidence is auto-tightened by review findings (a blocker forces "Do not merge" regardless of LLM's initial read).
• Merge-time learning. When a PR merges, Mira analyzes accept/reject signals and human review comments; LLM synthesizes recurring reviewer patterns into rules that inject into future reviews.
• Cancel indexing button on the repo detail page.
• Last-indexed timestamp in the repo header.