Releases
What's new in Capa
A per-version record of what changed and why, newest first. Every release page explains the change in plain terms, shows a short before-and-after, and states its scope honestly, including exactly what a security fix does and does not close. For what is planned rather than shipped, see the roadmap.
By version
Release notes
Pick a version to read its notes. The most recent release is at the top; the list grows as the earlier history is written up.
- Capa 1.31.0 · 2026-08-11 · an information-flow security fix: a @secret value captured by a closure and sunk inside that closure's body after the taint arrived is now flagged, a warning by default and a hard error under @strict_ifc. Technical details.
- Capa 1.30.1 · 2026-08-11 · a precision release (a PATCH, no security advisory): it removes two false-positive information-flow reports on a read of a public sibling field of a struct whose other field was stored a secret. No leak is closed; the direction is accept-more. Technical details.
- Capa 1.30.0 · 2026-08-10 · an information-flow security fix: a @secret reaching a public sink through a locally-resolved lambda (its parameter, or a captured container read back through its result) is now flagged, and a named argument at a first-class call is rejected, closing a silent backend divergence. Technical details.
The full machine-readable history is in the CHANGELOG, and every security fix has a matching entry under security advisories. Older versions will be summarised here as their notes are backfilled.