New

• Expose properties.threshold and properties.actual on all eight maintainability smells in both native JSON and SARIF output, so consumers no longer need to parse messages for measurements and can read values beyond the configured threshold (#2851)

Improved

• Compute repository cache state once per run instead of per invocation, making qlty check up to 4x faster on large repositories with per-file linters such as gitleaks (#2856)

Fixed

• Exclude arithmetic, bitwise, and comparison operators from cyclomatic complexity, which previously inflated scores by counting non-branching operators as extra paths (#2852)
• Include active check filters in issue cache keys, preventing a filtered check from caching an empty result that a later unfiltered check would incorrectly reuse (#2837)

Fixed

• Bump redocly from 2.32.2 to 2.41.0, which patches CVE-2026-63325 (arbitrary code execution via Arazzo $faker expressions) and CVE-2026-63225 (path traversal in the split command) (#2847)
• Fix shfmt reporting unparseable shell files as clean; files it cannot parse now surface a plugin error instead of silently passing with zero findings (#2847)

New

• Add maintainability analysis for Elixir, including complexity metrics (cyclomatic, cognitive, function/class/field counts, LCOM4), structure smells, and duplication detection (#2843)

Fixed

• Bump PHP_CodeSniffer from 3.10.3 to 3.13.6, which patches GHSA-hmqg-cxww-wqhq and restores installs that Composer now blocks on the vulnerable pin (#2839)
• Bump haml-lint from 0.69.0 to 0.77.0, fixing a Cannot handle Haml version failure when fresh installs resolve Haml 7.3.x (#2839)

Improved

• Bump the eslint, oxlint, and prisma plugins to eslint 10, oxlint 1.x, and prisma 7 (#2825)

Fixed

• Switch Biome >= 2.4 to the stable rdjson reporter, restoring lint results that were dropped when Biome 2.4 changed its unstable json reporter output (#2821)

• Add a pre-release channel to the release promotion workflow, so new releases auto-promote to pre-release and promotion to latest becomes a deliberate step (#2832)

Fixed

• Honor package-lock.json when installing node-based linters from package_file, so the locked versions are respected instead of npm resolving the latest versions matching the package.json semver ranges (#2829)
• Honor composer.lock when installing PHP linters from package_file, so the locked versions are respected instead of composer update re-resolving to the latest matching versions (#2830)

Improved

• Bump the managed Node runtime from 21.7.3 to 22.23.1 LTS, so plugins that require even-numbered LTS Node lines (such as eslint 10, knip 6, oxlint 1.x, and prisma 7) install their native dependencies correctly (#2827)

Improved

• Merge a [[plugins.definitions.X.drivers.Y.version]] block in qlty.toml into a source's versioned driver entry with the same version_matcher, allowing per-version driver field overrides instead of being silently unreachable (#2823)

Fixed

• Apply user-configured driver fields (such as prepare_script) to version-matched drivers for plugins with versioned drivers (eslint, stylelint, knip, golangci-lint, trufflehog, radarlint-*), instead of silently discarding them at plan time (#2822)

Improved

• Classify npm EUNSUPPORTEDPROTOCOL failures caused by workspace:/catalog: dependencies with a clear message explaining that pnpm/yarn workspace protocols are not supported (#2819)
• Surface the full error cause chain in install error details so failures without command output (such as package-file staging errors) are no longer reported with empty details (#2819)