Changelog

Last updated 5 October 2026.

What changed in MergeSafe recently?

MergeSafe ships small releases often; each entry below lists the changes you can notice, newest first, and leaves out internal work.

mergesafe-mcp 0.1.0 · 5 October 2026

• Your coding agent can now fix MergeSafe’s findings from your editor: install mergesafe-mcp and connect it to your agent. See Fix findings from your editor.

v1.0.43 · 2 October 2026

• A review that fails is never charged, even if part of it was already posted on the pull request.
• Reviews can now prove some JavaScript and TypeScript logic bugs by running a short script in an isolated sandbox, as they already could for Python.

v1.0.42 · 2 October 2026

• Organization roles began rolling out: the person who installed the GitHub App is the organization’s Admin, and changing settings, API keys and billing need an Admin. See Organization roles.
• For projects with uv.lock, Recommendations now suggest Dependabot’s uv ecosystem.
• Stronger protection against a GitHub webhook delivery being replayed.

v1.0.41 · 2 October 2026

• This site now measures time on page and how far a page is scrolled, still without cookies or personal data. See Privacy.

v1.0.40 · 2 October 2026

• Reviews can prove some Python logic bugs by running a short script in an isolated sandbox. This only shows a bug is real; it never tests security.

v1.0.39 · 2 October 2026

• Verifying your email address now takes a button press, so a link scanner in your mail can’t do it for you.

v1.0.38 · 2 October 2026

• In a pull request’s review history, each reviewed commit keeps its own score. When a score is recalculated, for example after a finding is withdrawn, only the latest one changes.

v1.0.37 · 2 October 2026

• This site now counts visits without cookies and without storing IP addresses. See Privacy.

v1.0.36 · 2 October 2026

• The top review level is now called Ultra. Nothing else about it changed.
• New Subprocessors page: who processes data on our behalf, what they receive, and where.

v1.0.35 · 2 October 2026

• A review of a new commit now re-checks open P2 and P3 findings too, not only P0 and P1, so a fixed one drops off instead of staying listed.
• New Security and compliance page, and a vulnerability disclosure policy with a security.txt file.

Next: Getting started →