Devzy v2.5.0 Release Notes

This release focuses on trust and stability at scale. We introduced approval-gated repository review flows, hardened runtime behavior across processing paths, and shipped targeted security improvements for scanning and network boundaries.

New Features

Approval-Gated Repository Review Access

Repository reviews can now be explicitly gated by installation and repository approval state before entering the PR review pipeline.

• Added approval seeding for newly installed repositories
• Added pending approval sync paths and API updates for review-access workflows
• Added blocked-review PR notice behavior when a repository is not yet approved
• Added expanded webhook checks for pull request review event coverage

Expanded Model Provider Compatibility

Model provider support was expanded with safer runtime configuration and rollout behavior.

• Added additional provider compatibility in the runtime stack
• Moved sensitive runtime configuration to safer managed secret paths
• Updated environment handling for safer provider configuration rollout

Review Pipeline Throughput Controls

Concurrency controls were expanded to reduce contention and improve reliability for long-running reviews.

• Added per-stage concurrency budgeting with separate LLM pools for summary vs review
• Added provider-throttle resilience (rate limiting, retries, and metrics)
• Added runtime validation checks around approval and review-access decision points

Improvements

Orchestration and Worker Robustness

Core review execution flows were reworked to better handle cancellation, shutdown, and lock safety.

• Refactored orchestration for improved review lifecycle control
• Updated worker shutdown handling to drain in-flight reviews on SIGTERM
• Added layered pull request lock protection against orphaned lock records
• Improved blocked review notice error handling in webhook paths

Grep Context Isolation and Analysis Stability

Hot-path grep analysis now runs with stricter isolation and guardrails to reduce pathological runtime behavior.

• Isolated expensive analyzers in background workers
• Added timeout-based terminate-on-budget behavior for regex-heavy analysis
• Added bounded similarity/usage-pattern analysis to prevent catastrophic backtracking hangs
• Instrumented grep worker clone/dispatch cost for capacity tuning

Observability and Testing Confidence

Coverage and observability improvements make issue triage and regression detection more reliable.

• Expanded test coverage across review and webhook flows
• Added metrics/tracing refinements for review, processing worker, and data behavior
• Improved lint/test hygiene and reduced false timeout/logging noise in tool race paths

Bug Fixes

• Fixed: Review flow false-positive patterns in judge/reviewer prompt logic and evidence handling
• Fixed: Webhook review triggering normalization mismatches for action handling
• Fixed: PR close/merge edge cases where bot review actions could still trigger
• Fixed: Data sync/versioning mismatches during dependency updates
• Fixed: CI and test regressions introduced during orchestration and security hardening passes

Infrastructure

Deployment and Runtime Configuration

• Added and tuned autoscaling updates for API and worker workloads
• Updated staging/production runtime limits, including review duration and termination grace windows
• Applied rolling-update and liveness-probe adjustments to reduce event-loop kill incidents
• Added safer repository/tooling local ignores for multi-worktree developer workflows

Security Hardening

• Restricted security scanner paths to approved temporary locations
• Hardened third-party integration URL validation against request-forgery vectors
• Enforced configuration allowlists for production cross-origin behavior
• Resolved vulnerability-driven dependency and configuration follow-ups