Changelogs

Improved review reliability

We fixed a timeout issue that could occur during repository initialization and improved a few rare edge cases where reviews could fail unexpectedly.

Fixed: authentication for project rules

The fr-agent project rules command no longer returns a 403 error when the user is not authenticated. It now redirects to the login flow instead.

Fixed: GitHub App review authentication

Agent-triggered reviews on GitHub repositories now correctly inject the namespace administrator's GitHub App installation ID, fixing clone authentication failures for organization-owned repositories.

Better resilience on errors

Error recovery has been reinforced across the entire review pipeline. When a transient failure occurs (timeout, invalid response), the system now retries cleanly without accumulating artifacts from previous attempts — reviews stay consistent and reliable.

More reasoning on critical stages

The planning and aggregation phases of the review now use a dedicated reasoning model. This enables deeper analysis on the steps where judgment quality matters most — without impacting the execution speed of the review itself.

A substantial round of behind-the-scenes improvements to make reviews more reliable — no change to the format of the feedback you receive.

Review pipeline hardening

• Format tolerance. When the reviewer produces output in a non-standard format, the knowledge-base reformat step now rescues it automatically — both for initial reviews and updates — instead of failing the review.
• No more review when nothing changed. If every finding is already fixed, the update step skips the LLM call entirely and posts a clean "no new review" notice instead of a redundant report.
• Safer retries. Retry loops are bounded and fail fast on empty content, preventing runaway retries or cascading failures.
• Markdown-first output. The aggregator and update-review steps now produce Markdown instead of brittle JSON, making partial salvage far more reliable when the model deviates from the expected format.

Webhook reliability

• GitLab. Reviews are now correctly skipped when the MR is closed, merged, or still a draft. Stale checkout SHAs are recovered automatically, and unregistered repos are ignored instead of causing errors. Old project tokens are revoked before new ones are created.
• GitHub. Webhook deletion is now wrapped in a try/except to handle transient network errors cleanly, and the repo removal step verifies the webhook is actually deleted before proceeding.
• System notes. GitLab approval notes no longer trigger unnecessary review cycles.

General reliability fixes

• Merged or deleted branches. Reviews now handle the case where a branch has already been merged and deleted gracefully instead of failing.
• Validation watchdog. The AI validation step has a bounded duration guard, and refunds are only issued when the parent review actually needs them — preventing incorrect credit deductions.
• Agent resilience. Transient git sync failures are retried automatically, and file paths with backticks are stripped correctly. Explicit comment-triggered reviews are no longer deduplicated away.
• Grep search. Search terms starting with - are now treated as literal patterns instead of being interpreted as flags.

Review updates are smarter in two ways:

• Author replies count. When you answer a finding as the author of a pull request (say, "out of scope" or "not blocking"), FriendlyReviewer captures your intent and takes it into account in the following reviews, instead of re-flagging the same thing on every update. Works on GitHub, GitLab and Bitbucket. Replying doesn't trigger a new review by itself.
• Compliance verdicts are re-evaluated. Like technical findings, compliance verdicts are now re-judged on every update: when a failed or mitigated requirement is actually fixed, it moves to the "Fixed" section of the report and stays resolved in subsequent reviews, instead of being copied as-is.

Reviews now follow the language of your pull request description: the reviewer detects the language of your PR or MR, and the whole review — summary, findings and report — is written in it, on new reviews and updates alike. If the language can't be detected reliably, reviews fall back to English. You can also force a repository to English only by ticking the "EN ONLY" box in the repositories table on your dashboard.

The review benchmark has been updated to better reflect real-world code, and the reviewer pipeline got a round of quality and robustness optimizations. Reviews are now more consistent and reliable, with no change to the format of the feedback you receive.

Reviews now complete noticeably faster. The reviewer's code search step was reworked to be lighter, so your feedback lands sooner — with no change to the review format or the findings you get back.

Findings you validate as resolved in a review now stay resolved. Previously they could reappear in later rounds of the same review and get re-flagged all over again; now the resolution is persisted across cycles, so the review converges cleanly.

FriendlyReviewer now reads the AGENTS.md file at the root of your repository and applies the conventions it describes to every review — no extra configuration needed.

• Rules are extracted from AGENTS.md and injected into each review alongside your existing .friendlyreviewer/helper.md team rules.
• The file is only re-processed when its content actually changes (tracked by a content hash per project), so an unchanged AGENTS.md adds no overhead.
• Only declarative rules about the code are kept; setup instructions and other non-review content are ignored.
• You can inspect what was extracted before starting a review, with fr-agent project rules --remote <url> (CLI 1.2.0 or later) or the matching fr_get_rules MCP tool. Both read your local AGENTS.md by default; override the path with --agents-md <path>.
• The answer tells you where you stand: ok returns the enforced rules, none means nothing is cached yet (rules are generated on your next review), and version_mismatch means your local AGENTS.md no longer matches the cached version.

When a review failed for an internal reason, the raw error could end up posted in the comment on your merge request. That no longer happens.

• Raw AI provider responses and system traces — which could include billing messages, internal endpoints or stack traces — were posted verbatim in the review comment, visible to everyone with access to the merge request.
• A failed review now posts a single neutral notice telling you the review is unavailable and that we have been alerted. The details go to our logs and to an internal alert instead.

When a merge request is too large to review, FriendlyReviewer now tells you once instead of repeating itself on every push.

• Previously, each new push to an oversized MR re-triggered the review and posted the "review aborted — too big" notice again, cluttering the thread.
• Now the notice is posted a single time. On later pushes that are still too big, FriendlyReviewer stays quiet and removes the transient "review started" comment it had just added.
• If you trim the MR back under the limit and it later grows too large again, you'll be notified once more — the state resets on its own.

The public site navigation has been reworked to make room for more entries and to behave properly on small screens:

• Nav links are now lightweight text links, keeping the header uncluttered as the number of pages grows.
• A burger menu collapses the navigation below 900px for a clean mobile layout.
• New Changelogs page (this one), fed by one Markdown file per entry with a month-based index.

The formatted review now shows how long the review took, displayed just before the review history.

GitHub and GitLab reviews now include a ready-to-copy "vibe coding" prompt block, so you can feed findings straight back to your AI coding agent.

Added a Connect with GitLab SSO button on the setup page for a one-click connection.

New Customize page walking you through how to tailor FriendlyReviewer to your project via .friendlyreviewer/ config files — set your review rules, ignore patterns and conventions, with a bootstrap guide to generate the config.

Added a per-request timeout on AI calls to prevent reviews from getting stuck when a model call hangs.

FriendlyReviewer now reviews pull requests on Bitbucket Cloud, in addition to GitHub and GitLab.

Knowledge Base analysis now batches multiple files per AI call, and the KB/dependencies phase is skipped on update reviews — noticeably reducing review time.

The dashboard's "Settings" section is now Platforms, with a reordered navigation to make connecting GitHub and GitLab clearer.

Review severity is now shown with weather-themed badges, giving a quicker read of a review's overall risk at a glance.

Review output is now grouped and easier to scan, with emoji severity badges that surface the most important findings first.

Added a context-light hosted MCP endpoint so MCP-compatible agents can request reviews. Access is scoped per review with short-lived tokens, and authentication failures now return a proper OAuth challenge.

FriendlyReviewer is now available as a standalone command-line agent (fr-agent), so your AI coding agents can trigger and drive reviews directly from the terminal. The friendly-review workflow has been migrated to the new CLI.

When a PR or MR is updated, FriendlyReviewer now re-reviews using a single diff-based pass, so follow-up reviews focus on what actually changed rather than re-scanning the whole change.