Kilo Code 7.8.1 ships a signed CycloneDX SBOM with every CLI, npm, container, VS Code and JetBrains artifact
GitHub·medium signal
Every release artifact now ships with a machine-readable list of its components, bound to the artifact's SHA-256 and signed as a GitHub attestation (#14513). 7.7.12, from the same release batch, turns on per-subagent model, provider and reasoning-effort selection by default. 7.8.0 blocks variable references in project MCP headers nested under mcp.servers.