v2.11.0

Fixed

• GitLab silently dropped findings that couldn’t be anchored to an inline diff line (issue #711). Out-of-diff findings, or ones bumped over the max_inline cap, were computed but never rendered anywhere: GitHub and Bitbucket both already surface these. They’re now rendered as a bullet list appended to the MR’s summary note, replacing (not accumulating on) each run.
• REVIEW_TARGET case-sensitivity could silently skip the standalone-mode deprecation warning and merge-commit-filter behavior (issue #629). REVIEW_TARGET=Standalone or STANDALONE fell through to default pr behavior instead of being recognized. Normalized once at the config boundary.
• A Semgrep false positive on the phpstan analyzer’s subprocess.run call (issue #789). An inline # nosemgrep comment was tried first but proved unreliable: Semgrep’s inline-suppression handling turned out to be nondeterministic across multi-file scans in CI’s environment. Fixed with the project’s existing deterministic suppressions.json mechanism instead, which isn’t affected by Semgrep’s own scan-time behavior.

See CHANGELOG.md for full technical detail on every change above.