garak v0.17.0 — adds EU AI Act risk-category mapping

What it is

garak v0.17.0 (NVIDIA's LLM vulnerability scanner). The catalog summary covers the headline EU AI Act mapping (#2094), the agent_breaker judge work, Ollama auth/generation, and the Python 3.10→3.13 move. What it does not surface are two correctness fixes in this release that change whether prior scan results can be trusted.

Detection-correctness fixes worth acting on

• packagehallucination missed real hallucinated packages. Two separate bugs: the detector missed every package after the first in a combined import a, b statement (#1991), and it missed dotted and indented imports entirely (#2108). If you relied on packagehallucination in an earlier version, those were false negatives — flagged-clean results that were not actually clean. Re-run against 0.17.0 before trusting an earlier package-hallucination pass.
• Markdown exfiltration link templates were incorrect (#2142), in addition to the detector guards the summary mentions (#1935, #2055). This affects the probe side, not just detection, so exfil-probe results from earlier versions may also be stale.

Reliability / operational fixes

• Indefinite hang against unreachable OpenAICompatible targets is fixed (#2153) — previously a run could stall forever if the endpoint was down. Relevant if you script garak in CI or against flaky/self-hosted endpoints.
• Ollama empty-response retry now actually retries (#2122); NIM transient HTTP errors are retried and report the real status code (#2019).
• agent_breaker hardening beyond the summary's note: _extract_json always returns a dict (#2044), graceful degradation on malformed analysis shapes (#2069), and verdict type-validation (#2121) — i.e. the judge no longer crashes the run on unexpected output.

Preconditions

• Python 3.10 is dropped; 3.13 is added (#2084). Upgrading from 3.10 requires an interpreter bump, not just pip install -U.
• If you are still on ≤0.15.x, note that v0.16.0 introduced breaking changes the summary does not cover: a unified probe/buff/intent spec syntax (old probe_spec/buff_spec deprecated), config files move probe_spec/buff_spec into the run definition, and report.jsonl gains a probe_summary entry type with an expanded digest format. Report-parsing tooling built against older output will need updating.

Caveats

This is a release-notes page, not an advisory — there are no CVE ids, severities, or exploit details. The "false negative" framing above follows directly from the fix descriptions (packages that were previously missed); the page does not quantify how many detections were affected.