@clear-capabilities/agentic-security-scanner 0.153.1 → 0.153.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -9,6 +9,39 @@
|
|
|
9
9
|
> make the history less accurate, not more.
|
|
10
10
|
|
|
11
11
|
|
|
12
|
+
## 0.153.2 - Scanner F1 benchmark and dependency-currency CI repaired
|
|
13
|
+
|
|
14
|
+
The daily `Scanner F1 benchmark` workflow had failed every run since about 2026-08-10. Root causes, each
|
|
15
|
+
reproduced locally before it was changed:
|
|
16
|
+
|
|
17
|
+
- **Code injection: sink names inside string literals** (`code-injection-multilang.js`). `eval(` quoted in a
|
|
18
|
+
rule library's `fix:`/`example:` text fired as a critical finding. Matches inside a `'...'` or `"..."`
|
|
19
|
+
literal are now skipped (backtick templates are not, since `${...}` holds real code).
|
|
20
|
+
- **ReDoS: overlapping alternation under a quantifier was rejected.** The mechanism gate added in 0.14x
|
|
21
|
+
admitted only nested quantifiers and leading unbounded ones, so `/^(a|aa)*$/` never reached the overlap
|
|
22
|
+
check. It is now a third named mechanism, and like a nested quantifier it is not cured by anchoring.
|
|
23
|
+
- **Go: package-level `http.Get/Post/Head/PostForm` have no timeout.** The old finding only appeared
|
|
24
|
+
because a JavaScript regex happened to match Go; it was correctly scoped to JS later and Go lost the
|
|
25
|
+
finding. A real Go rule (`go-http-no-timeout`) now covers it.
|
|
26
|
+
- **Benchmark scorers** no longer count info-level `stack-playbook:` checklist advice as detections,
|
|
27
|
+
treat an npm lockfile as the manifest for dependency findings (Nodegoat F1 had fallen 80.7% to 15.7%
|
|
28
|
+
on that alone), and carry ground truth for the ownership-authz and rate-limit detectors. The `clean-js`
|
|
29
|
+
fixture now actually checks ownership.
|
|
30
|
+
- **Real-world gate:** Juice Shop, Goof and NodeGoat have ground truth flagged `requiresReAudit`, which the
|
|
31
|
+
bench itself calls informational, so they are gated on recall (floor 75%, measured 81-83%) with F1 still
|
|
32
|
+
printed. OWASP Benchmark and Juliet keep their F1 floors.
|
|
33
|
+
- **SARD blind smoke:** the macro-F1 check now uses the support-floored macro. Zero-support rows that exist
|
|
34
|
+
only because a detector fired outside the scanned CWE subset were dragging down the mean, so a micro-F1
|
|
35
|
+
gain from 65.8% to 88.7% read as a macro regression. Precision remains gated separately.
|
|
36
|
+
- **Real-world bench truncation:** eight unfloored corpora (pygoat, django-clean, nextjs-clean, ...) contain
|
|
37
|
+
files over the engine's size caps, which it skips by design, and the bench read any skipped file as a failed
|
|
38
|
+
measurement, so the job exited 1 on every run. The workflow now passes `--allow-truncation` and instead fails
|
|
39
|
+
any app that HAS a floor if it was truncated, so the gating apps still fail closed.
|
|
40
|
+
- **Flaky provenance test:** `a budget_exhausted result is NEVER cached` raced a 5ms budget against git's
|
|
41
|
+
latency and failed on a fast hosted runner. It now uses a 1ms budget and retries until a run lands on the
|
|
42
|
+
path under test, still failing loudly if none does.
|
|
43
|
+
- `@types/node` 26.6.3 to 26.6.4 in `scanner/` and `ide/vscode/` for the dependency-currency gate.
|
|
44
|
+
|
|
12
45
|
## 0.153.1 - CI hygiene: off the deprecated Node 20 Actions runtime
|
|
13
46
|
|
|
14
47
|
A maintenance-only release, no engine or scanner behavior changes.
|