blitzstrike 2.4.129 → 2.4.130

package/CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.130] — 2026-10-02
+
+### Fixed — full interconnection audit (grounding gaps closed)
+
+- Cross-check of every data layer → pattern → chain → synonym → auto-poc →
+  specialist-discovery found two orphan aliases and closed them: `csti` /
+  "client-side template injection" → `ssti`, and "api security" → `missing_authz`.
+  Every ComplexBugType (34), pattern (37), synonym alias, auto-poc template key,
+  and specialist-discovery class now resolves to a grounded pattern.
+
 ## [2.4.129] — 2026-10-02
 
 ### Added — 4 deterministic detectors (open_redirect, missing_nonce/CSRF, toctou, second_order)

package/dist/index.js

@@ -34760,6 +34760,7 @@ var ALIASES = {
   "insecure direct object reference": "missing_authz",
   "broken access control": "missing_authz",
   authorization: "missing_authz",
+  "api security": "missing_authz",
   csrf: "missing_nonce",
   xsrf: "missing_nonce",
   "cross site request forgery": "missing_nonce",
@@ -34770,6 +34771,9 @@ var ALIASES = {
   ssti: "ssti",
   "template injection": "ssti",
   "server side template injection": "ssti",
+  csti: "ssti",
+  "client side template injection": "ssti",
+  "client-side template injection": "ssti",
   "command injection": "command_injection",
   "os command injection": "command_injection",
   "command execution": "command_injection",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.129",
+  "version": "2.4.130",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {