blitzstrike 2.4.18 → 2.4.19

package/CHANGELOG.md

@@ -5,6 +5,19 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.19] — 2026-09-14
+
+### Added — unit tests for 5 deep modules + off-by-one fix
+
+- 25 new hermetic checks: chain-executor dispatch (scan/crack/defer), memory
+  lifecycle (remember/dedup/lookup/forget), complex-bugs (deserialization /
+  type-juggling / mass-assignment / prototype-pollution / SSRF / SSTI / XXE),
+  route-confusion (dynamic dispatch/method/include/batch), universal-taint
+  (PHP command-injection + sanitizer suppression + language detection).
+- Fixed an off-by-one in `detectBatchForwarding`: a single-line
+  `foreach (...) { forward(...); }` was missed because the body scan skipped the
+  `foreach` line itself.
+
 ## [2.4.18] — 2026-09-14
 
 ### Fixed — catalog placeholder installs (full audit)

package/dist/index.js

@@ -55682,7 +55682,7 @@ function detectBatchForwarding(code, file, out) {
   let m;
   while ((m = BATCH_LOOP_RE.exec(code)) !== null) {
     const ln = lineNo(code, m.index);
-    const body = lines(code).slice(ln, ln + 8).join(`
+    const body = lines(code).slice(ln - 1, ln + 8).join(`
 `);
     const forwards = /\b(call_user_func|forward|dispatch|resolve_route|invoke|handle|route)\s*\(/i.test(body);
     if (!forwards)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.18",
+  "version": "2.4.19",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {