blitzstrike 2.4.30 → 2.4.31

package/CHANGELOG.md

@@ -5,6 +5,15 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.31] — 2026-09-14
+
+### Fixed — full CWE coverage in the compliance table (self-audit)
+
+- Added 6 CWEs that detectors/writeups can emit but were missing from the
+  compliance mapping: CWE-90 (LDAP), CWE-93 (CRLF/response-splitting), CWE-98
+  (PHP RFI), CWE-347 (JWT signature), CWE-643 (XPath), CWE-644 (header
+  injection). Every CWE the codebase references now maps to a framework.
+
 ## [2.4.30] — 2026-09-14
 
 ### Added — Proof-Obligation Engine (structure by construction)

package/dist/index.js

@@ -33346,7 +33346,13 @@ var CWE_COMPLIANCE = {
   "640": { name: "Weak Password Recovery", owasp_top10: "A07:2021 Identification and Authentication Failures", asvs: ["V2.5.2"], pci: ["8.3.6"], iso: ["A.8.5"], nist: ["IA-5"] },
   "798": { name: "Hard-coded Credentials", owasp_top10: "A07:2021 Identification and Authentication Failures", asvs: ["V2.10.4"], pci: ["8.3.8"], iso: ["A.8.5"], nist: ["IA-5"] },
   "327": { name: "Weak Cryptography", owasp_top10: "A02:2021 Cryptographic Failures", asvs: ["V6.2.1"], pci: ["3.5.1"], iso: ["A.8.24"], nist: ["SC-13"] },
-  "306": { name: "Missing Authentication for Critical Function", owasp_top10: "A07:2021 Identification and Authentication Failures", asvs: ["V1.2.1"], pci: ["8.1.1"], iso: ["A.8.5"], nist: ["IA-2"] }
+  "306": { name: "Missing Authentication for Critical Function", owasp_top10: "A07:2021 Identification and Authentication Failures", asvs: ["V1.2.1"], pci: ["8.1.1"], iso: ["A.8.5"], nist: ["IA-2"] },
+  "90": { name: "LDAP Injection", owasp_top10: "A03:2021 Injection", asvs: ["V5.3.7"], pci: ["6.5.1"], iso: ["A.8.26"], nist: ["SI-10"] },
+  "93": { name: "CRLF Injection / HTTP Response Splitting", owasp_top10: "A03:2021 Injection", asvs: ["V5.2.3"], pci: ["6.5.1"], iso: ["A.8.26"], nist: ["SI-10"] },
+  "98": { name: "PHP Remote File Inclusion", owasp_top10: "A03:2021 Injection", asvs: ["V12.3.1"], pci: ["6.5.8"], iso: ["A.8.12"], nist: ["SI-10"] },
+  "347": { name: "Improper Verification of Cryptographic Signature (JWT)", owasp_top10: "A07:2021 Identification and Authentication Failures", asvs: ["V2.9.1"], pci: ["8.1.1"], iso: ["A.8.5"], nist: ["IA-2"] },
+  "643": { name: "XPath Injection", owasp_top10: "A03:2021 Injection", asvs: ["V5.3.10"], pci: ["6.5.1"], iso: ["A.8.26"], nist: ["SI-10"] },
+  "644": { name: "HTTP Header Injection", owasp_top10: "A03:2021 Injection", asvs: ["V5.2.3"], pci: ["6.5.1"], iso: ["A.8.26"], nist: ["SI-10"] }
 };
 function complianceMap(cwe) {
   const id = (cwe ?? "").toUpperCase().replace(/^CWE-?/, "");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.30",
+  "version": "2.4.31",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {