circle-ir-ai 2.19.0 → 2.19.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +25 -0
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,31 @@ All notable changes to this project will be documented in this file.
|
|
|
5
5
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
7
|
|
|
8
|
+
## [2.19.1] - 2026-06-25
|
|
9
|
+
|
|
10
|
+
### Changed — dep refresh
|
|
11
|
+
|
|
12
|
+
- Bump `circle-ir` `3.106.0` → `3.107.0`. Three independent Java/JS
|
|
13
|
+
false-positive fixes at the sink-filter layer (zero engine API
|
|
14
|
+
surface change, recall preserved on OWASP Benchmark + Juliet):
|
|
15
|
+
- **JS `setInterval` / `setTimeout` code_injection over-fire**
|
|
16
|
+
(cognium-dev#152) — drops flows when the sole contributing source
|
|
17
|
+
is an `interprocedural_param` and the sink line is a timer call.
|
|
18
|
+
Real string sources and `eval()` flows preserved.
|
|
19
|
+
- **Java `xxe` over-matches CommonMark `Parser.parse()`**
|
|
20
|
+
(cognium-dev#181) — new sink-filter Stage 9f drops XXE when the
|
|
21
|
+
receiver type resolves to a data parser (excluding real XML
|
|
22
|
+
parsers); mirrors the earlier code_injection fix for the same
|
|
23
|
+
pattern.
|
|
24
|
+
- **Java `sql_injection` over-fires on regex-allowlist-quoter
|
|
25
|
+
wrappers** (cognium-dev#191 / FP-77) — new Stage 15 detects
|
|
26
|
+
parameterized SQL assembly (`?` placeholders + inline
|
|
27
|
+
`.matches()` guards) and suppresses; bare-variable concat and
|
|
28
|
+
unguarded wrappers continue to fire.
|
|
29
|
+
|
|
30
|
+
No engine surface change in circle-ir-ai itself — 904 tests
|
|
31
|
+
unchanged, `projectProfile` threading from 2.19.0 unchanged.
|
|
32
|
+
|
|
8
33
|
## [2.19.0] - 2026-06-25
|
|
9
34
|
|
|
10
35
|
### Added — `projectProfile` engine threading (cognium-ai#130)
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "circle-ir-ai",
|
|
3
|
-
"version": "2.19.
|
|
3
|
+
"version": "2.19.1",
|
|
4
4
|
"description": "LLM-enhanced SAST analysis built on circle-ir",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"module": "dist/index.js",
|
|
@@ -96,7 +96,7 @@
|
|
|
96
96
|
"@ax-llm/ax": "^20.0.0",
|
|
97
97
|
"@cognium/project-profile-detect": "^1.1.0",
|
|
98
98
|
"@mastra/core": "^1.18.0",
|
|
99
|
-
"circle-ir": "3.
|
|
99
|
+
"circle-ir": "3.107.0",
|
|
100
100
|
"minimatch": "^10.2.5",
|
|
101
101
|
"p-queue": "^9.1.0"
|
|
102
102
|
},
|