circle-ir-ai 2.19.0 → 2.19.2

package/CHANGELOG.md

@@ -5,6 +5,57 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.19.2] - 2026-06-26
+
+### Changed — benchmarks only (no npm dist change)
+
+- **`benchmarks/runners/run-top100-secure.ts`**: per-`srcPath` chunking
+  with greedy coalescing replaces the prior 200-file static cap.
+  Each oversized `srcPath` is split by immediate child dirs (max
+  depth 4), adjacent sibling chunks are bin-packed up to
+  `CHUNK_MAX_FILES = 500`, and results roll up by `parentRepo` for
+  the summary table while a new `chunks` field in the JSON output
+  carries per-chunk detail. Tracked in cognium-ai#132.
+- **Coverage impact**: 17.0% (3,441 / 20,216) → **100%** (18,469 /
+  18,469) across 12 cloned repos / 69 chunks. Without coalescing,
+  transformers alone would emit 462 micro-chunks; the packer
+  collapses adjacent siblings (462 → 8).
+- **Backwards-compat**: ≤ 500-file repos emit a single chunk with
+  `id === parentRepo`, name unchanged — cargo / express / etc.
+  produce the same row shape as the pre-chunking runner.
+- **Methodology note**: top-100 numbers from this release onward are
+  not directly comparable to pre-2.19.2 runs. The prior `n=200`
+  sampling cap is gone; new numbers reflect the full curated
+  `srcPath` source tree.
+
+Published `dist/` is byte-identical to 2.19.1 — bump exists only as a
+release-notes marker for the benchmark methodology change.
+
+## [2.19.1] - 2026-06-25
+
+### Changed — dep refresh
+
+- Bump `circle-ir` `3.106.0` → `3.107.0`. Three independent Java/JS
+  false-positive fixes at the sink-filter layer (zero engine API
+  surface change, recall preserved on OWASP Benchmark + Juliet):
+  - **JS `setInterval` / `setTimeout` code_injection over-fire**
+    (cognium-dev#152) — drops flows when the sole contributing source
+    is an `interprocedural_param` and the sink line is a timer call.
+    Real string sources and `eval()` flows preserved.
+  - **Java `xxe` over-matches CommonMark `Parser.parse()`**
+    (cognium-dev#181) — new sink-filter Stage 9f drops XXE when the
+    receiver type resolves to a data parser (excluding real XML
+    parsers); mirrors the earlier code_injection fix for the same
+    pattern.
+  - **Java `sql_injection` over-fires on regex-allowlist-quoter
+    wrappers** (cognium-dev#191 / FP-77) — new Stage 15 detects
+    parameterized SQL assembly (`?` placeholders + inline
+    `.matches()` guards) and suppresses; bare-variable concat and
+    unguarded wrappers continue to fire.
+
+No engine surface change in circle-ir-ai itself — 904 tests
+unchanged, `projectProfile` threading from 2.19.0 unchanged.
+
 ## [2.19.0] - 2026-06-25
 
 ### Added — `projectProfile` engine threading (cognium-ai#130)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir-ai",
-  "version": "2.19.0",
+  "version": "2.19.2",
   "description": "LLM-enhanced SAST analysis built on circle-ir",
   "main": "dist/index.js",
   "module": "dist/index.js",
@@ -96,7 +96,7 @@
     "@ax-llm/ax": "^20.0.0",
     "@cognium/project-profile-detect": "^1.1.0",
     "@mastra/core": "^1.18.0",
-    "circle-ir": "3.106.0",
+    "circle-ir": "3.107.0",
     "minimatch": "^10.2.5",
     "p-queue": "^9.1.0"
   },