circle-ir-ai 2.37.9 → 2.37.11

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/CHANGELOG.md +55 -0
  2. package/package.json +1 -1
package/CHANGELOG.md CHANGED
@@ -5,11 +5,66 @@ All notable changes to this project will be documented in this file.
5
5
  The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
6
6
  and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7
7
 
8
+ ## [2.37.11] - 2026-07-07
9
+
10
+ ### Re-forwarded — repin `circle-ir` `3.155.0 → 3.156.0`
11
+
12
+ Zero-code re-forward. Undoes the 2.37.10 rollback after the
13
+ rollback-verification sweep proved the "regression" flagged in
14
+ [cogniumhq/cognium-ai#202](https://github.com/cogniumhq/cognium-ai/issues/202)
15
+ was a false alarm.
16
+
17
+ **Root cause of the false alarm.** The 2.31.8 golden baseline was run
18
+ against a warm verifier cache and produced 200+ zero-token
19
+ `verifyTaintPathsBatch` entries via `logVerifyCacheHit()` in
20
+ `src/llm/verification.ts:1168`. Comparing those cache-hit log lines
21
+ against the cold-cache 2.31.9 sweep on 3.156.0 inflated the apparent
22
+ "real call" delta by ~2x. The rollback-verification sweep (cold cache
23
+ on 2.31.10 / 3.155.0) came in **higher** than the "regression" it was
24
+ meant to fix (5,543 realCalls vs 4,272), confirming the engine's
25
+ static pipeline is invariant across 3.155.0 → 3.156.0 and the delta
26
+ was cache-warmth artifact, not a signature-shape regression.
27
+
28
+ - All three sweeps (2.31.8 warm, 2.31.9 cold, 2.31.10 cold) share the
29
+ same 12,026 prefilter-skipped count → static pipeline unchanged.
30
+ - `verifyTaintPathsBatch` is still present in circle-ir-ai 2.37.11 —
31
+ it was not removed in circle-ir 3.156.0.
32
+
33
+ ### Tests
34
+
35
+ - 90 files, 1350 passed / 3 skipped.
36
+ - Typecheck + build clean.
37
+
38
+ ## [2.37.10] - 2026-07-06
39
+
40
+ ### Rolled back — repin `circle-ir` `3.156.0 → 3.155.0`
41
+
42
+ Zero-code rollback. Restores the last known-good engine after the Tier-2
43
+ sweep on 3.156.0 surfaced a sharp LLM-verifier regression (see
44
+ [cogniumhq/cognium-ai#202](https://github.com/cogniumhq/cognium-ai/issues/202)):
45
+
46
+ - Verifier calls +83.7% on same 12-repo panel with only +0.12% findings.
47
+ - USD cost +89.6% (\$2.47 → \$4.68).
48
+ - Root cause candidate: `verifyTaintPathsBatch` signature removed in
49
+ 3.156.0; work folded into heavier `verifyBatch` (0-token → full-token).
50
+ - Two amplifier repos (`openapi-generator` +385%, `hutool` +137%) drove
51
+ ~102% of the aggregate call increase.
52
+
53
+ Holding `circle-ir` at `3.155.0` until a fix ships upstream.
54
+
55
+ ### Tests
56
+
57
+ - 90 files, 1350 passed / 3 skipped (unchanged).
58
+ - Typecheck + build clean.
59
+
8
60
  ## [2.37.9] - 2026-07-06
9
61
 
10
62
  Bump `circle-ir` `3.155.0` → `3.156.0`. Zero-code refresh — pulls in
11
63
  upstream engine improvements published in `circle-ir@3.156.0`.
12
64
 
65
+ **Superseded by 2.37.10** — 3.156.0 caused a Tier-2 sweep regression
66
+ (cognium-ai#202); do not use 2.37.9.
67
+
13
68
  ### What changed
14
69
 
15
70
  - **`package.json`**:
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "circle-ir-ai",
3
- "version": "2.37.9",
3
+ "version": "2.37.11",
4
4
  "description": "LLM-enhanced SAST analysis built on circle-ir",
5
5
  "main": "dist/index.js",
6
6
  "module": "dist/index.js",