circle-ir-ai 2.39.0 → 2.40.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/CHANGELOG.md +26 -0
  2. package/package.json +2 -2
package/CHANGELOG.md CHANGED
@@ -5,6 +5,32 @@ All notable changes to this project will be documented in this file.
5
5
  The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
6
6
  and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7
7
 
8
+ ## [2.40.0] - 2026-07-10
9
+
10
+ ### Changed — bump `circle-ir` `3.164.0 → 3.165.0` (major precision win: source-misattribution fix)
11
+
12
+ circle-ir 3.165.0 fixes **cognium-dev#250** — taint findings whose
13
+ `source.line` resolved to a non-executable line (import / package /
14
+ comment / constant declaration) were being emitted with fabricated
15
+ source→sink flows. That accounted for **61% of the tier-2 Critical/High
16
+ residual**. Effect on real repos (verified, gpt-4o-mini verify):
17
+
18
+ | repo | C+H 3.164.0 | C+H 3.165.0 |
19
+ |---|---:|---:|
20
+ | INRIA/spoon | 24 | **2** |
21
+ | manifold-systems/manifold | 65 | **2** |
22
+
23
+ **No recall loss** — full benchmark suite re-verified against the
24
+ registry package: OWASP 100%, Juliet 100% (243/0 FN), **SecuriBench TPR
25
+ 97.7% (105/108, +1)**. As a bonus it also fixes **cognium-dev#249**:
26
+ rust-synthetic 84.6% → **92.3%** (FPR 15.4% → 7.7%). All other suites
27
+ stable.
28
+
29
+ This is a minor bump (not patch) because LLM-verified finding counts
30
+ drop dramatically on affected repos — a precision improvement, not
31
+ detection loss. Sweep baseline diffs across this version must attribute
32
+ the drop to the source-misattribution fix.
33
+
8
34
  ## [2.39.0] - 2026-07-10
9
35
 
10
36
  ### Changed — bump `circle-ir` `3.162.0 → 3.164.0`
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "circle-ir-ai",
3
- "version": "2.39.0",
3
+ "version": "2.40.0",
4
4
  "description": "LLM-enhanced SAST analysis built on circle-ir",
5
5
  "main": "dist/index.js",
6
6
  "module": "dist/index.js",
@@ -97,7 +97,7 @@
97
97
  "@ax-llm/ax": "^20.0.0",
98
98
  "@cognium/project-profile-detect": "^1.1.0",
99
99
  "@mastra/core": "^1.18.0",
100
- "circle-ir": "3.164.0",
100
+ "circle-ir": "3.165.0",
101
101
  "minimatch": "^10.2.5",
102
102
  "p-queue": "^9.1.0"
103
103
  },