circle-ir-ai 2.8.21 → 2.8.23

package/CHANGELOG.md

@@ -5,6 +5,84 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.8.23] - 2026-06-16
+
+### Changed — bump `circle-ir` 3.49.0 → 3.50.0
+
+Recall improvement for inline-source taint patterns. circle-ir#83
+(subsumes #76) closes the cross-language false-negative class where
+a taint source used inline as a call/concat argument was not
+tracked — previously only an intermediate variable recovered the
+flow:
+
+- **Java**: `Runtime.getRuntime().exec("echo " + req.getParameter("u"))`
+  and `Runtime.getRuntime().exec(req.getParameter("u"))`
+- **JavaScript/TypeScript**: `eval(req.query.x)`,
+  `vm.runInThisContext(req.cookies.c)`,
+  `child_process.exec(req.body.cmd)`
+- **Python**: `os.system("echo " + request.args.get("u"))` plus
+  for-loop iterable patterns: `for p in request.args.getlist("p"):
+  os.system(p)` (closes the original cognium-dev#76)
+
+Four upstream fixes combined: an inline-source colocation pass in
+`taint-propagation-pass.ts`, Python for-loop iterable derivation
+with virtual `http_param` anchor, loosened empty-source early
+returns in `taint-propagation-pass.ts` / `interprocedural-pass.ts`,
+and `canSourceReachSink` matrix expansion for JS RCE shapes
+(`code_injection` valid sink for `http_param` / `http_query` /
+`http_header` / `http_cookie`).
+
+Expected impact: lifts the dominant recall gap on OWASP
+BenchmarkPython, OWASP Benchmark Java with bare-arg variants, and
+the JS `eval(req.query.x)` shape. Should be visible on
+CWE-Bench-Java cmdi/code-injection runs as well.
+
+No circle-ir-ai source change — dep-only bump to surface the
+upstream recall fix to cognium-ai / circle-pack / mcp-server
+consumers.
+
+## [2.8.22] - 2026-06-16
+
+### Changed — bump `circle-ir` 3.48.0 → 3.49.0
+
+Pulls in upstream additive sink/pass coverage with no API surface
+changes. Visible to cognium-ai users without any engine-side work:
+
+- **`insecure-cookie` pattern pass for JavaScript/TypeScript (CWE-614,
+  circle-ir#43)** — scans `res.cookie(...)` / `reply.cookie(...)`
+  invocations for missing `secure: true` / `httpOnly: true` flags.
+  Pattern-based, no taint required. One finding per call site,
+  severity `medium`.
+- **`log_injection` sinks for Java + JavaScript/TypeScript (CWE-117,
+  circle-ir#44)** — slf4j/logback `Logger.info`/`warn`/`error`/etc.
+  and `java.util.logging.Logger` for Java; `console.log`/`warn`/`error`/
+  `info`/`debug`/`trace` for JS/TS. Severity `low`.
+- **`nosql_injection` (CWE-943) mongoose Model/Query fluent-chain
+  coverage (circle-ir#45)** — closes the gap where
+  `User.findOne({ username })` and friends didn't fire because the
+  receiver doesn't resolve to `Collection`. Adds `Model` /`Query`
+  class entries plus classless `findOne`/`updateOne`/`aggregate`/…
+  for JS/TS.
+- **Classless `open_redirect` (CWE-601) entry for Express
+  `res.redirect()` (circle-ir#46)** — removes the receiver-type
+  resolution dependency for the Express response object.
+- **Python `path_traversal` sanitizers for `os.path.realpath` and
+  `os.path.abspath` (circle-ir#48 pt 2)** — Python equivalents of
+  Java's `File.getCanonicalPath`; cuts the canonical-path FP class on
+  Python codebases.
+- **Rust actix-web / axum typed extractors now produce taint flows
+  (circle-ir#71)** — three fixes in the upstream taint matcher /
+  language-sources / propagation passes so `web::Path<…>` /
+  `axum::extract::Path<…>` are recognised as sources, source `type`
+  is selected per extractor kind (`Form`/`Query`/`Path` →
+  `http_param`; `Json`/`Body`/`Bytes`/`Multipart` → `http_body`),
+  and source `variable` is attached so propagation can fire.
+  Mostly improves Rust HTTP framework detection (axum, actix-web).
+
+No circle-ir-ai source change in this release — it's a dep-only bump
+to surface the upstream additive coverage to cognium-ai / circle-pack
+/ mcp-server consumers.
+
 ## [2.8.21] - 2026-06-15
 
 ### Fixed — capability_mismatch severity inversion for over-declared capabilities (cognium-ai#100 Bug #2)
@@ -49,6 +127,35 @@ real vulnerability-bearing files). Test updated to assert the new
 default. No production behaviour change — `prepublishOnly` was
 blocking publish on the stale assertion.
 
+### Changed — bundled LLM throughput defaults (2026-06-14, undocumented in 2.8.20)
+
+`src/llm/ax-client.ts` raised three defaults to match modern hosted
+LLM headroom — committed alongside the 2.8.20 → 2.8.21 work but not
+called out in 2.8.20's CHANGELOG. Recording here for traceability:
+
+- `MAX_CODE_CONTEXT_LENGTH` `8000` → `32000` chars (env
+  `LLM_MAX_CODE_CONTEXT` overrides).
+- `LLM_MAX_CONCURRENT` `5` → `10` (env override unchanged).
+- `LLM_RATE_LIMIT` `10` → `20` req/s (env override unchanged).
+
+Override individually via env to restore the previous limits on
+constrained backends.
+
+### Changed — big-file / minified-shape skip guard (mastra swarm path)
+
+`src/agents/mastra/swarm.ts` now short-circuits per-file analysis
+when content exceeds `LLM_MAX_FILE_BYTES` (default 500 KB) or
+matches a minified-shape heuristic (longest line > 5000 chars, or
+avg line > 500 chars). Minified bundles (e.g. `mermaid.min.js` at
+~18k parse errors) and giant generated files (~140 kLOC AWS SDK
+marshallers) thrash tree-sitter without producing useful findings;
+skipping them up-front saves 30 s – 3 min per file vs hitting the
+analysis timeout. Surfaced through the same `[SKIP]` stderr marker
+introduced in cognium-ai#88. Also tightened LLM-mode timeout
+defaults (`llmEnrichmentMs`/`llmVerificationMs` 60 s → 45 s,
+`llmMaxMs` 180 s → 120 s) for fail-fast behaviour on real-world
+mixes.
+
 ## [2.8.20] - 2026-06-13
 
 ### Changed — circle-ir 3.39.0 → 3.48.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir-ai",
-  "version": "2.8.21",
+  "version": "2.8.23",
   "description": "LLM-enhanced SAST analysis built on circle-ir",
   "main": "dist/index.js",
   "module": "dist/index.js",
@@ -94,7 +94,7 @@
   "dependencies": {
     "@ax-llm/ax": "^20.0.0",
     "@mastra/core": "^1.18.0",
-    "circle-ir": "3.48.0",
+    "circle-ir": "3.50.0",
     "minimatch": "^10.2.5",
     "p-queue": "^9.1.0"
   },