circle-ir-ai 2.80.0 → 2.81.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,44 @@ All notable changes to this project will be documented in this file.
|
|
|
5
5
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
7
|
|
|
8
|
+
## [2.81.0] - 2026-08-02
|
|
9
|
+
|
|
10
|
+
### Added — exhaustive source-type classification (circle-ir 3.198.0)
|
|
11
|
+
|
|
12
|
+
3.198.0 exports `SOURCE_TYPES` (25) and `SINK_TYPES` (29) as runtime arrays.
|
|
13
|
+
That closes the follow-up promised upstream: our classification sets are no
|
|
14
|
+
longer hand-copied, and an unhandled source type is now a **test failure**
|
|
15
|
+
instead of a silent severity demotion.
|
|
16
|
+
|
|
17
|
+
Diffing the real list against what we matched found two more gaps of the same
|
|
18
|
+
kind fixed in 2.79.1:
|
|
19
|
+
|
|
20
|
+
- **`http_query` — the HTTP query string — was classified nowhere.** Every
|
|
21
|
+
query-string source was falling through to `UNKNOWN` and being capped at low
|
|
22
|
+
outside `SINK_SHAPE_SUFFICIENT_CWES`. It is now a trust boundary.
|
|
23
|
+
- **`dom_input`** likewise, another DOM-XSS source.
|
|
24
|
+
|
|
25
|
+
And four values we match are **not declared upstream at all**:
|
|
26
|
+
`external_input`, `http_request`, `request_param`, `request_body`. Retained
|
|
27
|
+
deliberately — LLM discovery emits free-form type strings and has been observed
|
|
28
|
+
using them, so removing them would drop LLM-discovered sources to the UNKNOWN
|
|
29
|
+
cap. Now commented as such rather than looking like live union members.
|
|
30
|
+
|
|
31
|
+
New `NON_TRUST_BOUNDARY_SOURCE_TYPES` records the types considered and
|
|
32
|
+
*rejected*, with a rationale per group: environment (operator-controlled),
|
|
33
|
+
second-order (`db_input`, `file_input`, `network_input`, `http_response`,
|
|
34
|
+
`storage_input` — attacker-controlled only if something else wrote them),
|
|
35
|
+
`cli_arg` (operator-controlled under library/tool profiles), and internal
|
|
36
|
+
plumbing (`config_param`, `interprocedural_param`, `plugin_param`,
|
|
37
|
+
`constructor_field`).
|
|
38
|
+
|
|
39
|
+
`tests/source-type-exhaustive.test.ts` asserts the two sets together cover
|
|
40
|
+
`SOURCE_TYPES` exactly, with no overlap. When circle-ir adds a source type, that
|
|
41
|
+
test fails and forces a deliberate decision — the third instance of this failure
|
|
42
|
+
becomes loud instead of silent.
|
|
43
|
+
|
|
44
|
+
Suite 1646 pass + 3 skipped.
|
|
45
|
+
|
|
8
46
|
## [2.80.0] - 2026-08-01
|
|
9
47
|
|
|
10
48
|
### Changed — bump circle-ir 3.195.0 → 3.197.0
|
|
@@ -80,6 +80,38 @@ export interface SourceShape {
|
|
|
80
80
|
variable?: string | null;
|
|
81
81
|
code?: string | null;
|
|
82
82
|
}
|
|
83
|
+
/**
|
|
84
|
+
* Source `type` field semantic categories that map directly to a trust
|
|
85
|
+
* boundary regardless of surrounding AST context. circle-ir's taint
|
|
86
|
+
* sources are pre-categorized by the engine; when the type is already
|
|
87
|
+
* one of these, classification is unambiguous.
|
|
88
|
+
*/
|
|
89
|
+
export declare const TRUST_BOUNDARY_SOURCE_TYPES: Set<string>;
|
|
90
|
+
/**
|
|
91
|
+
* Source types deliberately NOT treated as a trust boundary.
|
|
92
|
+
*
|
|
93
|
+
* This exists so the two sets together cover circle-ir's entire exported
|
|
94
|
+
* `SOURCE_TYPES` array — `tests/source-type-exhaustive.test.ts` asserts it.
|
|
95
|
+
* A source type added upstream then fails a test here instead of silently
|
|
96
|
+
* falling through to `UNKNOWN`, which `applyClassificationGate` caps at low
|
|
97
|
+
* for any CWE outside `SINK_SHAPE_SUFFICIENT_CWES`.
|
|
98
|
+
*
|
|
99
|
+
* That silent fall-through is the exact failure this package absorbed twice:
|
|
100
|
+
* once when 3.195.0 renamed `user_input` → `io_input` (Python findings demoted
|
|
101
|
+
* critical→low), and again when seven declared browser source types turned out
|
|
102
|
+
* to be matched nowhere at all.
|
|
103
|
+
*
|
|
104
|
+
* Rationale per entry:
|
|
105
|
+
* - `env_input` / `env_var` — environment is operator-controlled, not
|
|
106
|
+
* attacker-controlled at a boundary.
|
|
107
|
+
* - `db_input` / `file_input` / `network_input` / `http_response` /
|
|
108
|
+
* `storage_input` — second-order: attacker-controlled only if something
|
|
109
|
+
* else wrote them first, which is a different flow to prove.
|
|
110
|
+
* - `cli_arg` — operator-controlled under our library and tool profiles.
|
|
111
|
+
* - `config_param` / `interprocedural_param` / `plugin_param` /
|
|
112
|
+
* `constructor_field` — internal plumbing, no boundary crossed.
|
|
113
|
+
*/
|
|
114
|
+
export declare const NON_TRUST_BOUNDARY_SOURCE_TYPES: Set<string>;
|
|
83
115
|
interface EnclosingScope {
|
|
84
116
|
type?: TypeShape;
|
|
85
117
|
method?: MethodShape;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"source-classifier.d.ts","sourceRoot":"","sources":["../../src/security-scan/source-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,MAAM,MAAM,oBAAoB,GAC5B,gBAAgB,GAChB,QAAQ,GACR,oBAAoB,GACpB,aAAa,GACb,SAAS,CAAC;AAEd;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,GAAG,WAAW,GAAG,MAAM,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;
|
|
1
|
+
{"version":3,"file":"source-classifier.d.ts","sourceRoot":"","sources":["../../src/security-scan/source-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,MAAM,MAAM,oBAAoB,GAC5B,gBAAgB,GAChB,QAAQ,GACR,oBAAoB,GACpB,aAAa,GACb,SAAS,CAAC;AAEd;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,GAAG,WAAW,GAAG,MAAM,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAMD;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,aAgCtC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,+BAA+B,aAa1C,CAAC;AA0GH,UAAU,cAAc;IACtB,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,GAAG,SAAS,GAAG,IAAI,EAClD,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAC9B,cAAc,CA0BhB;AA6BD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,IAAI,EACtC,KAAK,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,GAAG,IAAI,GACtC,oBAAoB,CAqEtB;AAkCD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,uBAAuB,CACrC,cAAc,EAAE,oBAAoB,EACpC,gBAAgB,EAAE,MAAM,EACxB,GAAG,CAAC,EAAE,MAAM,GACX,MAAM,GAAG,IAAI,CAgBf"}
|
|
@@ -54,37 +54,77 @@
|
|
|
54
54
|
* sources are pre-categorized by the engine; when the type is already
|
|
55
55
|
* one of these, classification is unambiguous.
|
|
56
56
|
*/
|
|
57
|
-
const TRUST_BOUNDARY_SOURCE_TYPES = new Set([
|
|
57
|
+
export const TRUST_BOUNDARY_SOURCE_TYPES = new Set([
|
|
58
58
|
'http_param',
|
|
59
59
|
'http_body',
|
|
60
60
|
'http_header',
|
|
61
61
|
'http_cookie',
|
|
62
62
|
'http_path',
|
|
63
|
-
//
|
|
64
|
-
//
|
|
65
|
-
//
|
|
66
|
-
|
|
67
|
-
//
|
|
63
|
+
// HTTP query string. Declared upstream since forever and matched here for
|
|
64
|
+
// the first time in 2.81.0 — until then every query-string source fell
|
|
65
|
+
// through to UNKNOWN and was capped at low outside a small CWE allowlist.
|
|
66
|
+
'http_query',
|
|
67
|
+
// DO NOT REMOVE `user_input` AS LEGACY. The JavaScript plugin emits it
|
|
68
|
+
// TODAY. circle-ir 3.195.0 removed only the *Python* duplicates, and it is a
|
|
69
|
+
// `@deprecated` union member whose removal is gated on a release carrying a
|
|
70
|
+
// Consumer Impact section.
|
|
68
71
|
'user_input',
|
|
69
|
-
// circle-ir 3.195.0+ — what Python `input()` emits now.
|
|
70
|
-
// source falls through to UNKNOWN, and `applyClassificationGate` caps
|
|
71
|
-
// UNKNOWN at LOW for every CWE outside SINK_SHAPE_SUFFICIENT_CWES, silently
|
|
72
|
-
// demoting critical/high path-traversal (CWE-22), XSS (CWE-79) and SSRF
|
|
73
|
-
// (CWE-918) findings.
|
|
72
|
+
// circle-ir 3.195.0+ — what Python `input()` emits now.
|
|
74
73
|
'io_input',
|
|
75
|
-
// Browser/DOM trust boundaries
|
|
76
|
-
//
|
|
77
|
-
// cap-at-low. These are textbook DOM-XSS sources: a `location.search`
|
|
78
|
-
// value reaching `innerHTML` is not a low-severity finding.
|
|
74
|
+
// Browser/DOM trust boundaries. Textbook DOM-XSS sources: a
|
|
75
|
+
// `location.search` value reaching `innerHTML` is not a low finding.
|
|
79
76
|
'url_param',
|
|
80
77
|
'navigation_param',
|
|
81
78
|
'message_input',
|
|
82
79
|
'file_upload',
|
|
80
|
+
'dom_input',
|
|
81
|
+
// Not members of circle-ir's `SourceType` union — retained because LLM
|
|
82
|
+
// discovery emits free-form type strings and has been observed using these.
|
|
83
|
+
// Harmless if unmatched; removing them would silently drop LLM-discovered
|
|
84
|
+
// sources to the UNKNOWN cap.
|
|
83
85
|
'external_input',
|
|
84
86
|
'http_request',
|
|
85
87
|
'request_param',
|
|
86
88
|
'request_body',
|
|
87
89
|
]);
|
|
90
|
+
/**
|
|
91
|
+
* Source types deliberately NOT treated as a trust boundary.
|
|
92
|
+
*
|
|
93
|
+
* This exists so the two sets together cover circle-ir's entire exported
|
|
94
|
+
* `SOURCE_TYPES` array — `tests/source-type-exhaustive.test.ts` asserts it.
|
|
95
|
+
* A source type added upstream then fails a test here instead of silently
|
|
96
|
+
* falling through to `UNKNOWN`, which `applyClassificationGate` caps at low
|
|
97
|
+
* for any CWE outside `SINK_SHAPE_SUFFICIENT_CWES`.
|
|
98
|
+
*
|
|
99
|
+
* That silent fall-through is the exact failure this package absorbed twice:
|
|
100
|
+
* once when 3.195.0 renamed `user_input` → `io_input` (Python findings demoted
|
|
101
|
+
* critical→low), and again when seven declared browser source types turned out
|
|
102
|
+
* to be matched nowhere at all.
|
|
103
|
+
*
|
|
104
|
+
* Rationale per entry:
|
|
105
|
+
* - `env_input` / `env_var` — environment is operator-controlled, not
|
|
106
|
+
* attacker-controlled at a boundary.
|
|
107
|
+
* - `db_input` / `file_input` / `network_input` / `http_response` /
|
|
108
|
+
* `storage_input` — second-order: attacker-controlled only if something
|
|
109
|
+
* else wrote them first, which is a different flow to prove.
|
|
110
|
+
* - `cli_arg` — operator-controlled under our library and tool profiles.
|
|
111
|
+
* - `config_param` / `interprocedural_param` / `plugin_param` /
|
|
112
|
+
* `constructor_field` — internal plumbing, no boundary crossed.
|
|
113
|
+
*/
|
|
114
|
+
export const NON_TRUST_BOUNDARY_SOURCE_TYPES = new Set([
|
|
115
|
+
'env_input',
|
|
116
|
+
'env_var',
|
|
117
|
+
'db_input',
|
|
118
|
+
'file_input',
|
|
119
|
+
'network_input',
|
|
120
|
+
'http_response',
|
|
121
|
+
'storage_input',
|
|
122
|
+
'cli_arg',
|
|
123
|
+
'config_param',
|
|
124
|
+
'interprocedural_param',
|
|
125
|
+
'plugin_param',
|
|
126
|
+
'constructor_field',
|
|
127
|
+
]);
|
|
88
128
|
/**
|
|
89
129
|
* Annotations on the enclosing method's parameters that mark a
|
|
90
130
|
* trust-boundary source — even when the source-line code itself
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"source-classifier.js","sourceRoot":"","sources":["../../src/security-scan/source-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AA+CH,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;
|
|
1
|
+
{"version":3,"file":"source-classifier.js","sourceRoot":"","sources":["../../src/security-scan/source-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AA+CH,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IACjD,YAAY;IACZ,WAAW;IACX,aAAa;IACb,aAAa;IACb,WAAW;IACX,0EAA0E;IAC1E,uEAAuE;IACvE,0EAA0E;IAC1E,YAAY;IACZ,uEAAuE;IACvE,6EAA6E;IAC7E,4EAA4E;IAC5E,2BAA2B;IAC3B,YAAY;IACZ,wDAAwD;IACxD,UAAU;IACV,4DAA4D;IAC5D,qEAAqE;IACrE,WAAW;IACX,kBAAkB;IAClB,eAAe;IACf,aAAa;IACb,WAAW;IACX,uEAAuE;IACvE,4EAA4E;IAC5E,0EAA0E;IAC1E,8BAA8B;IAC9B,gBAAgB;IAChB,cAAc;IACd,eAAe;IACf,cAAc;CACf,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC;IACrD,WAAW;IACX,SAAS;IACT,UAAU;IACV,YAAY;IACZ,eAAe;IACf,eAAe;IACf,eAAe;IACf,SAAS;IACT,cAAc;IACd,uBAAuB;IACvB,cAAc;IACd,mBAAmB;CACpB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,0BAA0B,GAAG;IACjC,uBAAuB;IACvB,cAAc;IACd,aAAa;IACb,eAAe;IACf,cAAc;IACd,aAAa;IACb,aAAa;IACb,gBAAgB;IAChB,gBAAgB;IAChB,SAAS;IACT,YAAY;IACZ,WAAW;IACX,aAAa;IACb,WAAW;IACX,aAAa;IACb,aAAa;IACb,WAAW;CACZ,CAAC;AAEF;;;;;GAKG;AACH,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC;IAC3C,YAAY;IACZ,gBAAgB;IAChB,MAAM,EAAE,SAAS;IACjB,YAAY;CACb,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,eAAe;IACf,aAAa;IACb,UAAU;IACV,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,eAAe;IACf,kBAAkB;IAClB,yBAAyB;IACzB,kBAAkB;IAClB,yBAAyB;IACzB,kBAAkB;IAClB,gBAAgB;IAChB,mBAAmB,EAAE,eAAe;IACpC,uBAAuB;IACvB,QAAQ;IACR,aAAa;IACb,4BAA4B;IAC5B,oBAAoB;IACpB,yBAAyB;CAC1B,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC;IAC3C,QAAQ;IACR,YAAY;IACZ,WAAW;IACX,KAAK;IACL,OAAO;IACP,aAAa;IACb,kBAAkB;CACnB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,eAAe,GAAa;IAChC,kCAAkC;IAClC,6BAA6B;IAC7B,+CAA+C;IAC/C,aAAa;IACb,6BAA6B;IAC7B,yBAAyB;IACzB,wCAAwC;IACxC,0DAA0D;IAC1D,+BAA+B;IAC/B,gEAAgE;CACjE,CAAC;AAWF;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAkD,EAClD,IAA+B;IAE/B,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACzD,IAAI,QAA+B,CAAC;IACpC,IAAI,UAAmC,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,IAAI,GAAG,CAAC,CAAC,UAAU,IAAI,IAAI,GAAG,CAAC,CAAC,QAAQ;YAAE,SAAS;QACvD,6CAA6C;QAC7C,IACE,CAAC,QAAQ;YACT,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,EACvE,CAAC;YACD,QAAQ,GAAG,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,EAAE,OAAO,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,IAAI,GAAG,CAAC,CAAC,UAAU,IAAI,IAAI,GAAG,CAAC,CAAC,QAAQ;gBAAE,SAAS;YACvD,IACE,CAAC,UAAU;gBACX,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,EAC3E,CAAC;gBACD,UAAU,GAAG,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CACzB,WAA8C,EAC9C,OAAyB;IAEzB,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,MAAM,GAAG,GAAG,OAAO,YAAY,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAChE,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,4DAA4D;QAC5D,MAAM,MAAM,GAAG,GAAG;aACf,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;aACjB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;aACtB,IAAI,EAAE,CAAC;QACV,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IACnC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAsC,EACtC,KAAuC;IAEvC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,wEAAwE;IACxE,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClD,IAAI,2BAA2B,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAEzE,wEAAwE;IACxE,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC;IACjC,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,CAAC;IAErC,qEAAqE;IACrE,kCAAkC;IAClC,IACE,aAAa;QACb,kBAAkB,CAAC,aAAa,CAAC,WAAW,EAAE,4BAA4B,CAAC,EAC3E,CAAC;QACD,8DAA8D;QAC9D,oEAAoE;QACpE,4DAA4D;QAC5D,IAAI,eAAe,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC;YAClF,IAAI,KAAK;gBAAE,OAAO,gBAAgB,CAAC;QACrC,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,IAAI,eAAe,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClF,IAAI,KAAK,IAAI,kBAAkB,CAAC,KAAK,CAAC,WAAW,EAAE,0BAA0B,CAAC,EAAE,CAAC;YAC/E,OAAO,gBAAgB,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,kEAAkE;IAClE,qDAAqD;IACrD,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,cAAc,GAAG,aAAa,CAAC,UAAU,IAAI,EAAE,CAAC;QACtD,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/C,IAAI,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,oBAAoB,CAAC;QACxE,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,IAAI,MAAM,CAAC,QAAQ,IAAI,4BAA4B,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzE,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,sEAAsE;IACtE,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5C,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC;YACjC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,QAAQ,CAAC;QACrC,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,qEAAqE;IACrE,kEAAkE;IAClE,uCAAuC;IACvC,IAAI,eAAe,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClF,IAAI,KAAK;YAAE,OAAO,aAAa,CAAC;IAClC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAS;IACjD,QAAQ,EAAI,uBAAuB;IACnC,QAAQ,EAAI,gBAAgB;IAC5B,QAAQ,EAAI,iBAAiB;IAC7B,SAAS,EAAG,2BAA2B;IACvC,SAAS,EAAG,oCAAoC;IAChD,SAAS,EAAG,4BAA4B;IACxC,SAAS,EAAG,wCAAwC;IACpD,SAAS,EAAG,wBAAwB;CACrC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,uBAAuB,CACrC,cAAoC,EACpC,gBAAwB,EACxB,GAAY;IAEZ,QAAQ,cAAc,EAAE,CAAC;QACvB,KAAK,oBAAoB;YACvB,OAAO,IAAI,CAAC;QACd,KAAK,QAAQ,CAAC;QACd,KAAK,aAAa;YAChB,OAAO,WAAW,CAAC,gBAAgB,CAAC,CAAC;QACvC,KAAK,SAAS;YACZ,IAAI,GAAG,IAAI,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/C,OAAO,gBAAgB,CAAC;YAC1B,CAAC;YACD,OAAO,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACpC,KAAK,gBAAgB,CAAC;QACtB;YACE,OAAO,gBAAgB,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB;IACnC,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC;IACpE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB;IAChC,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "circle-ir-ai",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.81.0",
|
|
4
4
|
"description": "LLM-enhanced SAST analysis built on circle-ir",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"module": "dist/index.js",
|
|
@@ -98,7 +98,7 @@
|
|
|
98
98
|
"@ax-llm/ax": "^20.0.0",
|
|
99
99
|
"@cognium/project-profile-detect": "^1.1.0",
|
|
100
100
|
"@mastra/core": "^1.18.0",
|
|
101
|
-
"circle-ir": "3.
|
|
101
|
+
"circle-ir": "3.198.0",
|
|
102
102
|
"minimatch": "^10.2.5",
|
|
103
103
|
"p-queue": "^9.1.0"
|
|
104
104
|
},
|