circle-ir-ai 2.89.0 → 2.90.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +27 -0
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,33 @@ All notable changes to this project will be documented in this file.
|
|
|
5
5
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
7
|
|
|
8
|
+
## [2.90.0] - 2026-08-04
|
|
9
|
+
|
|
10
|
+
### Changed — circle-ir 3.206.0 → 3.209.0 (upstream FP fixes; cognium-dev#269)
|
|
11
|
+
|
|
12
|
+
Bumps the pinned engine to pick up the static-detector FP fixes routed upstream
|
|
13
|
+
from the 2026-08-04 top-100 Java validation sweep:
|
|
14
|
+
|
|
15
|
+
- **circle-ir 3.208.0 / cognium-ai#268** — `StringBuilder`/`StringBuffer.append`
|
|
16
|
+
are no longer over-broad XSS sinks (CWE-79). This was the #1 crit/high FP
|
|
17
|
+
bucket (~350 static findings). Verified against the published 3.208.0: the
|
|
18
|
+
`StringBuilder.append` repro now emits **0** XSS (was 2, incl. a constant
|
|
19
|
+
`System.lineSeparator()` arg); real HTML write-sinks still fire (OWASP xss
|
|
20
|
+
194→194 per #269). This is the **engine-side** half of the CWE-79 fix — it
|
|
21
|
+
complements the #258 verifier-severity cap (2.89.0): the detector no longer
|
|
22
|
+
emits the FP, and the verifier no longer elevates what remains
|
|
23
|
+
(defense in depth).
|
|
24
|
+
- **circle-ir 3.207.0 / cognium-ai#253** — `ScanSecretsPass` now detects
|
|
25
|
+
credentials embedded in URI connection strings (`scheme://user:pw@host`).
|
|
26
|
+
- **circle-ir 3.206.0 / cognium-ai#129** — already in place (log_injection /
|
|
27
|
+
format_string / nosql_injection reach-map gap).
|
|
28
|
+
|
|
29
|
+
Bumped through to circle-ir 3.209.0 (latest in the 3.206–3.209 FP-fix line;
|
|
30
|
+
#268 XSS-sink fix re-verified on 3.209.0 — StringBuilder repro still emits 0).
|
|
31
|
+
Single-copy assertion holds (1 copy), full suite green (1688 pass /
|
|
32
|
+
3 skip). Fleet verification of the CWE-79 bucket collapse + static-parity flips
|
|
33
|
+
tracked in cognium-dev#269.
|
|
34
|
+
|
|
8
35
|
## [2.89.0] - 2026-08-04
|
|
9
36
|
|
|
10
37
|
### Fixed — verifier could ELEVATE severity above the detector, inflating crit/high FPs (#258)
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "circle-ir-ai",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.90.0",
|
|
4
4
|
"description": "LLM-enhanced SAST analysis built on circle-ir",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"module": "dist/index.js",
|
|
@@ -98,7 +98,7 @@
|
|
|
98
98
|
"@ax-llm/ax": "^20.0.0",
|
|
99
99
|
"@cognium/project-profile-detect": "^1.1.0",
|
|
100
100
|
"@mastra/core": "^1.18.0",
|
|
101
|
-
"circle-ir": "3.
|
|
101
|
+
"circle-ir": "3.209.0",
|
|
102
102
|
"minimatch": "^10.2.5",
|
|
103
103
|
"p-queue": "^9.1.0"
|
|
104
104
|
},
|