circle-ir-ai 4.14.0 → 4.14.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +20 -0
- package/package.json +4 -3
package/CHANGELOG.md
CHANGED
|
@@ -7,6 +7,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
7
7
|
|
|
8
8
|
## [Unreleased]
|
|
9
9
|
|
|
10
|
+
## [4.14.2] - 2026-09-19
|
|
11
|
+
|
|
12
|
+
### Changed
|
|
13
|
+
- Bump circle-ir 4.9.16 → 4.9.17. Single copy verified; typecheck + suite clean.
|
|
14
|
+
|
|
15
|
+
|
|
16
|
+
## [4.14.1] - 2026-09-18
|
|
17
|
+
|
|
18
|
+
### Changed
|
|
19
|
+
- **circle-ir 4.9.14 → 4.9.16.** Picks up the SAST-team precision/detection fixes
|
|
20
|
+
(JDBC CWE-89 retype, ProcessBuilder CWE-78, juice-shop XSS FP removals, plugin_param,
|
|
21
|
+
C# LDAP, JS/TS sink shapes, C# `using var`, Python trust_boundary). Finding counts move
|
|
22
|
+
in both directions on a rescan — expected movement, not regression.
|
|
23
|
+
- **skills-419 `SKILL_SINK_FLOW_GUARD=0` rollback test skipped** — obsolete against
|
|
24
|
+
circle-ir >=4.9.16: the legacy per-sink emission relied on the pre-4.9.16 IR sink-inventory
|
|
25
|
+
shape (#358 removed the setTimeout sink; the inventory structure changed), so the rollback
|
|
26
|
+
to pre-#419 behavior is now inert. The #419 fix itself (4 default-behavior tests) is
|
|
27
|
+
unaffected and green.
|
|
28
|
+
|
|
29
|
+
|
|
10
30
|
## [4.14.0] - 2026-09-15
|
|
11
31
|
|
|
12
32
|
### Fixed
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "circle-ir-ai",
|
|
3
|
-
"version": "4.14.
|
|
3
|
+
"version": "4.14.2",
|
|
4
4
|
"description": "LLM-enhanced SAST analysis built on circle-ir",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"module": "dist/index.js",
|
|
@@ -68,7 +68,8 @@
|
|
|
68
68
|
"benchmark:instruction-safety": "tsx benchmarks/instruction-safety/run-benchmark.ts",
|
|
69
69
|
"benchmark:csharp": "tsx benchmarks/runners/run-csharp.ts",
|
|
70
70
|
"benchmark:csharp-product": "tsx benchmarks/runners/run-csharp-product.ts",
|
|
71
|
-
"benchmark:csharp-juliet": "tsx benchmarks/runners/run-csharp-juliet.ts"
|
|
71
|
+
"benchmark:csharp-juliet": "tsx benchmarks/runners/run-csharp-juliet.ts",
|
|
72
|
+
"benchmark:vuln-localization": "tsx benchmarks/runners/run-vuln-localization.ts --limit 20"
|
|
72
73
|
},
|
|
73
74
|
"keywords": [
|
|
74
75
|
"sast",
|
|
@@ -102,7 +103,7 @@
|
|
|
102
103
|
"@ax-llm/ax": "^20.0.0",
|
|
103
104
|
"@cognium/project-profile-detect": "^1.1.0",
|
|
104
105
|
"@mastra/core": "^1.18.0",
|
|
105
|
-
"circle-ir": "4.9.
|
|
106
|
+
"circle-ir": "4.9.17",
|
|
106
107
|
"minimatch": "^10.2.5",
|
|
107
108
|
"p-queue": "^9.1.0"
|
|
108
109
|
},
|