circle-ir-ai 4.16.1 → 4.16.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +23 -0
- package/package.json +4 -3
package/CHANGELOG.md
CHANGED
|
@@ -7,6 +7,29 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
7
7
|
|
|
8
8
|
## [Unreleased]
|
|
9
9
|
|
|
10
|
+
## [4.16.2] - 2026-09-24
|
|
11
|
+
|
|
12
|
+
### Changed
|
|
13
|
+
- **circle-ir 4.9.23 → 4.9.25.** Two `analyzeProject` robustness fixes from 4.9.24, both of
|
|
14
|
+
which turned a scannable repo into a hard failure, plus the 4.9.25 lockstep tag (no library
|
|
15
|
+
change). Neither changes detection on ordinary source.
|
|
16
|
+
- **cognium-dev#458 / #420 — a Python starred parameter no longer fails the project analysis
|
|
17
|
+
closed.** `CrossFileResolver` interpolated a method parameter straight into `\b<name>\b`, so
|
|
18
|
+
`*args` / `**kwargs` arrived with their stars, `*` read as a quantifier, the pattern failed to
|
|
19
|
+
compile ("Nothing to repeat") and the whole `analyzeProject` call failed. This is the direct
|
|
20
|
+
cause of a chunk of the `meta.crossFile.error` rows our #482 pass reports — 42 errors on the
|
|
21
|
+
485-repo Cisco sweep of 2026-09-23, with urllib3 / fickling / haystack among the 6-in-95
|
|
22
|
+
upstream measured. Expect that error count to drop on the next sweep. Per-file `analyze()` was
|
|
23
|
+
never affected.
|
|
24
|
+
- **cognium-dev#460 / #421 — minified / bundled files no longer wedge the project scan.**
|
|
25
|
+
`analyze()` now returns a minimal IR for any file whose longest line exceeds 10,000 characters.
|
|
26
|
+
Our own `crossFile` guard (#482) already skipped these at a **tighter** 5,000 characters, so
|
|
27
|
+
this is belt-and-braces for that path — but it also protects every *other* `analyzeProject`
|
|
28
|
+
caller, which our guard never covered. NodeGoat drops ~56 s → ~0.4 s upstream.
|
|
29
|
+
|
|
30
|
+
Lockfile refreshed; single circle-ir copy verified.
|
|
31
|
+
|
|
32
|
+
|
|
10
33
|
## [4.16.1] - 2026-09-23
|
|
11
34
|
|
|
12
35
|
### Fixed
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "circle-ir-ai",
|
|
3
|
-
"version": "4.16.
|
|
3
|
+
"version": "4.16.2",
|
|
4
4
|
"description": "LLM-enhanced SAST analysis built on circle-ir",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"module": "dist/index.js",
|
|
@@ -69,7 +69,8 @@
|
|
|
69
69
|
"benchmark:csharp": "tsx benchmarks/runners/run-csharp.ts",
|
|
70
70
|
"benchmark:csharp-product": "tsx benchmarks/runners/run-csharp-product.ts",
|
|
71
71
|
"benchmark:csharp-juliet": "tsx benchmarks/runners/run-csharp-juliet.ts",
|
|
72
|
-
"benchmark:vuln-localization": "tsx benchmarks/runners/run-vuln-localization.ts --limit 20"
|
|
72
|
+
"benchmark:vuln-localization": "tsx benchmarks/runners/run-vuln-localization.ts --limit 20",
|
|
73
|
+
"test:coverage": "vitest run --coverage"
|
|
73
74
|
},
|
|
74
75
|
"keywords": [
|
|
75
76
|
"sast",
|
|
@@ -103,7 +104,7 @@
|
|
|
103
104
|
"@ax-llm/ax": "^20.0.0",
|
|
104
105
|
"@cognium/project-profile-detect": "^1.1.0",
|
|
105
106
|
"@mastra/core": "^1.18.0",
|
|
106
|
-
"circle-ir": "4.9.
|
|
107
|
+
"circle-ir": "4.9.25",
|
|
107
108
|
"minimatch": "^10.2.5",
|
|
108
109
|
"p-queue": "^9.1.0"
|
|
109
110
|
},
|