circle-ir-ai 4.16.2 → 4.16.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +27 -0
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -7,6 +7,33 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
7
7
|
|
|
8
8
|
## [Unreleased]
|
|
9
9
|
|
|
10
|
+
## [4.16.3] - 2026-09-24
|
|
11
|
+
|
|
12
|
+
### Changed
|
|
13
|
+
- **circle-ir 4.9.25 → 4.9.26.** Go/C# precision + recall batch. Not a lockstep tag — one of
|
|
14
|
+
these fixes a bug that shipped in our current pin.
|
|
15
|
+
- **cognium-dev#472 — Go taint no longer leaks to a same-named local in another function.**
|
|
16
|
+
The argument-expression matcher links source to sink by variable name, and its same-method
|
|
17
|
+
gate compared method *names*: it never ran for assignment-shaped sources (`a := os.Args`) and
|
|
18
|
+
could not separate two functions sharing a name (`(*A).ServeHTTP` / `(*C).ServeHTTP`). So a
|
|
19
|
+
`b := []byte("x")` in one function inherited the taint of `b, _ := io.ReadAll(r.Body)` in
|
|
20
|
+
another. **This shipped in 4.9.23–4.9.25 via the #459 `r.Body` source — i.e. it is live in our
|
|
21
|
+
4.16.2 pin.** Go now compares the enclosing function by line range; package-level sources stay
|
|
22
|
+
unscoped and closures share their handler's scope. 36 flows removed across 175 Go repos
|
|
23
|
+
(33 re-attributed to the correct source, 3 cross-function sinks dropped).
|
|
24
|
+
- **cognium-dev#343** — Go `bufio.NewScanner`/`NewReader` over the request body: `sc.Text()`,
|
|
25
|
+
`sc.Bytes()`, `br.ReadString(…)` now seed `http_body`.
|
|
26
|
+
- **cognium-dev#339** — C# bare expression-statement sinks with an inline request read
|
|
27
|
+
(`File.Create(Path.Combine(dir, file.FileName));`) were silent while the assigned form fired.
|
|
28
|
+
- **cognium-dev#473** — `initParser` cached a *failed* init forever, so one bad `wasmPath` or a
|
|
29
|
+
transient fetch failure poisoned every later `initParser`/`initAnalyzer` call in the process.
|
|
30
|
+
|
|
31
|
+
**Baseline impact (expected, not regression):** Go counts move in **both** directions. #472
|
|
32
|
+
re-attributes source lines, so a baseline keyed on `sink@source->sink` shows one removal plus one
|
|
33
|
+
addition per affected flow; #343/#339 add genuinely new Go/C# findings. No API or output-shape
|
|
34
|
+
change. Lockfile refreshed; single circle-ir copy verified.
|
|
35
|
+
|
|
36
|
+
|
|
10
37
|
## [4.16.2] - 2026-09-24
|
|
11
38
|
|
|
12
39
|
### Changed
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "circle-ir-ai",
|
|
3
|
-
"version": "4.16.
|
|
3
|
+
"version": "4.16.3",
|
|
4
4
|
"description": "LLM-enhanced SAST analysis built on circle-ir",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"module": "dist/index.js",
|
|
@@ -104,7 +104,7 @@
|
|
|
104
104
|
"@ax-llm/ax": "^20.0.0",
|
|
105
105
|
"@cognium/project-profile-detect": "^1.1.0",
|
|
106
106
|
"@mastra/core": "^1.18.0",
|
|
107
|
-
"circle-ir": "4.9.
|
|
107
|
+
"circle-ir": "4.9.26",
|
|
108
108
|
"minimatch": "^10.2.5",
|
|
109
109
|
"p-queue": "^9.1.0"
|
|
110
110
|
},
|