circle-ir 3.178.0 → 3.179.0

package/dist/analysis/dependency-versions.d.ts

@@ -44,6 +44,118 @@ export interface FastjsonPomResolution {
  * define).
  */
 export declare function resolveFastjsonFromPom(pomXml: string): FastjsonPomResolution | null;
+/**
+ * Extract the effective Fastjson version from a Gradle build script
+ * (`build.gradle` Groovy DSL or `build.gradle.kts` Kotlin DSL).
+ *
+ * cognium-dev #261 (Gradle-first slice extending #258's pom.xml gate).
+ *
+ * Recognises three declaration shapes:
+ *
+ *   1. Direct literal — the classic Groovy / Kotlin single-string form:
+ *        implementation 'com.alibaba:fastjson:1.2.83_noneautotype'
+ *        implementation "com.alibaba:fastjson:1.2.83_noneautotype"
+ *        implementation("com.alibaba:fastjson:1.2.83_noneautotype")
+ *      Also `api`, `compile`, `runtimeOnly`, `testImplementation`, … — the
+ *      configuration keyword is not part of the regex; only the
+ *      `group:artifact:version` triple is matched, so any dependency-
+ *      configuration prefix works.
+ *
+ *   2. Groovy interpolation — `implementation "com.alibaba:fastjson:${fastjsonVersion}"`
+ *      with the property defined via `ext { fastjsonVersion = '1.2.83_noneautotype' }`,
+ *      `def fastjsonVersion = '1.2.83_noneautotype'`, or top-level `fastjsonVersion = '…'`.
+ *
+ *   3. Kotlin interpolation — `implementation("com.alibaba:fastjson:$fastjsonVersion")`
+ *      with the property defined via `val fastjsonVersion = "1.2.83_noneautotype"`
+ *      or `const val fastjsonVersion = "…"`.
+ *
+ * Returns `null` on miss (no direct declaration AND no resolvable
+ * property reference). The `DeserializationSafetyGatePass` then falls
+ * through to its default "do not drop" behaviour on the sink.
+ *
+ * NOT recognised in this MVP (deferred, follow-ups on #261):
+ *   - `platform(...)` / `enforcedPlatform(...)` BOM version imports
+ *   - Version-catalog `libs.versions.toml` references (`libs.fastjson`)
+ *   - `constraints { }` block versions
+ *   - `subprojects { }` / `allprojects { }` conditional declarations
+ */
+export declare function resolveFastjsonFromGradle(buildGradle: string): FastjsonPomResolution | null;
+/**
+ * Result of extracting the effective PyYAML version. `safeByDefault` is
+ * true when the parsed version is ≥ 6.0; at that point pyyaml.load()
+ * without an explicit `Loader=` keyword argument raises TypeError
+ * instead of silently invoking the unsafe default Loader.
+ *
+ * See https://github.com/yaml/pyyaml/blob/master/CHANGES for the full
+ * 6.0 breakage story. The gate consumer must ALSO check the call site
+ * for an explicit `Loader=` keyword (fileHasUnsafePyYamlLoader below)
+ * — a caller under pyyaml ≥ 6.0 that explicitly passes
+ * `Loader=yaml.Loader` or `Loader=yaml.UnsafeLoader` is still
+ * dangerous regardless of the version pin.
+ */
+export interface PyYamlResolution {
+    version: string;
+    safeByDefault: boolean;
+}
+/**
+ * Extract the effective PyYAML version from a `requirements.txt` file.
+ * Recognises the standard PEP 508 shapes (`==`, `>=`, `~=`, `>`,
+ * exact pins with trailing modifiers). Package name matched
+ * case-insensitively (both `PyYAML` and `pyyaml` are common in the
+ * wild).
+ *
+ * Returns null when no pyyaml line is found or the version string
+ * cannot be parsed as `M.m[.p]`. Non-strict on trailing environment
+ * markers (` ; python_version >= '3.6'`), which are common on
+ * requirements.txt lines.
+ */
+export declare function resolvePyYamlFromRequirements(requirementsTxt: string): PyYamlResolution | null;
+/**
+ * Extract the effective PyYAML version from a `pyproject.toml`.
+ * Recognises the common Poetry and PEP 621 shapes:
+ *
+ *   Poetry — under `[tool.poetry.dependencies]`:
+ *     PyYAML = "6.0"
+ *     pyyaml = "^6.0.1"
+ *     pyyaml = { version = "6.0", extras = ["..."] }
+ *
+ *   PEP 621 — under `[project]` `dependencies` array:
+ *     dependencies = [ "PyYAML>=6.0", ... ]
+ *
+ * As with the requirements.txt resolver, non-strict on markers /
+ * modifiers; regex-based rather than a full TOML parser to keep the
+ * runtime-dep list minimal (Pillar I minimal-dependencies principle).
+ */
+export declare function resolvePyYamlFromPyproject(pyprojectToml: string): PyYamlResolution | null;
+/**
+ * True when `version` (as `M.m[.p]`) is ≥ 6.0. Handles bare `6`,
+ * `6.0`, `6.0.1`, `7`, `10.0`, etc. Returns false on malformed input
+ * (defensive — the gate defaults to *do not drop* on missing signal).
+ */
+export declare function isPyYamlVersionSafeByDefault(version: string): boolean;
+/**
+ * Return true when the file contains an explicit unsafe `Loader=`
+ * keyword argument on a `yaml.load(...)` call at or shortly after
+ * `sinkLine`. Recognises the well-known unsafe loaders and their
+ * qualified forms:
+ *
+ *   Loader=Loader         Loader=yaml.Loader
+ *   Loader=UnsafeLoader   Loader=yaml.UnsafeLoader
+ *   Loader=FullLoader     Loader=yaml.FullLoader   (technically safer
+ *                                                   than Loader; still
+ *                                                   permits arbitrary
+ *                                                   Python object types)
+ *
+ * SafeLoader / CSafeLoader / BaseLoader / CBaseLoader are all safe and
+ * are NOT matched here.
+ *
+ * Scans `sinkLine` through the next 9 lines to catch multi-line call
+ * shapes; if the closing `)` appears before the window ends the scan
+ * stops there. Regex-based (no AST inspection) to stay consistent with
+ * the sink-filter-pass conventions and avoid pulling parse state into
+ * the gate.
+ */
+export declare function fileHasUnsafePyYamlLoader(sourceLines: string[], sinkLine: number): boolean;
 /**
  * Return true when the given source text contains an in-file call that
  * re-enables Fastjson autotype. Even a `_noneautotype` build does not

package/dist/analysis/dependency-versions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependency-versions.d.ts","sourceRoot":"","sources":["../../src/analysis/dependency-versions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI,CA8BnF;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAKrE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAUtE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAOrE"}
+{"version":3,"file":"dependency-versions.d.ts","sourceRoot":"","sources":["../../src/analysis/dependency-versions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI,CA8BnF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI,CAsC3F;AAMD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAC3C,eAAe,EAAE,MAAM,GACtB,gBAAgB,GAAG,IAAI,CAuBzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,0BAA0B,CACxC,aAAa,EAAE,MAAM,GACpB,gBAAgB,GAAG,IAAI,CAiCzB;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAIrE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,EAAE,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAkBT;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAKrE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAUtE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAOrE"}

package/dist/analysis/dependency-versions.js

@@ -65,6 +65,205 @@ export function resolveFastjsonFromPom(pomXml) {
     }
     return null;
 }
+/**
+ * Extract the effective Fastjson version from a Gradle build script
+ * (`build.gradle` Groovy DSL or `build.gradle.kts` Kotlin DSL).
+ *
+ * cognium-dev #261 (Gradle-first slice extending #258's pom.xml gate).
+ *
+ * Recognises three declaration shapes:
+ *
+ *   1. Direct literal — the classic Groovy / Kotlin single-string form:
+ *        implementation 'com.alibaba:fastjson:1.2.83_noneautotype'
+ *        implementation "com.alibaba:fastjson:1.2.83_noneautotype"
+ *        implementation("com.alibaba:fastjson:1.2.83_noneautotype")
+ *      Also `api`, `compile`, `runtimeOnly`, `testImplementation`, … — the
+ *      configuration keyword is not part of the regex; only the
+ *      `group:artifact:version` triple is matched, so any dependency-
+ *      configuration prefix works.
+ *
+ *   2. Groovy interpolation — `implementation "com.alibaba:fastjson:${fastjsonVersion}"`
+ *      with the property defined via `ext { fastjsonVersion = '1.2.83_noneautotype' }`,
+ *      `def fastjsonVersion = '1.2.83_noneautotype'`, or top-level `fastjsonVersion = '…'`.
+ *
+ *   3. Kotlin interpolation — `implementation("com.alibaba:fastjson:$fastjsonVersion")`
+ *      with the property defined via `val fastjsonVersion = "1.2.83_noneautotype"`
+ *      or `const val fastjsonVersion = "…"`.
+ *
+ * Returns `null` on miss (no direct declaration AND no resolvable
+ * property reference). The `DeserializationSafetyGatePass` then falls
+ * through to its default "do not drop" behaviour on the sink.
+ *
+ * NOT recognised in this MVP (deferred, follow-ups on #261):
+ *   - `platform(...)` / `enforcedPlatform(...)` BOM version imports
+ *   - Version-catalog `libs.versions.toml` references (`libs.fastjson`)
+ *   - `constraints { }` block versions
+ *   - `subprojects { }` / `allprojects { }` conditional declarations
+ */
+export function resolveFastjsonFromGradle(buildGradle) {
+    if (!buildGradle)
+        return null;
+    // Shape 1 — direct literal declaration. Accepts single-quoted,
+    // double-quoted, or paren-wrapped ("Kotlin") forms. The version is
+    // any non-quote / non-`$` / non-`)` / non-whitespace run.
+    const directRe = /['"(]\s*com\.alibaba:fastjson:([^'"$\s)]+)\s*['")]/;
+    const direct = buildGradle.match(directRe);
+    if (direct) {
+        const version = direct[1];
+        return { version, noneAutotype: /_noneautotype/i.test(version) };
+    }
+    // Shapes 2 + 3 — property reference. Capture the property name (either
+    // `${name}` Groovy form or `$name` bare form; Kotlin uses the same
+    // string-template syntax as Groovy for this case).
+    const propRefRe = /['"(]\s*com\.alibaba:fastjson:\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?\s*['")]/;
+    const propRef = buildGradle.match(propRefRe);
+    if (!propRef)
+        return null;
+    const propName = propRef[1];
+    // Property definition — accept:
+    //   `fastjsonVersion = 'X'`                (Groovy top-level or ext)
+    //   `fastjsonVersion = "X"`                (Groovy interpolated)
+    //   `def fastjsonVersion = 'X'`            (Groovy local)
+    //   `val fastjsonVersion = "X"`            (Kotlin)
+    //   `const val fastjsonVersion = "X"`      (Kotlin)
+    //   `fastjsonVersion: 'X'`                 (Groovy map-syntax, rare)
+    // Any leading whitespace / newlines / `=` / `:` before the quote.
+    const defRe = new RegExp(`\\b${propName}\\s*[=:]\\s*['"]([^'"\\s]+)['"]`);
+    const def = buildGradle.match(defRe);
+    if (!def)
+        return null;
+    const version = def[1];
+    return { version, noneAutotype: /_noneautotype/i.test(version) };
+}
+/**
+ * Extract the effective PyYAML version from a `requirements.txt` file.
+ * Recognises the standard PEP 508 shapes (`==`, `>=`, `~=`, `>`,
+ * exact pins with trailing modifiers). Package name matched
+ * case-insensitively (both `PyYAML` and `pyyaml` are common in the
+ * wild).
+ *
+ * Returns null when no pyyaml line is found or the version string
+ * cannot be parsed as `M.m[.p]`. Non-strict on trailing environment
+ * markers (` ; python_version >= '3.6'`), which are common on
+ * requirements.txt lines.
+ */
+export function resolvePyYamlFromRequirements(requirementsTxt) {
+    if (!requirementsTxt)
+        return null;
+    // Iterate line-by-line so a fatal parse error on one line doesn't
+    // sink the whole file. Comment lines and `-r other.txt` includes are
+    // ignored (we don't recurse into included files here — the caller
+    // controls what manifest string is passed).
+    for (const rawLine of requirementsTxt.split(/\r?\n/)) {
+        const line = rawLine.replace(/#.*$/, '').trim();
+        if (!line)
+            continue;
+        if (line.startsWith('-'))
+            continue;
+        // Match: `PyYAML==6.0`, `pyyaml>=6.0.1`, `PyYAML ~= 6.0`,
+        // `pyyaml>6`, `PyYAML==6.0 ; python_version>='3.6'`
+        const m = line.match(/^(pyyaml)\s*(==|>=|~=|>|===)\s*(\d+(?:\.\d+)*)/i);
+        if (!m)
+            continue;
+        const version = m[3];
+        return { version, safeByDefault: isPyYamlVersionSafeByDefault(version) };
+    }
+    return null;
+}
+/**
+ * Extract the effective PyYAML version from a `pyproject.toml`.
+ * Recognises the common Poetry and PEP 621 shapes:
+ *
+ *   Poetry — under `[tool.poetry.dependencies]`:
+ *     PyYAML = "6.0"
+ *     pyyaml = "^6.0.1"
+ *     pyyaml = { version = "6.0", extras = ["..."] }
+ *
+ *   PEP 621 — under `[project]` `dependencies` array:
+ *     dependencies = [ "PyYAML>=6.0", ... ]
+ *
+ * As with the requirements.txt resolver, non-strict on markers /
+ * modifiers; regex-based rather than a full TOML parser to keep the
+ * runtime-dep list minimal (Pillar I minimal-dependencies principle).
+ */
+export function resolvePyYamlFromPyproject(pyprojectToml) {
+    if (!pyprojectToml)
+        return null;
+    // Poetry key = string form.
+    //   PyYAML = "6.0"     PyYAML = "^6.0"     pyyaml = "~=6.0"
+    const poetryLine = pyprojectToml.match(/^\s*(pyyaml)\s*=\s*"([\^~=<>]*)(\d+(?:\.\d+)*)"/im);
+    if (poetryLine) {
+        const version = poetryLine[3];
+        return { version, safeByDefault: isPyYamlVersionSafeByDefault(version) };
+    }
+    // Poetry table form: `pyyaml = { version = "6.0", … }`
+    const poetryTable = pyprojectToml.match(/^\s*(pyyaml)\s*=\s*\{[^}]*\bversion\s*=\s*"([\^~=<>]*)(\d+(?:\.\d+)*)"/im);
+    if (poetryTable) {
+        const version = poetryTable[3];
+        return { version, safeByDefault: isPyYamlVersionSafeByDefault(version) };
+    }
+    // PEP 621 array element: within a `dependencies = [ ... ]` block, a
+    // string literal like `"PyYAML>=6.0"` or `"pyyaml==6.0.1"`.
+    const pep621 = pyprojectToml.match(/"(pyyaml)\s*(==|>=|~=|>|===)\s*(\d+(?:\.\d+)*)/i);
+    if (pep621) {
+        const version = pep621[3];
+        return { version, safeByDefault: isPyYamlVersionSafeByDefault(version) };
+    }
+    return null;
+}
+/**
+ * True when `version` (as `M.m[.p]`) is ≥ 6.0. Handles bare `6`,
+ * `6.0`, `6.0.1`, `7`, `10.0`, etc. Returns false on malformed input
+ * (defensive — the gate defaults to *do not drop* on missing signal).
+ */
+export function isPyYamlVersionSafeByDefault(version) {
+    const parts = version.split('.').map((s) => Number.parseInt(s, 10));
+    if (parts.length === 0 || !Number.isFinite(parts[0]))
+        return false;
+    return parts[0] >= 6;
+}
+/**
+ * Return true when the file contains an explicit unsafe `Loader=`
+ * keyword argument on a `yaml.load(...)` call at or shortly after
+ * `sinkLine`. Recognises the well-known unsafe loaders and their
+ * qualified forms:
+ *
+ *   Loader=Loader         Loader=yaml.Loader
+ *   Loader=UnsafeLoader   Loader=yaml.UnsafeLoader
+ *   Loader=FullLoader     Loader=yaml.FullLoader   (technically safer
+ *                                                   than Loader; still
+ *                                                   permits arbitrary
+ *                                                   Python object types)
+ *
+ * SafeLoader / CSafeLoader / BaseLoader / CBaseLoader are all safe and
+ * are NOT matched here.
+ *
+ * Scans `sinkLine` through the next 9 lines to catch multi-line call
+ * shapes; if the closing `)` appears before the window ends the scan
+ * stops there. Regex-based (no AST inspection) to stay consistent with
+ * the sink-filter-pass conventions and avoid pulling parse state into
+ * the gate.
+ */
+export function fileHasUnsafePyYamlLoader(sourceLines, sinkLine) {
+    const start = Math.max(0, sinkLine - 1);
+    const end = Math.min(sourceLines.length, start + 10);
+    const unsafeRe = /\bLoader\s*=\s*(?:yaml\s*\.\s*)?(?:Loader|UnsafeLoader|FullLoader)\b/;
+    for (let i = start; i < end; i++) {
+        const ln = sourceLines[i] ?? '';
+        if (unsafeRe.test(ln))
+            return true;
+        // Stop once the call closes — the `)` at the top-level. Fine
+        // approximation: any bare `)` at the START of a stripped line, or
+        // trailing `)` at end of a stripped line, signals close.
+        const stripped = ln.trim();
+        if (i > start && (stripped === ')' || stripped.endsWith(')'))) {
+            // Also test the current line before we stop, in case Loader= is
+            // on the same line as the closing paren.
+            return false;
+        }
+    }
+    return false;
+}
 /**
  * Return true when the given source text contains an in-file call that
  * re-enables Fastjson autotype. Even a `_noneautotype` build does not

package/dist/analysis/dependency-versions.js.map

@@ -1 +1 @@
-{"version":3,"file":"dependency-versions.js","sourceRoot":"","sources":["../../src/analysis/dependency-versions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAcH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC1F,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IACnE,CAAC;IAED,8DAA8D;IAC9D,mEAAmE;IACnE,kEAAkE;IAClE,oCAAoC;IACpC,MAAM,KAAK,GAAG,qCAAqC,CAAC;IACpD,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,2CAA2C,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAI,GAAG,KAAK,aAAa;YAAE,SAAS;QACpC,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,WAAW;YAAE,SAAS;QACxD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,+DAA+D;QAC/D,2DAA2D;QAC3D,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,4DAA4D;IAC5D,+DAA+D;IAC/D,OAAO,oCAAoC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAc;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,6EAA6E;IAC7E,oEAAoE;IACpE,6DAA6D;IAC7D,2DAA2D;IAC3D,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,gFAAgF;IAChF,4DAA4D;IAC5D,IAAI,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"dependency-versions.js","sourceRoot":"","sources":["../../src/analysis/dependency-versions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAcH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC1F,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IACnE,CAAC;IAED,8DAA8D;IAC9D,mEAAmE;IACnE,kEAAkE;IAClE,oCAAoC;IACpC,MAAM,KAAK,GAAG,qCAAqC,CAAC;IACpD,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,2CAA2C,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAI,GAAG,KAAK,aAAa;YAAE,SAAS;QACpC,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,WAAW;YAAE,SAAS;QACxD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,+DAA+D;QAC/D,2DAA2D;QAC3D,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,yBAAyB,CAAC,WAAmB;IAC3D,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAE9B,+DAA+D;IAC/D,mEAAmE;IACnE,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,oDAAoD,CAAC;IACtE,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IACnE,CAAC;IAED,uEAAuE;IACvE,mEAAmE;IACnE,mDAAmD;IACnD,MAAM,SAAS,GACb,wEAAwE,CAAC;IAC3E,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5B,gCAAgC;IAChC,qEAAqE;IACrE,iEAAiE;IACjE,0DAA0D;IAC1D,oDAAoD;IACpD,oDAAoD;IACpD,qEAAqE;IACrE,kEAAkE;IAClE,MAAM,KAAK,GAAG,IAAI,MAAM,CACtB,MAAM,QAAQ,iCAAiC,CAChD,CAAC;IACF,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;AACnE,CAAC;AAwBD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,6BAA6B,CAC3C,eAAuB;IAEvB,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IAElC,kEAAkE;IAClE,qEAAqE;IACrE,kEAAkE;IAClE,4CAA4C;IAC5C,KAAK,MAAM,OAAO,IAAI,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAEnC,0DAA0D;QAC1D,oDAAoD;QACpD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAClB,iDAAiD,CAClD,CAAC;QACF,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,4BAA4B,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,0BAA0B,CACxC,aAAqB;IAErB,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEhC,4BAA4B;IAC5B,4DAA4D;IAC5D,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CACpC,mDAAmD,CACpD,CAAC;IACF,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9B,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,4BAA4B,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,uDAAuD;IACvD,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CACrC,0EAA0E,CAC3E,CAAC;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,4BAA4B,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,oEAAoE;IACpE,4DAA4D;IAC5D,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAChC,iDAAiD,CAClD,CAAC;IACF,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,4BAA4B,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAAe;IAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACnE,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,yBAAyB,CACvC,WAAqB,EACrB,QAAgB;IAEhB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,sEAAsE,CAAC;IACxF,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACjC,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,6DAA6D;QAC7D,kEAAkE;QAClE,yDAAyD;QACzD,MAAM,QAAQ,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,KAAK,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC9D,gEAAgE;YAChE,yCAAyC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,4DAA4D;IAC5D,+DAA+D;IAC/D,OAAO,oCAAoC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAc;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,6EAA6E;IAC7E,oEAAoE;IACpE,6DAA6D;IAC7D,2DAA2D;IAC3D,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,gFAAgF;IAChF,4DAA4D;IAC5D,IAAI,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/analysis/passes/deserialization-safety-gate-pass.d.ts

@@ -47,6 +47,8 @@ export interface DeserializationSafetyGateResult {
     droppedJackson: number;
     /** Sinks dropped by Gate C (SnakeYAML SafeConstructor). */
     droppedSnakeYaml: number;
+    /** Sinks dropped by Gate D (Python PyYAML ≥ 6.0 default-safe). */
+    droppedPyYaml: number;
 }
 export declare class DeserializationSafetyGatePass implements AnalysisPass<DeserializationSafetyGateResult> {
     private readonly dependencyContext?;

package/dist/analysis/passes/deserialization-safety-gate-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deserialization-safety-gate-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/deserialization-safety-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAQ3D,MAAM,WAAW,+BAA+B;IAC9C,uDAAuD;IACvD,eAAe,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,cAAc,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAWD,qBAAa,6BACX,YAAW,YAAY,CAAC,+BAA+B,CAAC;IAK5C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAH/C,QAAQ,CAAC,IAAI,iCAAiC;IAC9C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;gBAEX,iBAAiB,CAAC,EAAE,iBAAiB,YAAA;IAElE,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,+BAA+B;CAoFvD"}
+{"version":3,"file":"deserialization-safety-gate-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/deserialization-safety-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAY3D,MAAM,WAAW,+BAA+B;IAC9C,uDAAuD;IACvD,eAAe,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,cAAc,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,gBAAgB,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,aAAa,EAAE,MAAM,CAAC;CACvB;AAeD,qBAAa,6BACX,YAAW,YAAY,CAAC,+BAA+B,CAAC;IAK5C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAH/C,QAAQ,CAAC,IAAI,iCAAiC;IAC9C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;gBAEX,iBAAiB,CAAC,EAAE,iBAAiB,YAAA;IAElE,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,+BAA+B;CAiIvD"}

package/dist/analysis/passes/deserialization-safety-gate-pass.js

@@ -38,13 +38,16 @@
  *
  * See `docs/PASSES.md` for the canonical pass registry entry.
  */
-import { resolveFastjsonFromPom, fileReenablesFastjsonAutotype, fileEnablesJacksonPolymorphism, fileConfiguresSnakeYamlSafely, } from '../dependency-versions.js';
+import { resolveFastjsonFromPom, resolveFastjsonFromGradle, resolvePyYamlFromRequirements, resolvePyYamlFromPyproject, fileHasUnsafePyYamlLoader, fileReenablesFastjsonAutotype, fileEnablesJacksonPolymorphism, fileConfiguresSnakeYamlSafely, } from '../dependency-versions.js';
 const FASTJSON_METHODS = new Set(['parseObject', 'parse']);
 const FASTJSON_CLASSES = new Set(['JSON', 'JSONObject']);
 const JACKSON_METHODS = new Set(['readValue', 'convertValue', 'treeToValue']);
 const JACKSON_CLASSES = new Set(['ObjectMapper', 'ObjectReader']);
 const SNAKEYAML_METHODS = new Set(['load', 'loadAs', 'loadAll']);
 const SNAKEYAML_CLASSES = new Set(['Yaml']);
+// Python PyYAML gate (Gate D — cognium-dev #261 Python slice).
+const PYYAML_METHODS = new Set(['load']);
+const PYYAML_CLASSES = new Set(['yaml']);
 export class DeserializationSafetyGatePass {
     dependencyContext;
     name = 'deserialization-safety-gate';
@@ -54,11 +57,11 @@ export class DeserializationSafetyGatePass {
     }
     run(ctx) {
         const { graph, language, code } = ctx;
-        // Java-only for the MVP. Other languages (Python pyyaml, JS
-        // Deserialize, Rust bincode) can extend the gate on their own
-        // manifests in follow-up scopes.
-        if (language !== 'java') {
-            return { droppedFastjson: 0, droppedJackson: 0, droppedSnakeYaml: 0 };
+        // Java + Python for the MVP. Other languages (JS Deserialize,
+        // Rust bincode) can extend the gate on their own manifests in
+        // follow-up scopes.
+        if (language !== 'java' && language !== 'python') {
+            return { droppedFastjson: 0, droppedJackson: 0, droppedSnakeYaml: 0, droppedPyYaml: 0 };
         }
         // Same sink-source discovery as SinkSemanticsPass: prefer
         // SinkFilterResult when the real pipeline has run, otherwise fall
@@ -68,17 +71,44 @@ export class DeserializationSafetyGatePass {
             ? ctx.getResult('sink-filter').sinks
             : graph.ir.taint.sinks;
         // --- Gate A: Fastjson _noneautotype ------------------------------------
+        // Consult pom.xml first; fall back to build.gradle when pom does
+        // not resolve. Both manifests may be supplied by a caller that
+        // scans a multi-build project; either one indicating the hardened
+        // classifier is sufficient to drop the sink.
         const pomXml = this.dependencyContext?.java?.pomXml;
-        const fastjson = pomXml ? resolveFastjsonFromPom(pomXml) : null;
+        const buildGradle = this.dependencyContext?.java?.buildGradle;
+        const fastjson = (pomXml ? resolveFastjsonFromPom(pomXml) : null) ??
+            (buildGradle ? resolveFastjsonFromGradle(buildGradle) : null);
         const fastjsonHardened = fastjson?.noneAutotype === true &&
             !fileReenablesFastjsonAutotype(code);
         // --- Gate B: Jackson polymorphism ---------------------------------------
         const jacksonSafe = !fileEnablesJacksonPolymorphism(code);
         // --- Gate C: SnakeYAML SafeConstructor ----------------------------------
         const snakeYamlSafe = fileConfiguresSnakeYamlSafely(code);
+        // --- Gate D: PyYAML ≥ 6.0 (Python) --------------------------------------
+        // Under pyyaml ≥ 6.0, `yaml.load(x)` without an explicit `Loader=`
+        // keyword arg raises TypeError (safe-by-default); callers that pass
+        // `Loader=SafeLoader` are safe; callers that pass an unsafe Loader
+        // (`Loader=Loader` / `UnsafeLoader` / `FullLoader`) are still
+        // dangerous regardless of the version pin — those need per-call
+        // inspection to preserve.
+        const requirementsTxt = this.dependencyContext?.python?.requirementsTxt;
+        const pyprojectToml = this.dependencyContext?.python?.pyprojectToml;
+        const pyYaml = (requirementsTxt ? resolvePyYamlFromRequirements(requirementsTxt) : null) ??
+            (pyprojectToml ? resolvePyYamlFromPyproject(pyprojectToml) : null);
+        const pyYamlSafeByDefault = pyYaml?.safeByDefault === true;
+        // Lazy: only split source lines when we actually need per-call
+        // inspection (i.e. gate D is active and could fire).
+        let sourceLines = null;
+        const getSourceLines = () => {
+            if (sourceLines === null)
+                sourceLines = code.split('\n');
+            return sourceLines;
+        };
         let droppedFastjson = 0;
         let droppedJackson = 0;
         let droppedSnakeYaml = 0;
+        let droppedPyYaml = 0;
         const kept = sinks.filter((sink) => {
             if (sink.type !== 'deserialization')
                 return true;
@@ -107,16 +137,29 @@ export class DeserializationSafetyGatePass {
                 droppedSnakeYaml++;
                 return false;
             }
+            // Gate D — PyYAML (Python). `sink.class` may be `undefined` for
+            // Python: unlike Java, Python calls do not carry receiver-type
+            // resolution into the CallInfo, so the taint-matcher's sinkMap
+            // assigns undefined for the class field. Accept undefined OR
+            // exact-`'yaml'` (mirrors Gate A's Fastjson check).
+            if (language === 'python' &&
+                pyYamlSafeByDefault &&
+                PYYAML_METHODS.has(sink.method) &&
+                (sink.class === undefined || PYYAML_CLASSES.has(sink.class)) &&
+                !fileHasUnsafePyYamlLoader(getSourceLines(), sink.line)) {
+                droppedPyYaml++;
+                return false;
+            }
             return true;
         });
-        const totalDropped = droppedFastjson + droppedJackson + droppedSnakeYaml;
+        const totalDropped = droppedFastjson + droppedJackson + droppedSnakeYaml + droppedPyYaml;
         if (totalDropped > 0) {
             // Mutate in place so downstream passes see the reduced sink set.
             // Matches SinkSemanticsPass's contract.
             sinks.length = 0;
             sinks.push(...kept);
         }
-        return { droppedFastjson, droppedJackson, droppedSnakeYaml };
+        return { droppedFastjson, droppedJackson, droppedSnakeYaml, droppedPyYaml };
     }
 }
 //# sourceMappingURL=deserialization-safety-gate-pass.js.map

package/dist/analysis/passes/deserialization-safety-gate-pass.js.map

@@ -1 +1 @@
-{"version":3,"file":"deserialization-safety-gate-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/deserialization-safety-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAMH,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AAWnC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;AAC3D,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;AAEzD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC;AAC9E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;AAElE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AACjE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE5C,MAAM,OAAO,6BAA6B;IAMX;IAHpB,IAAI,GAAG,6BAA6B,CAAC;IACrC,QAAQ,GAAG,UAAmB,CAAC;IAExC,YAA6B,iBAAqC;QAArC,sBAAiB,GAAjB,iBAAiB,CAAoB;IAAG,CAAC;IAEtE,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;QAEtC,4DAA4D;QAC5D,8DAA8D;QAC9D,iCAAiC;QACjC,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;QACxE,CAAC;QAED,0DAA0D;QAC1D,kEAAkE;QAClE,4DAA4D;QAC5D,+DAA+D;QAC/D,MAAM,KAAK,GAAgB,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC;YACrD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAmB,aAAa,CAAC,CAAC,KAAK;YACtD,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QAEzB,0EAA0E;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,MAAM,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,MAAM,gBAAgB,GACpB,QAAQ,EAAE,YAAY,KAAK,IAAI;YAC/B,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAEvC,2EAA2E;QAC3E,MAAM,WAAW,GAAG,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;QAE1D,2EAA2E;QAC3E,MAAM,aAAa,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAE1D,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,gBAAgB,GAAG,CAAC,CAAC;QAEzB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACjC,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;gBAAE,OAAO,IAAI,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YAE9B,oBAAoB;YACpB,IACE,gBAAgB;gBAChB,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBACjC,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAC9D,CAAC;gBACD,eAAe,EAAE,CAAC;gBAClB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,mBAAmB;YACnB,IACE,WAAW;gBACX,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAChC,IAAI,CAAC,KAAK,KAAK,SAAS;gBACxB,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAC/B,CAAC;gBACD,cAAc,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,qBAAqB;YACrB,IACE,aAAa;gBACb,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAClC,IAAI,CAAC,KAAK,KAAK,SAAS;gBACxB,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EACjC,CAAC;gBACD,gBAAgB,EAAE,CAAC;gBACnB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,eAAe,GAAG,cAAc,GAAG,gBAAgB,CAAC;QACzE,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,iEAAiE;YACjE,wCAAwC;YACxC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACtB,CAAC;QAED,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC;IAC/D,CAAC;CACF"}
+{"version":3,"file":"deserialization-safety-gate-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/deserialization-safety-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAMH,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,EAC7B,0BAA0B,EAC1B,yBAAyB,EACzB,6BAA6B,EAC7B,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AAanC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;AAC3D,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;AAEzD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC;AAC9E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;AAElE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AACjE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE5C,+DAA+D;AAC/D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AACzC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAEzC,MAAM,OAAO,6BAA6B;IAMX;IAHpB,IAAI,GAAG,6BAA6B,CAAC;IACrC,QAAQ,GAAG,UAAmB,CAAC;IAExC,YAA6B,iBAAqC;QAArC,sBAAiB,GAAjB,iBAAiB,CAAoB;IAAG,CAAC;IAEtE,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;QAEtC,8DAA8D;QAC9D,8DAA8D;QAC9D,oBAAoB;QACpB,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjD,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;QAC1F,CAAC;QAED,0DAA0D;QAC1D,kEAAkE;QAClE,4DAA4D;QAC5D,+DAA+D;QAC/D,MAAM,KAAK,GAAgB,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC;YACrD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAmB,aAAa,CAAC,CAAC,KAAK;YACtD,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QAEzB,0EAA0E;QAC1E,iEAAiE;QACjE,+DAA+D;QAC/D,kEAAkE;QAClE,6CAA6C;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,MAAM,CAAC;QACpD,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,WAAW,CAAC;QAC9D,MAAM,QAAQ,GACZ,CAAC,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAChD,CAAC,WAAW,CAAC,CAAC,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChE,MAAM,gBAAgB,GACpB,QAAQ,EAAE,YAAY,KAAK,IAAI;YAC/B,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAEvC,2EAA2E;QAC3E,MAAM,WAAW,GAAG,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;QAE1D,2EAA2E;QAC3E,MAAM,aAAa,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAE1D,2EAA2E;QAC3E,mEAAmE;QACnE,oEAAoE;QACpE,mEAAmE;QACnE,8DAA8D;QAC9D,gEAAgE;QAChE,0BAA0B;QAC1B,MAAM,eAAe,GAAG,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,eAAe,CAAC;QACxE,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,aAAa,CAAC;QACpE,MAAM,MAAM,GACV,CAAC,eAAe,CAAC,CAAC,CAAC,6BAA6B,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACzE,CAAC,aAAa,CAAC,CAAC,CAAC,0BAA0B,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,mBAAmB,GAAG,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;QAC3D,+DAA+D;QAC/D,qDAAqD;QACrD,IAAI,WAAW,GAAoB,IAAI,CAAC;QACxC,MAAM,cAAc,GAAG,GAAa,EAAE;YACpC,IAAI,WAAW,KAAK,IAAI;gBAAE,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzD,OAAO,WAAW,CAAC;QACrB,CAAC,CAAC;QAEF,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,gBAAgB,GAAG,CAAC,CAAC;QACzB,IAAI,aAAa,GAAG,CAAC,CAAC;QAEtB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACjC,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;gBAAE,OAAO,IAAI,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YAE9B,oBAAoB;YACpB,IACE,gBAAgB;gBAChB,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBACjC,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAC9D,CAAC;gBACD,eAAe,EAAE,CAAC;gBAClB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,mBAAmB;YACnB,IACE,WAAW;gBACX,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAChC,IAAI,CAAC,KAAK,KAAK,SAAS;gBACxB,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAC/B,CAAC;gBACD,cAAc,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,qBAAqB;YACrB,IACE,aAAa;gBACb,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAClC,IAAI,CAAC,KAAK,KAAK,SAAS;gBACxB,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EACjC,CAAC;gBACD,gBAAgB,EAAE,CAAC;gBACnB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,gEAAgE;YAChE,+DAA+D;YAC/D,+DAA+D;YAC/D,6DAA6D;YAC7D,oDAAoD;YACpD,IACE,QAAQ,KAAK,QAAQ;gBACrB,mBAAmB;gBACnB,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC/B,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC5D,CAAC,yBAAyB,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EACvD,CAAC;gBACD,aAAa,EAAE,CAAC;gBAChB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,eAAe,GAAG,cAAc,GAAG,gBAAgB,GAAG,aAAa,CAAC;QACzF,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,iEAAiE;YACjE,wCAAwC;YACxC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACtB,CAAC;QAED,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC;IAC9E,CAAC;CACF"}

package/dist/analysis/taint-matcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"taint-matcher.d.ts","sourceRoot":"","sources":["../../src/analysis/taint-matcher.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAgB,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAkB,KAAK,EAAwB,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAClK,OAAO,KAAK,EAAE,WAAW,EAAiB,WAAW,EAAoB,MAAM,oBAAoB,CAAC;AACpG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAgC7E;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,EAAE,EACjB,KAAK,EAAE,QAAQ,EAAE,EACjB,MAAM,GAAE,WAAgC,EACxC,aAAa,CAAC,EAAE,qBAAqB,EACrC,QAAQ,CAAC,EAAE,iBAAiB,EAC5B,IAAI,CAAC,EAAE,MAAM,GACZ,KAAK,CASP;AAqID;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,EAAE,EACtB,KAAK,EAAE,SAAS,EAAE,EAClB,IAAI,EAAE,MAAM,GACX,IAAI,CAYN;AA02ED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,WAAW,GACnB,OAAO,CAET"}
+{"version":3,"file":"taint-matcher.d.ts","sourceRoot":"","sources":["../../src/analysis/taint-matcher.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAgB,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAkB,KAAK,EAAwB,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAClK,OAAO,KAAK,EAAE,WAAW,EAAiB,WAAW,EAAoB,MAAM,oBAAoB,CAAC;AACpG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAgC7E;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,EAAE,EACjB,KAAK,EAAE,QAAQ,EAAE,EACjB,MAAM,GAAE,WAAgC,EACxC,aAAa,CAAC,EAAE,qBAAqB,EACrC,QAAQ,CAAC,EAAE,iBAAiB,EAC5B,IAAI,CAAC,EAAE,MAAM,GACZ,KAAK,CASP;AAqID;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,EAAE,EACtB,KAAK,EAAE,SAAS,EAAE,EAClB,IAAI,EAAE,MAAM,GACX,IAAI,CAYN;AA43ED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,WAAW,GACnB,OAAO,CAET"}

package/dist/analysis/taint-matcher.js

@@ -2407,6 +2407,24 @@ function calculateSinkConfidence(call, pattern) {
     if (pattern.class && call.receiver) {
         if (receiverMightBeClass(call.receiver, pattern.class)) {
             confidence += 0.1;
+            // cognium-dev #260 — EXACT-match tiebreaker. When two patterns
+            // for the same `(method, cwe)` both accept the receiver — one
+            // exactly (e.g. class: 'Ctx' vs receiver 'Ctx') and one via
+            // `receiverMightBeClass` fuzzy heuristics (e.g. class: 'Context'
+            // vs receiver 'Ctx' via the includes/40%-length rule at
+            // taint-matcher.ts:2366) — the fuzzy match used to win the
+            // `sinkMap` dedup slot when it iterated first (both had the same
+            // 0.9 confidence). The extra boost here guarantees the exact-
+            // match pattern's `arg_positions` are the ones emitted on the
+            // final sink. Fixes the fiber `c.Redirect(next)` shape whose
+            // sink was emitted with the gin `class: 'Context'` pattern's
+            // `arg_positions: [1]` instead of fiber `class: 'Ctx'`'s
+            // `arg_positions: [0]`, dropping the taint flow silently.
+            const receiverLc = call.receiver.toLowerCase();
+            const classLc = pattern.class.toLowerCase();
+            if (call.receiver === pattern.class || receiverLc === classLc) {
+                confidence += 0.05;
+            }
         }
     }
     // Higher confidence for critical severity patterns