circle-ir 3.178.0 → 3.180.0

package/dist/analysis/dependency-versions.d.ts

@@ -44,6 +44,177 @@ export interface FastjsonPomResolution {
  * define).
  */
 export declare function resolveFastjsonFromPom(pomXml: string): FastjsonPomResolution | null;
+/**
+ * Extract the effective Fastjson version from a Gradle build script
+ * (`build.gradle` Groovy DSL or `build.gradle.kts` Kotlin DSL).
+ *
+ * cognium-dev #261 (Gradle-first slice extending #258's pom.xml gate).
+ *
+ * Recognises three declaration shapes:
+ *
+ *   1. Direct literal — the classic Groovy / Kotlin single-string form:
+ *        implementation 'com.alibaba:fastjson:1.2.83_noneautotype'
+ *        implementation "com.alibaba:fastjson:1.2.83_noneautotype"
+ *        implementation("com.alibaba:fastjson:1.2.83_noneautotype")
+ *      Also `api`, `compile`, `runtimeOnly`, `testImplementation`, … — the
+ *      configuration keyword is not part of the regex; only the
+ *      `group:artifact:version` triple is matched, so any dependency-
+ *      configuration prefix works.
+ *
+ *   2. Groovy interpolation — `implementation "com.alibaba:fastjson:${fastjsonVersion}"`
+ *      with the property defined via `ext { fastjsonVersion = '1.2.83_noneautotype' }`,
+ *      `def fastjsonVersion = '1.2.83_noneautotype'`, or top-level `fastjsonVersion = '…'`.
+ *
+ *   3. Kotlin interpolation — `implementation("com.alibaba:fastjson:$fastjsonVersion")`
+ *      with the property defined via `val fastjsonVersion = "1.2.83_noneautotype"`
+ *      or `const val fastjsonVersion = "…"`.
+ *
+ * Returns `null` on miss (no direct declaration AND no resolvable
+ * property reference). The `DeserializationSafetyGatePass` then falls
+ * through to its default "do not drop" behaviour on the sink.
+ *
+ * NOT recognised in this MVP (deferred, follow-ups on #261):
+ *   - `platform(...)` / `enforcedPlatform(...)` BOM version imports
+ *   - Version-catalog `libs.versions.toml` references (`libs.fastjson`)
+ *   - `constraints { }` block versions
+ *   - `subprojects { }` / `allprojects { }` conditional declarations
+ */
+export declare function resolveFastjsonFromGradle(buildGradle: string): FastjsonPomResolution | null;
+/**
+ * Extract the effective Fastjson version from a Gradle version-catalog
+ * (`gradle/libs.versions.toml`) combined with the `build.gradle` script
+ * that references it via a `libs.<alias>` accessor.
+ *
+ * cognium-dev #261 (Gradle catalog slice, extending the direct-Gradle
+ * shape landed in the first Gradle slice).
+ *
+ * Recognises the two common `[libraries]` entry shapes:
+ *
+ *   fastjson = { module = "com.alibaba:fastjson", version.ref = "fastjson" }
+ *   fastjson = { group = "com.alibaba", name = "fastjson", version.ref = "fastjson" }
+ *
+ * The version can be either a `version.ref` pointer into the
+ * `[versions]` section, or an inline `version = "…"` on the library
+ * entry itself. Both forms are handled.
+ *
+ * The build.gradle must reference the resolved alias via a
+ * `libs.<alias>` accessor (or `libs.<dashed>` — Gradle normalises
+ * dashes to dots for accessor names, but at the toml level the key
+ * uses the original form; we match the toml alias here). If the alias
+ * isn't referenced anywhere in the build.gradle, returns null — an
+ * unreferenced catalog entry is not an active dependency.
+ *
+ * Returns null when no fastjson library entry exists, when the version
+ * cannot be resolved, or when the alias is defined but unreferenced.
+ * The `DeserializationSafetyGatePass` then falls through to its
+ * default "do not drop" behaviour.
+ */
+export declare function resolveFastjsonFromGradleCatalog(buildGradle: string, libsVersionsToml: string): FastjsonPomResolution | null;
+/**
+ * Result of extracting the effective PyYAML version. `safeByDefault` is
+ * true when the parsed version is ≥ 6.0; at that point pyyaml.load()
+ * without an explicit `Loader=` keyword argument raises TypeError
+ * instead of silently invoking the unsafe default Loader.
+ *
+ * See https://github.com/yaml/pyyaml/blob/master/CHANGES for the full
+ * 6.0 breakage story. The gate consumer must ALSO check the call site
+ * for an explicit `Loader=` keyword (fileHasUnsafePyYamlLoader below)
+ * — a caller under pyyaml ≥ 6.0 that explicitly passes
+ * `Loader=yaml.Loader` or `Loader=yaml.UnsafeLoader` is still
+ * dangerous regardless of the version pin.
+ */
+export interface PyYamlResolution {
+    version: string;
+    safeByDefault: boolean;
+}
+/**
+ * Extract the effective PyYAML version from a `requirements.txt` file.
+ * Recognises the standard PEP 508 shapes (`==`, `>=`, `~=`, `>`,
+ * exact pins with trailing modifiers). Package name matched
+ * case-insensitively (both `PyYAML` and `pyyaml` are common in the
+ * wild).
+ *
+ * Returns null when no pyyaml line is found or the version string
+ * cannot be parsed as `M.m[.p]`. Non-strict on trailing environment
+ * markers (` ; python_version >= '3.6'`), which are common on
+ * requirements.txt lines.
+ */
+export declare function resolvePyYamlFromRequirements(requirementsTxt: string): PyYamlResolution | null;
+/**
+ * Extract the effective PyYAML version from a `pyproject.toml`.
+ * Recognises the common Poetry and PEP 621 shapes:
+ *
+ *   Poetry — under `[tool.poetry.dependencies]`:
+ *     PyYAML = "6.0"
+ *     pyyaml = "^6.0.1"
+ *     pyyaml = { version = "6.0", extras = ["..."] }
+ *
+ *   PEP 621 — under `[project]` `dependencies` array:
+ *     dependencies = [ "PyYAML>=6.0", ... ]
+ *
+ * As with the requirements.txt resolver, non-strict on markers /
+ * modifiers; regex-based rather than a full TOML parser to keep the
+ * runtime-dep list minimal (Pillar I minimal-dependencies principle).
+ */
+export declare function resolvePyYamlFromPyproject(pyprojectToml: string): PyYamlResolution | null;
+/**
+ * True when `version` (as `M.m[.p]`) is ≥ 6.0. Handles bare `6`,
+ * `6.0`, `6.0.1`, `7`, `10.0`, etc. Returns false on malformed input
+ * (defensive — the gate defaults to *do not drop* on missing signal).
+ */
+export declare function isPyYamlVersionSafeByDefault(version: string): boolean;
+/**
+ * Return true when the file contains an explicit unsafe `Loader=`
+ * keyword argument on a `yaml.load(...)` call at or shortly after
+ * `sinkLine`. Recognises the well-known unsafe loaders and their
+ * qualified forms:
+ *
+ *   Loader=Loader         Loader=yaml.Loader
+ *   Loader=UnsafeLoader   Loader=yaml.UnsafeLoader
+ *   Loader=FullLoader     Loader=yaml.FullLoader   (technically safer
+ *                                                   than Loader; still
+ *                                                   permits arbitrary
+ *                                                   Python object types)
+ *
+ * SafeLoader / CSafeLoader / BaseLoader / CBaseLoader are all safe and
+ * are NOT matched here.
+ *
+ * Scans `sinkLine` through the next 9 lines to catch multi-line call
+ * shapes; if the closing `)` appears before the window ends the scan
+ * stops there. Regex-based (no AST inspection) to stay consistent with
+ * the sink-filter-pass conventions and avoid pulling parse state into
+ * the gate.
+ */
+export declare function fileHasUnsafePyYamlLoader(sourceLines: string[], sinkLine: number): boolean;
+/**
+ * Generic result: the declared version string + the parsed feature list
+ * (for `[dependencies] pkg = { version = "…", features = ["safe"] }`
+ * shapes). Returns null when the dep is absent, or when the version is
+ * a `{ git = "…" }` / `{ path = "…" }` non-registry source (no version
+ * string to compare against). Feature-set matching is left to the
+ * caller; this helper only parses.
+ */
+export interface CargoDepResolution {
+    version: string;
+    features: string[];
+}
+/**
+ * Extract the declared version + feature list for a named crate from a
+ * `Cargo.toml`. Recognises the standard `[dependencies]` (and
+ * `[dev-dependencies]` / `[build-dependencies]`) shapes:
+ *
+ *   pkg = "1.2.3"                              — bare string
+ *   pkg = { version = "1.2.3" }                — table with version
+ *   pkg = { version = "1.2.3", features = ["a", "b"] }
+ *   pkg = { git = "…" }                        — git source (no version)
+ *   pkg = { path = "…" }                       — path source (no version)
+ *
+ * Cross-table dependency declarations (`[dependencies.pkg]`) are not
+ * yet recognised; those are less common and can be added when needed.
+ * Regex-based rather than a full TOML parser to keep the runtime-dep
+ * list minimal (Pillar I).
+ */
+export declare function resolveDepFromCargoToml(cargoToml: string, crateName: string): CargoDepResolution | null;
 /**
  * Return true when the given source text contains an in-file call that
  * re-enables Fastjson autotype. Even a `_noneautotype` build does not

package/dist/analysis/dependency-versions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependency-versions.d.ts","sourceRoot":"","sources":["../../src/analysis/dependency-versions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI,CA8BnF;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAKrE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAUtE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAOrE"}
+{"version":3,"file":"dependency-versions.d.ts","sourceRoot":"","sources":["../../src/analysis/dependency-versions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI,CA8BnF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI,CA4D3F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,gCAAgC,CAC9C,WAAW,EAAE,MAAM,EACnB,gBAAgB,EAAE,MAAM,GACvB,qBAAqB,GAAG,IAAI,CAkE9B;AAMD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAC3C,eAAe,EAAE,MAAM,GACtB,gBAAgB,GAAG,IAAI,CAuBzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,0BAA0B,CACxC,aAAa,EAAE,MAAM,GACpB,gBAAgB,GAAG,IAAI,CAiCzB;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAIrE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,EAAE,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAkBT;AAMD;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,kBAAkB,GAAG,IAAI,CAsC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAKrE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAUtE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAOrE"}

package/dist/analysis/dependency-versions.js

@@ -65,6 +65,354 @@ export function resolveFastjsonFromPom(pomXml) {
     }
     return null;
 }
+/**
+ * Extract the effective Fastjson version from a Gradle build script
+ * (`build.gradle` Groovy DSL or `build.gradle.kts` Kotlin DSL).
+ *
+ * cognium-dev #261 (Gradle-first slice extending #258's pom.xml gate).
+ *
+ * Recognises three declaration shapes:
+ *
+ *   1. Direct literal — the classic Groovy / Kotlin single-string form:
+ *        implementation 'com.alibaba:fastjson:1.2.83_noneautotype'
+ *        implementation "com.alibaba:fastjson:1.2.83_noneautotype"
+ *        implementation("com.alibaba:fastjson:1.2.83_noneautotype")
+ *      Also `api`, `compile`, `runtimeOnly`, `testImplementation`, … — the
+ *      configuration keyword is not part of the regex; only the
+ *      `group:artifact:version` triple is matched, so any dependency-
+ *      configuration prefix works.
+ *
+ *   2. Groovy interpolation — `implementation "com.alibaba:fastjson:${fastjsonVersion}"`
+ *      with the property defined via `ext { fastjsonVersion = '1.2.83_noneautotype' }`,
+ *      `def fastjsonVersion = '1.2.83_noneautotype'`, or top-level `fastjsonVersion = '…'`.
+ *
+ *   3. Kotlin interpolation — `implementation("com.alibaba:fastjson:$fastjsonVersion")`
+ *      with the property defined via `val fastjsonVersion = "1.2.83_noneautotype"`
+ *      or `const val fastjsonVersion = "…"`.
+ *
+ * Returns `null` on miss (no direct declaration AND no resolvable
+ * property reference). The `DeserializationSafetyGatePass` then falls
+ * through to its default "do not drop" behaviour on the sink.
+ *
+ * NOT recognised in this MVP (deferred, follow-ups on #261):
+ *   - `platform(...)` / `enforcedPlatform(...)` BOM version imports
+ *   - Version-catalog `libs.versions.toml` references (`libs.fastjson`)
+ *   - `constraints { }` block versions
+ *   - `subprojects { }` / `allprojects { }` conditional declarations
+ */
+export function resolveFastjsonFromGradle(buildGradle) {
+    if (!buildGradle)
+        return null;
+    // Shape 1 — direct literal declaration. Accepts single-quoted,
+    // double-quoted, or paren-wrapped ("Kotlin") forms. The version is
+    // any non-quote / non-`$` / non-`)` / non-whitespace run.
+    const directRe = /['"(]\s*com\.alibaba:fastjson:([^'"$\s)]+)\s*['")]/;
+    const direct = buildGradle.match(directRe);
+    if (direct) {
+        const version = direct[1];
+        return { version, noneAutotype: /_noneautotype/i.test(version) };
+    }
+    // Shape 4 — `constraints { }` block with a `version { strictly/
+    // require/prefer 'X' }` sub-block. cognium-dev #261 (extended forms).
+    //
+    //   constraints {
+    //     implementation('com.alibaba:fastjson') {
+    //       version {
+    //         strictly '1.2.83_noneautotype'
+    //       }
+    //     }
+    //   }
+    //
+    // Non-greedy `[\s\S]*?` across the outer + inner braces so we don't
+    // fuse sibling constraint entries. Accepts strictly / require /
+    // prefer — all three specify a concrete version.
+    const constraintsBlockRe = /['"(]\s*com\.alibaba:fastjson\s*['")]\s*\)?\s*\{[\s\S]*?\bversion\s*\{[\s\S]*?\b(?:strictly|require|prefer)\s+['"]([^'"\s]+)['"]/;
+    const constraintsBlock = buildGradle.match(constraintsBlockRe);
+    if (constraintsBlock) {
+        const version = constraintsBlock[1];
+        return { version, noneAutotype: /_noneautotype/i.test(version) };
+    }
+    // Shapes 2 + 3 — property reference. Capture the property name (either
+    // `${name}` Groovy form or `$name` bare form; Kotlin uses the same
+    // string-template syntax as Groovy for this case).
+    const propRefRe = /['"(]\s*com\.alibaba:fastjson:\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?\s*['")]/;
+    const propRef = buildGradle.match(propRefRe);
+    if (!propRef)
+        return null;
+    const propName = propRef[1];
+    // Property definition — accept:
+    //   `fastjsonVersion = 'X'`                (Groovy top-level or ext)
+    //   `fastjsonVersion = "X"`                (Groovy interpolated)
+    //   `def fastjsonVersion = 'X'`            (Groovy local)
+    //   `val fastjsonVersion = "X"`            (Kotlin)
+    //   `const val fastjsonVersion = "X"`      (Kotlin)
+    //   `fastjsonVersion: 'X'`                 (Groovy map-syntax, rare)
+    // Any leading whitespace / newlines / `=` / `:` before the quote.
+    const defRe = new RegExp(`\\b${propName}\\s*[=:]\\s*['"]([^'"\\s]+)['"]`);
+    const def = buildGradle.match(defRe);
+    if (!def)
+        return null;
+    const version = def[1];
+    return { version, noneAutotype: /_noneautotype/i.test(version) };
+}
+/**
+ * Extract the effective Fastjson version from a Gradle version-catalog
+ * (`gradle/libs.versions.toml`) combined with the `build.gradle` script
+ * that references it via a `libs.<alias>` accessor.
+ *
+ * cognium-dev #261 (Gradle catalog slice, extending the direct-Gradle
+ * shape landed in the first Gradle slice).
+ *
+ * Recognises the two common `[libraries]` entry shapes:
+ *
+ *   fastjson = { module = "com.alibaba:fastjson", version.ref = "fastjson" }
+ *   fastjson = { group = "com.alibaba", name = "fastjson", version.ref = "fastjson" }
+ *
+ * The version can be either a `version.ref` pointer into the
+ * `[versions]` section, or an inline `version = "…"` on the library
+ * entry itself. Both forms are handled.
+ *
+ * The build.gradle must reference the resolved alias via a
+ * `libs.<alias>` accessor (or `libs.<dashed>` — Gradle normalises
+ * dashes to dots for accessor names, but at the toml level the key
+ * uses the original form; we match the toml alias here). If the alias
+ * isn't referenced anywhere in the build.gradle, returns null — an
+ * unreferenced catalog entry is not an active dependency.
+ *
+ * Returns null when no fastjson library entry exists, when the version
+ * cannot be resolved, or when the alias is defined but unreferenced.
+ * The `DeserializationSafetyGatePass` then falls through to its
+ * default "do not drop" behaviour.
+ */
+export function resolveFastjsonFromGradleCatalog(buildGradle, libsVersionsToml) {
+    if (!buildGradle || !libsVersionsToml)
+        return null;
+    // 1. Locate the [libraries] block. Non-greedy to next `[section]` or EOF.
+    const librariesMatch = libsVersionsToml.match(/\[libraries\]([\s\S]*?)(?=\n\[|$)/);
+    if (!librariesMatch)
+        return null;
+    const librariesBlock = librariesMatch[1];
+    // 2. Find the alias whose entry maps to com.alibaba:fastjson. Try
+    //    both `module = "com.alibaba:fastjson"` and split
+    //    `group = "com.alibaba"` + `name = "fastjson"` forms.
+    const moduleForm = librariesBlock.match(/^\s*([\w.-]+)\s*=\s*\{[^}]*\bmodule\s*=\s*"com\.alibaba:fastjson"[^}]*\}/m);
+    const groupNameForm = librariesBlock.match(/^\s*([\w.-]+)\s*=\s*\{[^}]*\bgroup\s*=\s*"com\.alibaba"[^}]*\bname\s*=\s*"fastjson"[^}]*\}/m);
+    const entry = moduleForm ?? groupNameForm;
+    if (!entry)
+        return null;
+    const alias = entry[1];
+    const entryBody = entry[0];
+    // 3. The build script must actually consume this alias — an unused
+    //    catalog entry is not an active dep. The Gradle accessor form is
+    //    `libs.<alias>` (or `libs.<pathified>` for dot-separated aliases;
+    //    for the MVP we match the alias verbatim).
+    const aliasEsc = alias.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const aliasRefRe = new RegExp(`\\blibs\\s*\\.\\s*${aliasEsc}\\b`);
+    if (!aliasRefRe.test(buildGradle))
+        return null;
+    // 4. Extract version. Inline `version = "..."` on the library entry
+    //    beats `version.ref` if both are present (matches Gradle's own
+    //    resolution).
+    const inlineVersionM = entryBody.match(/\bversion\s*=\s*"([^"$][^"]*)"/);
+    if (inlineVersionM) {
+        const version = inlineVersionM[1];
+        return { version, noneAutotype: /_noneautotype/i.test(version) };
+    }
+    const versionRefM = entryBody.match(/\bversion\.ref\s*=\s*"([^"]+)"/);
+    if (!versionRefM)
+        return null;
+    const versionAlias = versionRefM[1];
+    // 5. Look up the version-alias in the [versions] block.
+    const versionsMatch = libsVersionsToml.match(/\[versions\]([\s\S]*?)(?=\n\[|$)/);
+    if (!versionsMatch)
+        return null;
+    const versionsBlock = versionsMatch[1];
+    const versionAliasEsc = versionAlias.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const versionLineRe = new RegExp(`^\\s*${versionAliasEsc}\\s*=\\s*"([^"]+)"`, 'm');
+    const versionLine = versionsBlock.match(versionLineRe);
+    if (!versionLine)
+        return null;
+    const version = versionLine[1];
+    return { version, noneAutotype: /_noneautotype/i.test(version) };
+}
+/**
+ * Extract the effective PyYAML version from a `requirements.txt` file.
+ * Recognises the standard PEP 508 shapes (`==`, `>=`, `~=`, `>`,
+ * exact pins with trailing modifiers). Package name matched
+ * case-insensitively (both `PyYAML` and `pyyaml` are common in the
+ * wild).
+ *
+ * Returns null when no pyyaml line is found or the version string
+ * cannot be parsed as `M.m[.p]`. Non-strict on trailing environment
+ * markers (` ; python_version >= '3.6'`), which are common on
+ * requirements.txt lines.
+ */
+export function resolvePyYamlFromRequirements(requirementsTxt) {
+    if (!requirementsTxt)
+        return null;
+    // Iterate line-by-line so a fatal parse error on one line doesn't
+    // sink the whole file. Comment lines and `-r other.txt` includes are
+    // ignored (we don't recurse into included files here — the caller
+    // controls what manifest string is passed).
+    for (const rawLine of requirementsTxt.split(/\r?\n/)) {
+        const line = rawLine.replace(/#.*$/, '').trim();
+        if (!line)
+            continue;
+        if (line.startsWith('-'))
+            continue;
+        // Match: `PyYAML==6.0`, `pyyaml>=6.0.1`, `PyYAML ~= 6.0`,
+        // `pyyaml>6`, `PyYAML==6.0 ; python_version>='3.6'`
+        const m = line.match(/^(pyyaml)\s*(==|>=|~=|>|===)\s*(\d+(?:\.\d+)*)/i);
+        if (!m)
+            continue;
+        const version = m[3];
+        return { version, safeByDefault: isPyYamlVersionSafeByDefault(version) };
+    }
+    return null;
+}
+/**
+ * Extract the effective PyYAML version from a `pyproject.toml`.
+ * Recognises the common Poetry and PEP 621 shapes:
+ *
+ *   Poetry — under `[tool.poetry.dependencies]`:
+ *     PyYAML = "6.0"
+ *     pyyaml = "^6.0.1"
+ *     pyyaml = { version = "6.0", extras = ["..."] }
+ *
+ *   PEP 621 — under `[project]` `dependencies` array:
+ *     dependencies = [ "PyYAML>=6.0", ... ]
+ *
+ * As with the requirements.txt resolver, non-strict on markers /
+ * modifiers; regex-based rather than a full TOML parser to keep the
+ * runtime-dep list minimal (Pillar I minimal-dependencies principle).
+ */
+export function resolvePyYamlFromPyproject(pyprojectToml) {
+    if (!pyprojectToml)
+        return null;
+    // Poetry key = string form.
+    //   PyYAML = "6.0"     PyYAML = "^6.0"     pyyaml = "~=6.0"
+    const poetryLine = pyprojectToml.match(/^\s*(pyyaml)\s*=\s*"([\^~=<>]*)(\d+(?:\.\d+)*)"/im);
+    if (poetryLine) {
+        const version = poetryLine[3];
+        return { version, safeByDefault: isPyYamlVersionSafeByDefault(version) };
+    }
+    // Poetry table form: `pyyaml = { version = "6.0", … }`
+    const poetryTable = pyprojectToml.match(/^\s*(pyyaml)\s*=\s*\{[^}]*\bversion\s*=\s*"([\^~=<>]*)(\d+(?:\.\d+)*)"/im);
+    if (poetryTable) {
+        const version = poetryTable[3];
+        return { version, safeByDefault: isPyYamlVersionSafeByDefault(version) };
+    }
+    // PEP 621 array element: within a `dependencies = [ ... ]` block, a
+    // string literal like `"PyYAML>=6.0"` or `"pyyaml==6.0.1"`.
+    const pep621 = pyprojectToml.match(/"(pyyaml)\s*(==|>=|~=|>|===)\s*(\d+(?:\.\d+)*)/i);
+    if (pep621) {
+        const version = pep621[3];
+        return { version, safeByDefault: isPyYamlVersionSafeByDefault(version) };
+    }
+    return null;
+}
+/**
+ * True when `version` (as `M.m[.p]`) is ≥ 6.0. Handles bare `6`,
+ * `6.0`, `6.0.1`, `7`, `10.0`, etc. Returns false on malformed input
+ * (defensive — the gate defaults to *do not drop* on missing signal).
+ */
+export function isPyYamlVersionSafeByDefault(version) {
+    const parts = version.split('.').map((s) => Number.parseInt(s, 10));
+    if (parts.length === 0 || !Number.isFinite(parts[0]))
+        return false;
+    return parts[0] >= 6;
+}
+/**
+ * Return true when the file contains an explicit unsafe `Loader=`
+ * keyword argument on a `yaml.load(...)` call at or shortly after
+ * `sinkLine`. Recognises the well-known unsafe loaders and their
+ * qualified forms:
+ *
+ *   Loader=Loader         Loader=yaml.Loader
+ *   Loader=UnsafeLoader   Loader=yaml.UnsafeLoader
+ *   Loader=FullLoader     Loader=yaml.FullLoader   (technically safer
+ *                                                   than Loader; still
+ *                                                   permits arbitrary
+ *                                                   Python object types)
+ *
+ * SafeLoader / CSafeLoader / BaseLoader / CBaseLoader are all safe and
+ * are NOT matched here.
+ *
+ * Scans `sinkLine` through the next 9 lines to catch multi-line call
+ * shapes; if the closing `)` appears before the window ends the scan
+ * stops there. Regex-based (no AST inspection) to stay consistent with
+ * the sink-filter-pass conventions and avoid pulling parse state into
+ * the gate.
+ */
+export function fileHasUnsafePyYamlLoader(sourceLines, sinkLine) {
+    const start = Math.max(0, sinkLine - 1);
+    const end = Math.min(sourceLines.length, start + 10);
+    const unsafeRe = /\bLoader\s*=\s*(?:yaml\s*\.\s*)?(?:Loader|UnsafeLoader|FullLoader)\b/;
+    for (let i = start; i < end; i++) {
+        const ln = sourceLines[i] ?? '';
+        if (unsafeRe.test(ln))
+            return true;
+        // Stop once the call closes — the `)` at the top-level. Fine
+        // approximation: any bare `)` at the START of a stripped line, or
+        // trailing `)` at end of a stripped line, signals close.
+        const stripped = ln.trim();
+        if (i > start && (stripped === ')' || stripped.endsWith(')'))) {
+            // Also test the current line before we stop, in case Loader= is
+            // on the same line as the closing paren.
+            return false;
+        }
+    }
+    return false;
+}
+/**
+ * Extract the declared version + feature list for a named crate from a
+ * `Cargo.toml`. Recognises the standard `[dependencies]` (and
+ * `[dev-dependencies]` / `[build-dependencies]`) shapes:
+ *
+ *   pkg = "1.2.3"                              — bare string
+ *   pkg = { version = "1.2.3" }                — table with version
+ *   pkg = { version = "1.2.3", features = ["a", "b"] }
+ *   pkg = { git = "…" }                        — git source (no version)
+ *   pkg = { path = "…" }                       — path source (no version)
+ *
+ * Cross-table dependency declarations (`[dependencies.pkg]`) are not
+ * yet recognised; those are less common and can be added when needed.
+ * Regex-based rather than a full TOML parser to keep the runtime-dep
+ * list minimal (Pillar I).
+ */
+export function resolveDepFromCargoToml(cargoToml, crateName) {
+    if (!cargoToml || !crateName)
+        return null;
+    const nameEsc = crateName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    // Shape 1: bare string — `pkg = "1.2.3"`.
+    const bareRe = new RegExp(`^\\s*${nameEsc}\\s*=\\s*"([\\d.]+[^"\\s]*)"`, 'm');
+    const bare = cargoToml.match(bareRe);
+    if (bare) {
+        return { version: bare[1], features: [] };
+    }
+    // Shape 2: inline table — `pkg = { version = "1.2.3", features = [...] }`.
+    // Match the table body then extract version + optional features.
+    const tableRe = new RegExp(`^\\s*${nameEsc}\\s*=\\s*\\{([^}]*)\\}`, 'm');
+    const table = cargoToml.match(tableRe);
+    if (!table)
+        return null;
+    const body = table[1];
+    const versionM = body.match(/\bversion\s*=\s*"([\d.]+[^"\s]*)"/);
+    if (!versionM)
+        return null;
+    const version = versionM[1];
+    const featuresM = body.match(/\bfeatures\s*=\s*\[([^\]]*)\]/);
+    const features = [];
+    if (featuresM) {
+        const featureStr = featuresM[1];
+        const re = /"([^"]+)"/g;
+        let m;
+        while ((m = re.exec(featureStr)) !== null) {
+            features.push(m[1]);
+        }
+    }
+    return { version, features };
+}
 /**
  * Return true when the given source text contains an in-file call that
  * re-enables Fastjson autotype. Even a `_noneautotype` build does not

package/dist/analysis/dependency-versions.js.map

@@ -1 +1 @@
-{"version":3,"file":"dependency-versions.js","sourceRoot":"","sources":["../../src/analysis/dependency-versions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAcH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC1F,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IACnE,CAAC;IAED,8DAA8D;IAC9D,mEAAmE;IACnE,kEAAkE;IAClE,oCAAoC;IACpC,MAAM,KAAK,GAAG,qCAAqC,CAAC;IACpD,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,2CAA2C,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAI,GAAG,KAAK,aAAa;YAAE,SAAS;QACpC,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,WAAW;YAAE,SAAS;QACxD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,+DAA+D;QAC/D,2DAA2D;QAC3D,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,4DAA4D;IAC5D,+DAA+D;IAC/D,OAAO,oCAAoC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAc;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,6EAA6E;IAC7E,oEAAoE;IACpE,6DAA6D;IAC7D,2DAA2D;IAC3D,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,gFAAgF;IAChF,4DAA4D;IAC5D,IAAI,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"dependency-versions.js","sourceRoot":"","sources":["../../src/analysis/dependency-versions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAcH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC1F,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IACnE,CAAC;IAED,8DAA8D;IAC9D,mEAAmE;IACnE,kEAAkE;IAClE,oCAAoC;IACpC,MAAM,KAAK,GAAG,qCAAqC,CAAC;IACpD,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,2CAA2C,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAI,GAAG,KAAK,aAAa;YAAE,SAAS;QACpC,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,WAAW;YAAE,SAAS;QACxD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,+DAA+D;QAC/D,2DAA2D;QAC3D,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,yBAAyB,CAAC,WAAmB;IAC3D,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAE9B,+DAA+D;IAC/D,mEAAmE;IACnE,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,oDAAoD,CAAC;IACtE,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IACnE,CAAC;IAED,gEAAgE;IAChE,sEAAsE;IACtE,EAAE;IACF,kBAAkB;IAClB,+CAA+C;IAC/C,kBAAkB;IAClB,yCAAyC;IACzC,UAAU;IACV,QAAQ;IACR,MAAM;IACN,EAAE;IACF,oEAAoE;IACpE,gEAAgE;IAChE,iDAAiD;IACjD,MAAM,kBAAkB,GACtB,kIAAkI,CAAC;IACrI,MAAM,gBAAgB,GAAG,WAAW,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC/D,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IACnE,CAAC;IAED,uEAAuE;IACvE,mEAAmE;IACnE,mDAAmD;IACnD,MAAM,SAAS,GACb,wEAAwE,CAAC;IAC3E,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5B,gCAAgC;IAChC,qEAAqE;IACrE,iEAAiE;IACjE,0DAA0D;IAC1D,oDAAoD;IACpD,oDAAoD;IACpD,qEAAqE;IACrE,kEAAkE;IAClE,MAAM,KAAK,GAAG,IAAI,MAAM,CACtB,MAAM,QAAQ,iCAAiC,CAChD,CAAC;IACF,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,gCAAgC,CAC9C,WAAmB,EACnB,gBAAwB;IAExB,IAAI,CAAC,WAAW,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAEnD,0EAA0E;IAC1E,MAAM,cAAc,GAAG,gBAAgB,CAAC,KAAK,CAC3C,mCAAmC,CACpC,CAAC;IACF,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,cAAc,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAEzC,kEAAkE;IAClE,sDAAsD;IACtD,0DAA0D;IAC1D,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CACrC,2EAA2E,CAC5E,CAAC;IACF,MAAM,aAAa,GAAG,cAAc,CAAC,KAAK,CACxC,6FAA6F,CAC9F,CAAC;IACF,MAAM,KAAK,GAAG,UAAU,IAAI,aAAa,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAE3B,mEAAmE;IACnE,qEAAqE;IACrE,sEAAsE;IACtE,+CAA+C;IAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,qBAAqB,QAAQ,KAAK,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/C,oEAAoE;IACpE,mEAAmE;IACnE,kBAAkB;IAClB,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,CACpC,gCAAgC,CACjC,CAAC;IACF,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IACnE,CAAC;IAED,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACtE,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,YAAY,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAEpC,wDAAwD;IACxD,MAAM,aAAa,GAAG,gBAAgB,CAAC,KAAK,CAC1C,kCAAkC,CACnC,CAAC;IACF,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,aAAa,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IAEvC,MAAM,eAAe,GAAG,YAAY,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC5E,MAAM,aAAa,GAAG,IAAI,MAAM,CAC9B,QAAQ,eAAe,oBAAoB,EAC3C,GAAG,CACJ,CAAC;IACF,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACvD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC/B,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;AACnE,CAAC;AAwBD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,6BAA6B,CAC3C,eAAuB;IAEvB,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IAElC,kEAAkE;IAClE,qEAAqE;IACrE,kEAAkE;IAClE,4CAA4C;IAC5C,KAAK,MAAM,OAAO,IAAI,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAEnC,0DAA0D;QAC1D,oDAAoD;QACpD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAClB,iDAAiD,CAClD,CAAC;QACF,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,4BAA4B,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,0BAA0B,CACxC,aAAqB;IAErB,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEhC,4BAA4B;IAC5B,4DAA4D;IAC5D,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CACpC,mDAAmD,CACpD,CAAC;IACF,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9B,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,4BAA4B,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,uDAAuD;IACvD,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CACrC,0EAA0E,CAC3E,CAAC;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,4BAA4B,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,oEAAoE;IACpE,4DAA4D;IAC5D,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAChC,iDAAiD,CAClD,CAAC;IACF,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,4BAA4B,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAAe;IAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACnE,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,yBAAyB,CACvC,WAAqB,EACrB,QAAgB;IAEhB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,sEAAsE,CAAC;IACxF,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACjC,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,6DAA6D;QAC7D,kEAAkE;QAClE,yDAAyD;QACzD,MAAM,QAAQ,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,KAAK,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC9D,gEAAgE;YAChE,yCAAyC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAmBD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAAiB,EACjB,SAAiB;IAEjB,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAEjE,0CAA0C;IAC1C,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,QAAQ,OAAO,8BAA8B,EAC7C,GAAG,CACJ,CAAC;IACF,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC5C,CAAC;IAED,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,QAAQ,OAAO,wBAAwB,EAAE,GAAG,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACjE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAE5B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,YAAY,CAAC;QACxB,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,4DAA4D;IAC5D,+DAA+D;IAC/D,OAAO,oCAAoC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAc;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,6EAA6E;IAC7E,oEAAoE;IACpE,6DAA6D;IAC7D,2DAA2D;IAC3D,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,gFAAgF;IAChF,4DAA4D;IAC5D,IAAI,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/analysis/passes/deserialization-safety-gate-pass.d.ts

@@ -47,6 +47,8 @@ export interface DeserializationSafetyGateResult {
     droppedJackson: number;
     /** Sinks dropped by Gate C (SnakeYAML SafeConstructor). */
     droppedSnakeYaml: number;
+    /** Sinks dropped by Gate D (Python PyYAML ≥ 6.0 default-safe). */
+    droppedPyYaml: number;
 }
 export declare class DeserializationSafetyGatePass implements AnalysisPass<DeserializationSafetyGateResult> {
     private readonly dependencyContext?;

package/dist/analysis/passes/deserialization-safety-gate-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deserialization-safety-gate-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/deserialization-safety-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAQ3D,MAAM,WAAW,+BAA+B;IAC9C,uDAAuD;IACvD,eAAe,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,cAAc,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAWD,qBAAa,6BACX,YAAW,YAAY,CAAC,+BAA+B,CAAC;IAK5C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAH/C,QAAQ,CAAC,IAAI,iCAAiC;IAC9C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;gBAEX,iBAAiB,CAAC,EAAE,iBAAiB,YAAA;IAElE,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,+BAA+B;CAoFvD"}
+{"version":3,"file":"deserialization-safety-gate-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/deserialization-safety-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAa3D,MAAM,WAAW,+BAA+B;IAC9C,uDAAuD;IACvD,eAAe,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,cAAc,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,gBAAgB,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,aAAa,EAAE,MAAM,CAAC;CACvB;AAeD,qBAAa,6BACX,YAAW,YAAY,CAAC,+BAA+B,CAAC;IAK5C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAH/C,QAAQ,CAAC,IAAI,iCAAiC;IAC9C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;gBAEX,iBAAiB,CAAC,EAAE,iBAAiB,YAAA;IAElE,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,+BAA+B;CAqIvD"}