circle-ir 3.179.0 → 3.180.0

package/dist/analysis/dependency-versions.d.ts

@@ -80,6 +80,36 @@ export declare function resolveFastjsonFromPom(pomXml: string): FastjsonPomResol
  *   - `subprojects { }` / `allprojects { }` conditional declarations
  */
 export declare function resolveFastjsonFromGradle(buildGradle: string): FastjsonPomResolution | null;
+/**
+ * Extract the effective Fastjson version from a Gradle version-catalog
+ * (`gradle/libs.versions.toml`) combined with the `build.gradle` script
+ * that references it via a `libs.<alias>` accessor.
+ *
+ * cognium-dev #261 (Gradle catalog slice, extending the direct-Gradle
+ * shape landed in the first Gradle slice).
+ *
+ * Recognises the two common `[libraries]` entry shapes:
+ *
+ *   fastjson = { module = "com.alibaba:fastjson", version.ref = "fastjson" }
+ *   fastjson = { group = "com.alibaba", name = "fastjson", version.ref = "fastjson" }
+ *
+ * The version can be either a `version.ref` pointer into the
+ * `[versions]` section, or an inline `version = "…"` on the library
+ * entry itself. Both forms are handled.
+ *
+ * The build.gradle must reference the resolved alias via a
+ * `libs.<alias>` accessor (or `libs.<dashed>` — Gradle normalises
+ * dashes to dots for accessor names, but at the toml level the key
+ * uses the original form; we match the toml alias here). If the alias
+ * isn't referenced anywhere in the build.gradle, returns null — an
+ * unreferenced catalog entry is not an active dependency.
+ *
+ * Returns null when no fastjson library entry exists, when the version
+ * cannot be resolved, or when the alias is defined but unreferenced.
+ * The `DeserializationSafetyGatePass` then falls through to its
+ * default "do not drop" behaviour.
+ */
+export declare function resolveFastjsonFromGradleCatalog(buildGradle: string, libsVersionsToml: string): FastjsonPomResolution | null;
 /**
  * Result of extracting the effective PyYAML version. `safeByDefault` is
  * true when the parsed version is ≥ 6.0; at that point pyyaml.load()
@@ -156,6 +186,35 @@ export declare function isPyYamlVersionSafeByDefault(version: string): boolean;
  * the gate.
  */
 export declare function fileHasUnsafePyYamlLoader(sourceLines: string[], sinkLine: number): boolean;
+/**
+ * Generic result: the declared version string + the parsed feature list
+ * (for `[dependencies] pkg = { version = "…", features = ["safe"] }`
+ * shapes). Returns null when the dep is absent, or when the version is
+ * a `{ git = "…" }` / `{ path = "…" }` non-registry source (no version
+ * string to compare against). Feature-set matching is left to the
+ * caller; this helper only parses.
+ */
+export interface CargoDepResolution {
+    version: string;
+    features: string[];
+}
+/**
+ * Extract the declared version + feature list for a named crate from a
+ * `Cargo.toml`. Recognises the standard `[dependencies]` (and
+ * `[dev-dependencies]` / `[build-dependencies]`) shapes:
+ *
+ *   pkg = "1.2.3"                              — bare string
+ *   pkg = { version = "1.2.3" }                — table with version
+ *   pkg = { version = "1.2.3", features = ["a", "b"] }
+ *   pkg = { git = "…" }                        — git source (no version)
+ *   pkg = { path = "…" }                       — path source (no version)
+ *
+ * Cross-table dependency declarations (`[dependencies.pkg]`) are not
+ * yet recognised; those are less common and can be added when needed.
+ * Regex-based rather than a full TOML parser to keep the runtime-dep
+ * list minimal (Pillar I).
+ */
+export declare function resolveDepFromCargoToml(cargoToml: string, crateName: string): CargoDepResolution | null;
 /**
  * Return true when the given source text contains an in-file call that
  * re-enables Fastjson autotype. Even a `_noneautotype` build does not

package/dist/analysis/dependency-versions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependency-versions.d.ts","sourceRoot":"","sources":["../../src/analysis/dependency-versions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI,CA8BnF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI,CAsC3F;AAMD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAC3C,eAAe,EAAE,MAAM,GACtB,gBAAgB,GAAG,IAAI,CAuBzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,0BAA0B,CACxC,aAAa,EAAE,MAAM,GACpB,gBAAgB,GAAG,IAAI,CAiCzB;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAIrE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,EAAE,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAkBT;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAKrE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAUtE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAOrE"}
+{"version":3,"file":"dependency-versions.d.ts","sourceRoot":"","sources":["../../src/analysis/dependency-versions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI,CA8BnF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI,CA4D3F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,gCAAgC,CAC9C,WAAW,EAAE,MAAM,EACnB,gBAAgB,EAAE,MAAM,GACvB,qBAAqB,GAAG,IAAI,CAkE9B;AAMD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAC3C,eAAe,EAAE,MAAM,GACtB,gBAAgB,GAAG,IAAI,CAuBzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,0BAA0B,CACxC,aAAa,EAAE,MAAM,GACpB,gBAAgB,GAAG,IAAI,CAiCzB;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAIrE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,EAAE,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAkBT;AAMD;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,kBAAkB,GAAG,IAAI,CAsC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAKrE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAUtE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAOrE"}

package/dist/analysis/dependency-versions.js

@@ -112,6 +112,26 @@ export function resolveFastjsonFromGradle(buildGradle) {
         const version = direct[1];
         return { version, noneAutotype: /_noneautotype/i.test(version) };
     }
+    // Shape 4 — `constraints { }` block with a `version { strictly/
+    // require/prefer 'X' }` sub-block. cognium-dev #261 (extended forms).
+    //
+    //   constraints {
+    //     implementation('com.alibaba:fastjson') {
+    //       version {
+    //         strictly '1.2.83_noneautotype'
+    //       }
+    //     }
+    //   }
+    //
+    // Non-greedy `[\s\S]*?` across the outer + inner braces so we don't
+    // fuse sibling constraint entries. Accepts strictly / require /
+    // prefer — all three specify a concrete version.
+    const constraintsBlockRe = /['"(]\s*com\.alibaba:fastjson\s*['")]\s*\)?\s*\{[\s\S]*?\bversion\s*\{[\s\S]*?\b(?:strictly|require|prefer)\s+['"]([^'"\s]+)['"]/;
+    const constraintsBlock = buildGradle.match(constraintsBlockRe);
+    if (constraintsBlock) {
+        const version = constraintsBlock[1];
+        return { version, noneAutotype: /_noneautotype/i.test(version) };
+    }
     // Shapes 2 + 3 — property reference. Capture the property name (either
     // `${name}` Groovy form or `$name` bare form; Kotlin uses the same
     // string-template syntax as Groovy for this case).
@@ -135,6 +155,86 @@ export function resolveFastjsonFromGradle(buildGradle) {
     const version = def[1];
     return { version, noneAutotype: /_noneautotype/i.test(version) };
 }
+/**
+ * Extract the effective Fastjson version from a Gradle version-catalog
+ * (`gradle/libs.versions.toml`) combined with the `build.gradle` script
+ * that references it via a `libs.<alias>` accessor.
+ *
+ * cognium-dev #261 (Gradle catalog slice, extending the direct-Gradle
+ * shape landed in the first Gradle slice).
+ *
+ * Recognises the two common `[libraries]` entry shapes:
+ *
+ *   fastjson = { module = "com.alibaba:fastjson", version.ref = "fastjson" }
+ *   fastjson = { group = "com.alibaba", name = "fastjson", version.ref = "fastjson" }
+ *
+ * The version can be either a `version.ref` pointer into the
+ * `[versions]` section, or an inline `version = "…"` on the library
+ * entry itself. Both forms are handled.
+ *
+ * The build.gradle must reference the resolved alias via a
+ * `libs.<alias>` accessor (or `libs.<dashed>` — Gradle normalises
+ * dashes to dots for accessor names, but at the toml level the key
+ * uses the original form; we match the toml alias here). If the alias
+ * isn't referenced anywhere in the build.gradle, returns null — an
+ * unreferenced catalog entry is not an active dependency.
+ *
+ * Returns null when no fastjson library entry exists, when the version
+ * cannot be resolved, or when the alias is defined but unreferenced.
+ * The `DeserializationSafetyGatePass` then falls through to its
+ * default "do not drop" behaviour.
+ */
+export function resolveFastjsonFromGradleCatalog(buildGradle, libsVersionsToml) {
+    if (!buildGradle || !libsVersionsToml)
+        return null;
+    // 1. Locate the [libraries] block. Non-greedy to next `[section]` or EOF.
+    const librariesMatch = libsVersionsToml.match(/\[libraries\]([\s\S]*?)(?=\n\[|$)/);
+    if (!librariesMatch)
+        return null;
+    const librariesBlock = librariesMatch[1];
+    // 2. Find the alias whose entry maps to com.alibaba:fastjson. Try
+    //    both `module = "com.alibaba:fastjson"` and split
+    //    `group = "com.alibaba"` + `name = "fastjson"` forms.
+    const moduleForm = librariesBlock.match(/^\s*([\w.-]+)\s*=\s*\{[^}]*\bmodule\s*=\s*"com\.alibaba:fastjson"[^}]*\}/m);
+    const groupNameForm = librariesBlock.match(/^\s*([\w.-]+)\s*=\s*\{[^}]*\bgroup\s*=\s*"com\.alibaba"[^}]*\bname\s*=\s*"fastjson"[^}]*\}/m);
+    const entry = moduleForm ?? groupNameForm;
+    if (!entry)
+        return null;
+    const alias = entry[1];
+    const entryBody = entry[0];
+    // 3. The build script must actually consume this alias — an unused
+    //    catalog entry is not an active dep. The Gradle accessor form is
+    //    `libs.<alias>` (or `libs.<pathified>` for dot-separated aliases;
+    //    for the MVP we match the alias verbatim).
+    const aliasEsc = alias.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const aliasRefRe = new RegExp(`\\blibs\\s*\\.\\s*${aliasEsc}\\b`);
+    if (!aliasRefRe.test(buildGradle))
+        return null;
+    // 4. Extract version. Inline `version = "..."` on the library entry
+    //    beats `version.ref` if both are present (matches Gradle's own
+    //    resolution).
+    const inlineVersionM = entryBody.match(/\bversion\s*=\s*"([^"$][^"]*)"/);
+    if (inlineVersionM) {
+        const version = inlineVersionM[1];
+        return { version, noneAutotype: /_noneautotype/i.test(version) };
+    }
+    const versionRefM = entryBody.match(/\bversion\.ref\s*=\s*"([^"]+)"/);
+    if (!versionRefM)
+        return null;
+    const versionAlias = versionRefM[1];
+    // 5. Look up the version-alias in the [versions] block.
+    const versionsMatch = libsVersionsToml.match(/\[versions\]([\s\S]*?)(?=\n\[|$)/);
+    if (!versionsMatch)
+        return null;
+    const versionsBlock = versionsMatch[1];
+    const versionAliasEsc = versionAlias.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const versionLineRe = new RegExp(`^\\s*${versionAliasEsc}\\s*=\\s*"([^"]+)"`, 'm');
+    const versionLine = versionsBlock.match(versionLineRe);
+    if (!versionLine)
+        return null;
+    const version = versionLine[1];
+    return { version, noneAutotype: /_noneautotype/i.test(version) };
+}
 /**
  * Extract the effective PyYAML version from a `requirements.txt` file.
  * Recognises the standard PEP 508 shapes (`==`, `>=`, `~=`, `>`,
@@ -264,6 +364,55 @@ export function fileHasUnsafePyYamlLoader(sourceLines, sinkLine) {
     }
     return false;
 }
+/**
+ * Extract the declared version + feature list for a named crate from a
+ * `Cargo.toml`. Recognises the standard `[dependencies]` (and
+ * `[dev-dependencies]` / `[build-dependencies]`) shapes:
+ *
+ *   pkg = "1.2.3"                              — bare string
+ *   pkg = { version = "1.2.3" }                — table with version
+ *   pkg = { version = "1.2.3", features = ["a", "b"] }
+ *   pkg = { git = "…" }                        — git source (no version)
+ *   pkg = { path = "…" }                       — path source (no version)
+ *
+ * Cross-table dependency declarations (`[dependencies.pkg]`) are not
+ * yet recognised; those are less common and can be added when needed.
+ * Regex-based rather than a full TOML parser to keep the runtime-dep
+ * list minimal (Pillar I).
+ */
+export function resolveDepFromCargoToml(cargoToml, crateName) {
+    if (!cargoToml || !crateName)
+        return null;
+    const nameEsc = crateName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    // Shape 1: bare string — `pkg = "1.2.3"`.
+    const bareRe = new RegExp(`^\\s*${nameEsc}\\s*=\\s*"([\\d.]+[^"\\s]*)"`, 'm');
+    const bare = cargoToml.match(bareRe);
+    if (bare) {
+        return { version: bare[1], features: [] };
+    }
+    // Shape 2: inline table — `pkg = { version = "1.2.3", features = [...] }`.
+    // Match the table body then extract version + optional features.
+    const tableRe = new RegExp(`^\\s*${nameEsc}\\s*=\\s*\\{([^}]*)\\}`, 'm');
+    const table = cargoToml.match(tableRe);
+    if (!table)
+        return null;
+    const body = table[1];
+    const versionM = body.match(/\bversion\s*=\s*"([\d.]+[^"\s]*)"/);
+    if (!versionM)
+        return null;
+    const version = versionM[1];
+    const featuresM = body.match(/\bfeatures\s*=\s*\[([^\]]*)\]/);
+    const features = [];
+    if (featuresM) {
+        const featureStr = featuresM[1];
+        const re = /"([^"]+)"/g;
+        let m;
+        while ((m = re.exec(featureStr)) !== null) {
+            features.push(m[1]);
+        }
+    }
+    return { version, features };
+}
 /**
  * Return true when the given source text contains an in-file call that
  * re-enables Fastjson autotype. Even a `_noneautotype` build does not

package/dist/analysis/dependency-versions.js.map

@@ -1 +1 @@
-{"version":3,"file":"dependency-versions.js","sourceRoot":"","sources":["../../src/analysis/dependency-versions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAcH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC1F,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IACnE,CAAC;IAED,8DAA8D;IAC9D,mEAAmE;IACnE,kEAAkE;IAClE,oCAAoC;IACpC,MAAM,KAAK,GAAG,qCAAqC,CAAC;IACpD,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,2CAA2C,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAI,GAAG,KAAK,aAAa;YAAE,SAAS;QACpC,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,WAAW;YAAE,SAAS;QACxD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,+DAA+D;QAC/D,2DAA2D;QAC3D,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,yBAAyB,CAAC,WAAmB;IAC3D,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAE9B,+DAA+D;IAC/D,mEAAmE;IACnE,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,oDAAoD,CAAC;IACtE,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IACnE,CAAC;IAED,uEAAuE;IACvE,mEAAmE;IACnE,mDAAmD;IACnD,MAAM,SAAS,GACb,wEAAwE,CAAC;IAC3E,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5B,gCAAgC;IAChC,qEAAqE;IACrE,iEAAiE;IACjE,0DAA0D;IAC1D,oDAAoD;IACpD,oDAAoD;IACpD,qEAAqE;IACrE,kEAAkE;IAClE,MAAM,KAAK,GAAG,IAAI,MAAM,CACtB,MAAM,QAAQ,iCAAiC,CAChD,CAAC;IACF,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;AACnE,CAAC;AAwBD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,6BAA6B,CAC3C,eAAuB;IAEvB,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IAElC,kEAAkE;IAClE,qEAAqE;IACrE,kEAAkE;IAClE,4CAA4C;IAC5C,KAAK,MAAM,OAAO,IAAI,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAEnC,0DAA0D;QAC1D,oDAAoD;QACpD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAClB,iDAAiD,CAClD,CAAC;QACF,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,4BAA4B,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,0BAA0B,CACxC,aAAqB;IAErB,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEhC,4BAA4B;IAC5B,4DAA4D;IAC5D,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CACpC,mDAAmD,CACpD,CAAC;IACF,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9B,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,4BAA4B,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,uDAAuD;IACvD,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CACrC,0EAA0E,CAC3E,CAAC;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,4BAA4B,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,oEAAoE;IACpE,4DAA4D;IAC5D,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAChC,iDAAiD,CAClD,CAAC;IACF,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,4BAA4B,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAAe;IAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACnE,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,yBAAyB,CACvC,WAAqB,EACrB,QAAgB;IAEhB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,sEAAsE,CAAC;IACxF,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACjC,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,6DAA6D;QAC7D,kEAAkE;QAClE,yDAAyD;QACzD,MAAM,QAAQ,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,KAAK,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC9D,gEAAgE;YAChE,yCAAyC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,4DAA4D;IAC5D,+DAA+D;IAC/D,OAAO,oCAAoC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAc;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,6EAA6E;IAC7E,oEAAoE;IACpE,6DAA6D;IAC7D,2DAA2D;IAC3D,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,gFAAgF;IAChF,4DAA4D;IAC5D,IAAI,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"dependency-versions.js","sourceRoot":"","sources":["../../src/analysis/dependency-versions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAcH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC1F,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IACnE,CAAC;IAED,8DAA8D;IAC9D,mEAAmE;IACnE,kEAAkE;IAClE,oCAAoC;IACpC,MAAM,KAAK,GAAG,qCAAqC,CAAC;IACpD,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,2CAA2C,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAI,GAAG,KAAK,aAAa;YAAE,SAAS;QACpC,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,WAAW;YAAE,SAAS;QACxD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,+DAA+D;QAC/D,2DAA2D;QAC3D,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,yBAAyB,CAAC,WAAmB;IAC3D,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAE9B,+DAA+D;IAC/D,mEAAmE;IACnE,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,oDAAoD,CAAC;IACtE,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IACnE,CAAC;IAED,gEAAgE;IAChE,sEAAsE;IACtE,EAAE;IACF,kBAAkB;IAClB,+CAA+C;IAC/C,kBAAkB;IAClB,yCAAyC;IACzC,UAAU;IACV,QAAQ;IACR,MAAM;IACN,EAAE;IACF,oEAAoE;IACpE,gEAAgE;IAChE,iDAAiD;IACjD,MAAM,kBAAkB,GACtB,kIAAkI,CAAC;IACrI,MAAM,gBAAgB,GAAG,WAAW,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC/D,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IACnE,CAAC;IAED,uEAAuE;IACvE,mEAAmE;IACnE,mDAAmD;IACnD,MAAM,SAAS,GACb,wEAAwE,CAAC;IAC3E,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5B,gCAAgC;IAChC,qEAAqE;IACrE,iEAAiE;IACjE,0DAA0D;IAC1D,oDAAoD;IACpD,oDAAoD;IACpD,qEAAqE;IACrE,kEAAkE;IAClE,MAAM,KAAK,GAAG,IAAI,MAAM,CACtB,MAAM,QAAQ,iCAAiC,CAChD,CAAC;IACF,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,gCAAgC,CAC9C,WAAmB,EACnB,gBAAwB;IAExB,IAAI,CAAC,WAAW,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAEnD,0EAA0E;IAC1E,MAAM,cAAc,GAAG,gBAAgB,CAAC,KAAK,CAC3C,mCAAmC,CACpC,CAAC;IACF,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,cAAc,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAEzC,kEAAkE;IAClE,sDAAsD;IACtD,0DAA0D;IAC1D,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CACrC,2EAA2E,CAC5E,CAAC;IACF,MAAM,aAAa,GAAG,cAAc,CAAC,KAAK,CACxC,6FAA6F,CAC9F,CAAC;IACF,MAAM,KAAK,GAAG,UAAU,IAAI,aAAa,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAE3B,mEAAmE;IACnE,qEAAqE;IACrE,sEAAsE;IACtE,+CAA+C;IAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,qBAAqB,QAAQ,KAAK,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/C,oEAAoE;IACpE,mEAAmE;IACnE,kBAAkB;IAClB,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,CACpC,gCAAgC,CACjC,CAAC;IACF,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IACnE,CAAC;IAED,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACtE,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,YAAY,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAEpC,wDAAwD;IACxD,MAAM,aAAa,GAAG,gBAAgB,CAAC,KAAK,CAC1C,kCAAkC,CACnC,CAAC;IACF,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,aAAa,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IAEvC,MAAM,eAAe,GAAG,YAAY,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC5E,MAAM,aAAa,GAAG,IAAI,MAAM,CAC9B,QAAQ,eAAe,oBAAoB,EAC3C,GAAG,CACJ,CAAC;IACF,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACvD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC/B,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;AACnE,CAAC;AAwBD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,6BAA6B,CAC3C,eAAuB;IAEvB,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IAElC,kEAAkE;IAClE,qEAAqE;IACrE,kEAAkE;IAClE,4CAA4C;IAC5C,KAAK,MAAM,OAAO,IAAI,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAEnC,0DAA0D;QAC1D,oDAAoD;QACpD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAClB,iDAAiD,CAClD,CAAC;QACF,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,4BAA4B,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,0BAA0B,CACxC,aAAqB;IAErB,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEhC,4BAA4B;IAC5B,4DAA4D;IAC5D,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CACpC,mDAAmD,CACpD,CAAC;IACF,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9B,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,4BAA4B,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,uDAAuD;IACvD,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CACrC,0EAA0E,CAC3E,CAAC;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,4BAA4B,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,oEAAoE;IACpE,4DAA4D;IAC5D,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAChC,iDAAiD,CAClD,CAAC;IACF,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,4BAA4B,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAAe;IAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACnE,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,yBAAyB,CACvC,WAAqB,EACrB,QAAgB;IAEhB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,sEAAsE,CAAC;IACxF,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACjC,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,6DAA6D;QAC7D,kEAAkE;QAClE,yDAAyD;QACzD,MAAM,QAAQ,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,KAAK,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC9D,gEAAgE;YAChE,yCAAyC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAmBD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAAiB,EACjB,SAAiB;IAEjB,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAEjE,0CAA0C;IAC1C,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,QAAQ,OAAO,8BAA8B,EAC7C,GAAG,CACJ,CAAC;IACF,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC5C,CAAC;IAED,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,QAAQ,OAAO,wBAAwB,EAAE,GAAG,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACjE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAE5B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,YAAY,CAAC;QACxB,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,4DAA4D;IAC5D,+DAA+D;IAC/D,OAAO,oCAAoC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAc;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,6EAA6E;IAC7E,oEAAoE;IACpE,6DAA6D;IAC7D,2DAA2D;IAC3D,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,gFAAgF;IAChF,4DAA4D;IAC5D,IAAI,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/analysis/passes/deserialization-safety-gate-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deserialization-safety-gate-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/deserialization-safety-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAY3D,MAAM,WAAW,+BAA+B;IAC9C,uDAAuD;IACvD,eAAe,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,cAAc,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,gBAAgB,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,aAAa,EAAE,MAAM,CAAC;CACvB;AAeD,qBAAa,6BACX,YAAW,YAAY,CAAC,+BAA+B,CAAC;IAK5C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAH/C,QAAQ,CAAC,IAAI,iCAAiC;IAC9C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;gBAEX,iBAAiB,CAAC,EAAE,iBAAiB,YAAA;IAElE,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,+BAA+B;CAiIvD"}
+{"version":3,"file":"deserialization-safety-gate-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/deserialization-safety-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAa3D,MAAM,WAAW,+BAA+B;IAC9C,uDAAuD;IACvD,eAAe,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,cAAc,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,gBAAgB,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,aAAa,EAAE,MAAM,CAAC;CACvB;AAeD,qBAAa,6BACX,YAAW,YAAY,CAAC,+BAA+B,CAAC;IAK5C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAH/C,QAAQ,CAAC,IAAI,iCAAiC;IAC9C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;gBAEX,iBAAiB,CAAC,EAAE,iBAAiB,YAAA;IAElE,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,+BAA+B;CAqIvD"}

package/dist/analysis/passes/deserialization-safety-gate-pass.js

@@ -38,7 +38,7 @@
  *
  * See `docs/PASSES.md` for the canonical pass registry entry.
  */
-import { resolveFastjsonFromPom, resolveFastjsonFromGradle, resolvePyYamlFromRequirements, resolvePyYamlFromPyproject, fileHasUnsafePyYamlLoader, fileReenablesFastjsonAutotype, fileEnablesJacksonPolymorphism, fileConfiguresSnakeYamlSafely, } from '../dependency-versions.js';
+import { resolveFastjsonFromPom, resolveFastjsonFromGradle, resolveFastjsonFromGradleCatalog, resolvePyYamlFromRequirements, resolvePyYamlFromPyproject, fileHasUnsafePyYamlLoader, fileReenablesFastjsonAutotype, fileEnablesJacksonPolymorphism, fileConfiguresSnakeYamlSafely, } from '../dependency-versions.js';
 const FASTJSON_METHODS = new Set(['parseObject', 'parse']);
 const FASTJSON_CLASSES = new Set(['JSON', 'JSONObject']);
 const JACKSON_METHODS = new Set(['readValue', 'convertValue', 'treeToValue']);
@@ -77,8 +77,12 @@ export class DeserializationSafetyGatePass {
         // classifier is sufficient to drop the sink.
         const pomXml = this.dependencyContext?.java?.pomXml;
         const buildGradle = this.dependencyContext?.java?.buildGradle;
+        const libsVersionsToml = this.dependencyContext?.java?.libsVersionsToml;
         const fastjson = (pomXml ? resolveFastjsonFromPom(pomXml) : null) ??
-            (buildGradle ? resolveFastjsonFromGradle(buildGradle) : null);
+            (buildGradle ? resolveFastjsonFromGradle(buildGradle) : null) ??
+            (buildGradle && libsVersionsToml
+                ? resolveFastjsonFromGradleCatalog(buildGradle, libsVersionsToml)
+                : null);
         const fastjsonHardened = fastjson?.noneAutotype === true &&
             !fileReenablesFastjsonAutotype(code);
         // --- Gate B: Jackson polymorphism ---------------------------------------

package/dist/analysis/passes/deserialization-safety-gate-pass.js.map

@@ -1 +1 @@
-{"version":3,"file":"deserialization-safety-gate-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/deserialization-safety-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAMH,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,EAC7B,0BAA0B,EAC1B,yBAAyB,EACzB,6BAA6B,EAC7B,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AAanC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;AAC3D,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;AAEzD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC;AAC9E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;AAElE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AACjE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE5C,+DAA+D;AAC/D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AACzC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAEzC,MAAM,OAAO,6BAA6B;IAMX;IAHpB,IAAI,GAAG,6BAA6B,CAAC;IACrC,QAAQ,GAAG,UAAmB,CAAC;IAExC,YAA6B,iBAAqC;QAArC,sBAAiB,GAAjB,iBAAiB,CAAoB;IAAG,CAAC;IAEtE,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;QAEtC,8DAA8D;QAC9D,8DAA8D;QAC9D,oBAAoB;QACpB,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjD,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;QAC1F,CAAC;QAED,0DAA0D;QAC1D,kEAAkE;QAClE,4DAA4D;QAC5D,+DAA+D;QAC/D,MAAM,KAAK,GAAgB,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC;YACrD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAmB,aAAa,CAAC,CAAC,KAAK;YACtD,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QAEzB,0EAA0E;QAC1E,iEAAiE;QACjE,+DAA+D;QAC/D,kEAAkE;QAClE,6CAA6C;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,MAAM,CAAC;QACpD,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,WAAW,CAAC;QAC9D,MAAM,QAAQ,GACZ,CAAC,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAChD,CAAC,WAAW,CAAC,CAAC,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChE,MAAM,gBAAgB,GACpB,QAAQ,EAAE,YAAY,KAAK,IAAI;YAC/B,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAEvC,2EAA2E;QAC3E,MAAM,WAAW,GAAG,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;QAE1D,2EAA2E;QAC3E,MAAM,aAAa,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAE1D,2EAA2E;QAC3E,mEAAmE;QACnE,oEAAoE;QACpE,mEAAmE;QACnE,8DAA8D;QAC9D,gEAAgE;QAChE,0BAA0B;QAC1B,MAAM,eAAe,GAAG,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,eAAe,CAAC;QACxE,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,aAAa,CAAC;QACpE,MAAM,MAAM,GACV,CAAC,eAAe,CAAC,CAAC,CAAC,6BAA6B,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACzE,CAAC,aAAa,CAAC,CAAC,CAAC,0BAA0B,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,mBAAmB,GAAG,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;QAC3D,+DAA+D;QAC/D,qDAAqD;QACrD,IAAI,WAAW,GAAoB,IAAI,CAAC;QACxC,MAAM,cAAc,GAAG,GAAa,EAAE;YACpC,IAAI,WAAW,KAAK,IAAI;gBAAE,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzD,OAAO,WAAW,CAAC;QACrB,CAAC,CAAC;QAEF,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,gBAAgB,GAAG,CAAC,CAAC;QACzB,IAAI,aAAa,GAAG,CAAC,CAAC;QAEtB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACjC,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;gBAAE,OAAO,IAAI,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YAE9B,oBAAoB;YACpB,IACE,gBAAgB;gBAChB,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBACjC,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAC9D,CAAC;gBACD,eAAe,EAAE,CAAC;gBAClB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,mBAAmB;YACnB,IACE,WAAW;gBACX,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAChC,IAAI,CAAC,KAAK,KAAK,SAAS;gBACxB,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAC/B,CAAC;gBACD,cAAc,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,qBAAqB;YACrB,IACE,aAAa;gBACb,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAClC,IAAI,CAAC,KAAK,KAAK,SAAS;gBACxB,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EACjC,CAAC;gBACD,gBAAgB,EAAE,CAAC;gBACnB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,gEAAgE;YAChE,+DAA+D;YAC/D,+DAA+D;YAC/D,6DAA6D;YAC7D,oDAAoD;YACpD,IACE,QAAQ,KAAK,QAAQ;gBACrB,mBAAmB;gBACnB,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC/B,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC5D,CAAC,yBAAyB,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EACvD,CAAC;gBACD,aAAa,EAAE,CAAC;gBAChB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,eAAe,GAAG,cAAc,GAAG,gBAAgB,GAAG,aAAa,CAAC;QACzF,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,iEAAiE;YACjE,wCAAwC;YACxC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACtB,CAAC;QAED,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC;IAC9E,CAAC;CACF"}
+{"version":3,"file":"deserialization-safety-gate-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/deserialization-safety-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAMH,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,gCAAgC,EAChC,6BAA6B,EAC7B,0BAA0B,EAC1B,yBAAyB,EACzB,6BAA6B,EAC7B,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AAanC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;AAC3D,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;AAEzD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC;AAC9E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;AAElE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AACjE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE5C,+DAA+D;AAC/D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AACzC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAEzC,MAAM,OAAO,6BAA6B;IAMX;IAHpB,IAAI,GAAG,6BAA6B,CAAC;IACrC,QAAQ,GAAG,UAAmB,CAAC;IAExC,YAA6B,iBAAqC;QAArC,sBAAiB,GAAjB,iBAAiB,CAAoB;IAAG,CAAC;IAEtE,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;QAEtC,8DAA8D;QAC9D,8DAA8D;QAC9D,oBAAoB;QACpB,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjD,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;QAC1F,CAAC;QAED,0DAA0D;QAC1D,kEAAkE;QAClE,4DAA4D;QAC5D,+DAA+D;QAC/D,MAAM,KAAK,GAAgB,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC;YACrD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAmB,aAAa,CAAC,CAAC,KAAK;YACtD,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QAEzB,0EAA0E;QAC1E,iEAAiE;QACjE,+DAA+D;QAC/D,kEAAkE;QAClE,6CAA6C;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,MAAM,CAAC;QACpD,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,WAAW,CAAC;QAC9D,MAAM,gBAAgB,GAAG,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,CAAC;QACxE,MAAM,QAAQ,GACZ,CAAC,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAChD,CAAC,WAAW,CAAC,CAAC,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7D,CAAC,WAAW,IAAI,gBAAgB;gBAC9B,CAAC,CAAC,gCAAgC,CAAC,WAAW,EAAE,gBAAgB,CAAC;gBACjE,CAAC,CAAC,IAAI,CAAC,CAAC;QACZ,MAAM,gBAAgB,GACpB,QAAQ,EAAE,YAAY,KAAK,IAAI;YAC/B,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAEvC,2EAA2E;QAC3E,MAAM,WAAW,GAAG,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;QAE1D,2EAA2E;QAC3E,MAAM,aAAa,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAE1D,2EAA2E;QAC3E,mEAAmE;QACnE,oEAAoE;QACpE,mEAAmE;QACnE,8DAA8D;QAC9D,gEAAgE;QAChE,0BAA0B;QAC1B,MAAM,eAAe,GAAG,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,eAAe,CAAC;QACxE,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,aAAa,CAAC;QACpE,MAAM,MAAM,GACV,CAAC,eAAe,CAAC,CAAC,CAAC,6BAA6B,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACzE,CAAC,aAAa,CAAC,CAAC,CAAC,0BAA0B,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,mBAAmB,GAAG,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;QAC3D,+DAA+D;QAC/D,qDAAqD;QACrD,IAAI,WAAW,GAAoB,IAAI,CAAC;QACxC,MAAM,cAAc,GAAG,GAAa,EAAE;YACpC,IAAI,WAAW,KAAK,IAAI;gBAAE,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzD,OAAO,WAAW,CAAC;QACrB,CAAC,CAAC;QAEF,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,gBAAgB,GAAG,CAAC,CAAC;QACzB,IAAI,aAAa,GAAG,CAAC,CAAC;QAEtB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACjC,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;gBAAE,OAAO,IAAI,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YAE9B,oBAAoB;YACpB,IACE,gBAAgB;gBAChB,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBACjC,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAC9D,CAAC;gBACD,eAAe,EAAE,CAAC;gBAClB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,mBAAmB;YACnB,IACE,WAAW;gBACX,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAChC,IAAI,CAAC,KAAK,KAAK,SAAS;gBACxB,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAC/B,CAAC;gBACD,cAAc,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,qBAAqB;YACrB,IACE,aAAa;gBACb,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAClC,IAAI,CAAC,KAAK,KAAK,SAAS;gBACxB,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EACjC,CAAC;gBACD,gBAAgB,EAAE,CAAC;gBACnB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,gEAAgE;YAChE,+DAA+D;YAC/D,+DAA+D;YAC/D,6DAA6D;YAC7D,oDAAoD;YACpD,IACE,QAAQ,KAAK,QAAQ;gBACrB,mBAAmB;gBACnB,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC/B,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC5D,CAAC,yBAAyB,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EACvD,CAAC;gBACD,aAAa,EAAE,CAAC;gBAChB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,eAAe,GAAG,cAAc,GAAG,gBAAgB,GAAG,aAAa,CAAC;QACzF,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,iEAAiE;YACjE,wCAAwC;YACxC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACtB,CAAC;QAED,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC;IAC9E,CAAC;CACF"}

package/dist/analysis/passes/python-receiver-taint-format-pass.d.ts

@@ -0,0 +1,48 @@
+/**
+ * PythonReceiverTaintFormatPass — cognium-dev #264 (Python receiver-taint).
+ *
+ * Emits `format_string` (CWE-134) findings for Python `.format(...)`
+ * calls whose RECEIVER is tainted. The pre-#264-Python-slice sink
+ * patterns key exclusively on `arg_positions`, which cannot represent
+ * a taint that lives on the call's receiver — Python's
+ * `str.format(*args)` shape puts the format template AS the receiver,
+ * not as an argument. Same is true of the `%`-operator shape
+ * (`taintedFmt % args`), which lives entirely in a binary-operator
+ * AST node, not a call.
+ *
+ * This pass takes the receiver-taint half of that gap by scanning
+ * `graph.ir.calls` for `.format(...)` calls whose receiver appears in
+ * the constant-propagation `tainted` set. On a hit, emits a direct
+ * `format_string` finding at the call site (severity `medium`, level
+ * `warning`).
+ *
+ * The `%`-operator half is genuinely bigger — needs a new AST scan
+ * over `binary_operator` nodes with format-shape RHS detection — and
+ * remains deferred on #264.
+ *
+ * Python-only. No-op on other languages.
+ *
+ * Pipeline slot: runs after `ConstantPropagationPass` so the
+ * `tainted` set is populated. Any pass position after
+ * `constant-propagation` is safe; placing near the sink-emission
+ * chain keeps like-with-like grouped.
+ *
+ * Direct-finding emission (via `ctx.addFinding`) rather than
+ * synthetic-sink emission because the format-string vulnerability
+ * here doesn't need a taint-source → sink flow trace: the
+ * `constant-propagation.tainted` set implicitly encodes that the
+ * receiver traces back to a source. Emitting a sink would require
+ * TaintPropagationPass to also understand receiver-taint, which
+ * would be a much broader engine change.
+ */
+import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
+export interface PythonReceiverTaintFormatResult {
+    /** Number of `.format()` calls flagged this run. */
+    findingsEmitted: number;
+}
+export declare class PythonReceiverTaintFormatPass implements AnalysisPass<PythonReceiverTaintFormatResult> {
+    readonly name = "python-receiver-taint-format";
+    readonly category: "security";
+    run(ctx: PassContext): PythonReceiverTaintFormatResult;
+}
+//# sourceMappingURL=python-receiver-taint-format-pass.d.ts.map

package/dist/analysis/passes/python-receiver-taint-format-pass.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"python-receiver-taint-format-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/python-receiver-taint-format-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG9E,MAAM,WAAW,+BAA+B;IAC9C,oDAAoD;IACpD,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,6BACX,YAAW,YAAY,CAAC,+BAA+B,CAAC;IAExD,QAAQ,CAAC,IAAI,kCAAkC;IAC/C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,+BAA+B;CAsDvD"}

package/dist/analysis/passes/python-receiver-taint-format-pass.js

@@ -0,0 +1,91 @@
+/**
+ * PythonReceiverTaintFormatPass — cognium-dev #264 (Python receiver-taint).
+ *
+ * Emits `format_string` (CWE-134) findings for Python `.format(...)`
+ * calls whose RECEIVER is tainted. The pre-#264-Python-slice sink
+ * patterns key exclusively on `arg_positions`, which cannot represent
+ * a taint that lives on the call's receiver — Python's
+ * `str.format(*args)` shape puts the format template AS the receiver,
+ * not as an argument. Same is true of the `%`-operator shape
+ * (`taintedFmt % args`), which lives entirely in a binary-operator
+ * AST node, not a call.
+ *
+ * This pass takes the receiver-taint half of that gap by scanning
+ * `graph.ir.calls` for `.format(...)` calls whose receiver appears in
+ * the constant-propagation `tainted` set. On a hit, emits a direct
+ * `format_string` finding at the call site (severity `medium`, level
+ * `warning`).
+ *
+ * The `%`-operator half is genuinely bigger — needs a new AST scan
+ * over `binary_operator` nodes with format-shape RHS detection — and
+ * remains deferred on #264.
+ *
+ * Python-only. No-op on other languages.
+ *
+ * Pipeline slot: runs after `ConstantPropagationPass` so the
+ * `tainted` set is populated. Any pass position after
+ * `constant-propagation` is safe; placing near the sink-emission
+ * chain keeps like-with-like grouped.
+ *
+ * Direct-finding emission (via `ctx.addFinding`) rather than
+ * synthetic-sink emission because the format-string vulnerability
+ * here doesn't need a taint-source → sink flow trace: the
+ * `constant-propagation.tainted` set implicitly encodes that the
+ * receiver traces back to a source. Emitting a sink would require
+ * TaintPropagationPass to also understand receiver-taint, which
+ * would be a much broader engine change.
+ */
+export class PythonReceiverTaintFormatPass {
+    name = 'python-receiver-taint-format';
+    category = 'security';
+    run(ctx) {
+        if (ctx.language !== 'python') {
+            return { findingsEmitted: 0 };
+        }
+        const { calls, meta } = ctx.graph.ir;
+        const constProp = ctx.getResult('constant-propagation');
+        const tainted = constProp.tainted;
+        let count = 0;
+        for (const call of calls) {
+            if (call.method_name !== 'format')
+                continue;
+            const receiver = call.receiver;
+            if (!receiver)
+                continue;
+            // Only bare-identifier receivers can be looked up in the tainted
+            // set. Skip complex receivers (`obj.attr.format()`, `f(x).format()`)
+            // — those don't correspond to a variable name the taint tracker
+            // would have on file. Recall may improve later with attribute-
+            // chain resolution, but the direct-identifier form is the common
+            // shape for user-controlled templates.
+            if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(receiver))
+                continue;
+            // constant-propagation stores both scoped (`method:var`) and
+            // unscoped forms in the tainted set. Check both.
+            const scopedName = call.in_method
+                ? `${call.in_method}:${receiver}`
+                : receiver;
+            if (!tainted.has(receiver) && !tainted.has(scopedName))
+                continue;
+            ctx.addFinding({
+                id: `format_string-${meta.file}-${call.location.line}-${receiver}`,
+                pass: this.name,
+                category: 'security',
+                rule_id: 'format_string',
+                cwe: 'CWE-134',
+                severity: 'medium',
+                level: 'warning',
+                message: `Format-string vulnerability: the format template \`${receiver}\` ` +
+                    `is tainted (traces back to a taint source). Attacker can leak ` +
+                    `object attributes via \`{obj.__class__.__mro__[…]}\` chains or ` +
+                    `crash the process via unbounded specifiers. Use a literal ` +
+                    `format string and pass user input as an argument instead.`,
+                file: meta.file,
+                line: call.location.line,
+            });
+            count++;
+        }
+        return { findingsEmitted: count };
+    }
+}
+//# sourceMappingURL=python-receiver-taint-format-pass.js.map

package/dist/analysis/passes/python-receiver-taint-format-pass.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"python-receiver-taint-format-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/python-receiver-taint-format-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAUH,MAAM,OAAO,6BAA6B;IAG/B,IAAI,GAAG,8BAA8B,CAAC;IACtC,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;QAChC,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAC7B,sBAAsB,CACvB,CAAC;QACF,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;QAElC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,WAAW,KAAK,QAAQ;gBAAE,SAAS;YAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;YAC/B,IAAI,CAAC,QAAQ;gBAAE,SAAS;YAExB,iEAAiE;YACjE,qEAAqE;YACrE,gEAAgE;YAChE,+DAA+D;YAC/D,iEAAiE;YACjE,uCAAuC;YACvC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAEzD,6DAA6D;YAC7D,iDAAiD;YACjD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS;gBAC/B,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,QAAQ,EAAE;gBACjC,CAAC,CAAC,QAAQ,CAAC;YACb,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;gBAAE,SAAS;YAEjE,GAAG,CAAC,UAAU,CAAC;gBACb,EAAE,EAAE,iBAAiB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,EAAE;gBAClE,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,UAAU;gBACpB,OAAO,EAAE,eAAe;gBACxB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,SAAS;gBAChB,OAAO,EACL,sDAAsD,QAAQ,KAAK;oBACnE,gEAAgE;oBAChE,iEAAiE;oBACjE,4DAA4D;oBAC5D,2DAA2D;gBAC7D,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;aACzB,CAAC,CAAC;YACH,KAAK,EAAE,CAAC;QACV,CAAC;QAED,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IACpC,CAAC;CACF"}

package/dist/analyzer.d.ts

@@ -241,6 +241,15 @@ export interface DependencyContext {
          * dependency. Added by cognium-dev #261 (Gradle-first slice).
          */
         buildGradle?: string;
+        /**
+         * Raw `gradle/libs.versions.toml` content (Gradle version-catalog).
+         * When present alongside `buildGradle`, the gate follows any
+         * `libs.<alias>` reference in the build script through the
+         * `[libraries]` and `[versions]` sections of the catalog to resolve
+         * the effective declared version. Added by cognium-dev #261
+         * (Gradle catalog slice).
+         */
+        libsVersionsToml?: string;
     };
     /**
      * Python project manifests (added cognium-dev #261 Python slice). Both
@@ -256,6 +265,21 @@ export interface DependencyContext {
         /** Raw `pyproject.toml` content (Poetry / PEP 621). */
         pyprojectToml?: string;
     };
+    /**
+     * Rust project manifest (added cognium-dev #261 Rust slice).
+     *
+     * **Plumbing shipped ahead of gate integration.** Currently no gate
+     * consumes `cargoToml`: `serde_yaml` is deprecated (no safe successor
+     * to gate on), `bincode` has no safe-mode feature, and no other Rust
+     * deserialization sink in `DEFAULT_SINKS` has a clean version-safety
+     * story. The field + `resolveDepFromCargoToml` helper are shipped so
+     * future work can attach a gate without another round of API-surface
+     * additions when a real Rust FP-driving case appears.
+     */
+    rust?: {
+        /** Raw `Cargo.toml` content. */
+        cargoToml?: string;
+    };
 }
 /**
  * Per-pass configuration options.

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAA2B,eAAe,EAAe,cAAc,EAAgE,MAAM,kBAAkB,CAAC;AACxM,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAcL,KAAK,iBAAiB,EACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAKL,eAAe,EAChB,MAAM,qBAAqB,CAAC;AAmD7B,OAAO,EAAwB,KAAK,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AAKlH,OAAO,EAA2B,KAAK,0BAA0B,EAAE,MAAM,gDAAgD,CAAC;AAe1H,OAAO,EAAwB,KAAK,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACjH,OAAO,EAAuB,KAAK,sBAAsB,EAA6B,MAAM,4CAA4C,CAAC;AAyCzI,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC;IAEhC;;OAEG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC;IAE3D;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAEzE;;OAEG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAE1B;;OAEG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAE1B;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;;;;;;;;;;;;;;;OAkBG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,CAAC,EAAE,cAAc,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAE9D;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACvC;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,8BAA8B;IAC9B,IAAI,CAAC,EAAE;QACL,mEAAmE;QACnE,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB;;;;;;WAMG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE;QACP,4CAA4C;QAC5C,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,uDAAuD;QACvD,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,8CAA8C;IAC9C,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C,8CAA8C;IAC9C,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C,iDAAiD;IACjD,mBAAmB,CAAC,EAAE,0BAA0B,CAAC;IACjD,6CAA6C;IAC7C,eAAe,CAAC,EAAE,sBAAsB,CAAC;CAC1C;AAID;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAc/E;AA8MD;;GAEG;AACH,wBAAsB,OAAO,CAC3B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,QAAQ,CAAC,CA+XnB;AAwHD;;GAEG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CAwG3B;AAkID;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,IAAI,CAEpC;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,iBAAiB,CAAA;CAAE,CAAC,EAC7E,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,eAAe,CAAC,CAkG1B;AAsBD,OAAO,EAAE,eAAe,EAAE,CAAC"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAA2B,eAAe,EAAe,cAAc,EAAgE,MAAM,kBAAkB,CAAC;AACxM,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAcL,KAAK,iBAAiB,EACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAKL,eAAe,EAChB,MAAM,qBAAqB,CAAC;AAmD7B,OAAO,EAAwB,KAAK,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AAKlH,OAAO,EAA2B,KAAK,0BAA0B,EAAE,MAAM,gDAAgD,CAAC;AAe1H,OAAO,EAAwB,KAAK,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACjH,OAAO,EAAuB,KAAK,sBAAsB,EAA6B,MAAM,4CAA4C,CAAC;AA0CzI,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC;IAEhC;;OAEG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC;IAE3D;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAEzE;;OAEG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAE1B;;OAEG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAE1B;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;;;;;;;;;;;;;;;OAkBG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,CAAC,EAAE,cAAc,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAE9D;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACvC;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,8BAA8B;IAC9B,IAAI,CAAC,EAAE;QACL,mEAAmE;QACnE,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB;;;;;;WAMG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB;;;;;;;WAOG;QACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE;QACP,4CAA4C;QAC5C,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,uDAAuD;QACvD,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF;;;;;;;;;;OAUG;IACH,IAAI,CAAC,EAAE;QACL,gCAAgC;QAChC,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,8CAA8C;IAC9C,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C,8CAA8C;IAC9C,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C,iDAAiD;IACjD,mBAAmB,CAAC,EAAE,0BAA0B,CAAC;IACjD,6CAA6C;IAC7C,eAAe,CAAC,EAAE,sBAAsB,CAAC;CAC1C;AAID;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAc/E;AA8MD;;GAEG;AACH,wBAAsB,OAAO,CAC3B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,QAAQ,CAAC,CAwYnB;AAwHD;;GAEG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CAwG3B;AAkID;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,IAAI,CAEpC;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,iBAAiB,CAAA;CAAE,CAAC,EAC7E,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,eAAe,CAAC,CAkG1B;AAsBD,OAAO,EAAE,eAAe,EAAE,CAAC"}

package/dist/analyzer.js

@@ -122,6 +122,7 @@ import { GodClassPass } from './analysis/passes/god-class-pass.js';
 import { NamingConventionPass } from './analysis/passes/naming-convention-pass.js';
 import { SecurityHeadersPass, checkInheritedCorsHeaders } from './analysis/passes/security-headers-pass.js';
 import { ScanSecretsPass } from './analysis/passes/scan-secrets-pass.js';
+import { PythonReceiverTaintFormatPass } from './analysis/passes/python-receiver-taint-format-pass.js';
 import { Spring4ShellPass } from './analysis/passes/spring4shell-pass.js';
 import { InsecureCookiePass } from './analysis/passes/insecure-cookie-pass.js';
 import { WeakHashPass } from './analysis/passes/weak-hash-pass.js';
@@ -560,6 +561,14 @@ export async function analyze(code, filePath, language, options = {}) {
         // `hardcoded-credential` findings are already in the dedup buffer.
         if (!disabledPasses.has('scan-secrets'))
             pipeline.add(new ScanSecretsPass());
+        // cognium-dev #264 Python receiver-taint: emits format_string
+        // (CWE-134) findings for Python `.format(...)` calls whose
+        // receiver appears in the constant-propagation tainted set.
+        // Direct-finding emission (not sink emission) — no downstream flow
+        // generation needed since the tainted set implicitly encodes the
+        // source-to-receiver trace. Python-only; no-op on other languages.
+        if (!disabledPasses.has('python-receiver-taint-format'))
+            pipeline.add(new PythonReceiverTaintFormatPass());
         // Optional passes — can be disabled via disabledPasses
         if (!disabledPasses.has('dead-code'))
             pipeline.add(new DeadCodePass());