cognium-dev 3.90.1 → 3.91.0

package/README.md

@@ -213,6 +213,33 @@ Found 2 vulnerability(ies) in 1 file(s)
 
 Use `-v` flag to see all scanned files including clean ones.
 
+### Output streams (stdout vs stderr)
+
+`cognium-dev` follows the standard CLI convention: machine-readable payload on **stdout**, diagnostics on **stderr**.
+
+| Output | Stream | Notes |
+|--------|--------|-------|
+| `--format json` document | **stdout** | Pure JSON starting at character 1. No banner, no preamble. Safe to pipe directly to `jq`, `json_pp`, etc. |
+| `--format sarif` document | **stdout** | Pure SARIF 2.1.0 JSON. Same contract as `--format json`. |
+| `--format text` report | **stdout** | The human-readable report (default). |
+| Status lines (`Loaded config: …`, `Suppressed N finding(s) …`, `Results written to …`) | **stderr** | |
+| Spinner animation and final status (`✔ Scanned N file(s)`) | **stderr** | |
+| Error messages and usage hints | **stderr** | |
+| Library log output (cross-file phase markers, budget warnings, etc.) | **stderr** | Silent by default; enable with `--log-level <level>` or `COGNIUM_LOG_LEVEL`. |
+| Findings instrumentation (`CIRCLE_IR_INSTRUMENT_FINDINGS=1`) | **stderr** | JSONL `[finding] …` / `[findings-summary] …` lines. |
+
+The stdout contract for `--format json` and `--format sarif` is **stable**: pure parseable payload, version included inside the JSON object (not as a stdout preamble). Consumers can safely pipe stdout to a parser without skip-the-first-line idioms.
+
+```bash
+# Safe — stdout is pure JSON
+cognium-dev scan ./src --format json | jq '.summary'
+
+# Status lines and warnings on stderr, JSON on stdout
+cognium-dev scan ./src --format json > results.json 2> scan.log
+```
+
+If you previously relied on a `tail -n +2` or `split("\n",1)[1]` idiom against pre-3.89.2 builds, drop it — there is no longer a stdout banner to skip.
+
 ## Detected Vulnerabilities
 
 | Type | CWE | Severity | Description |

package/dist/cli.js

@@ -25001,6 +25001,9 @@ var TIER_1_METHOD_ANNOTATIONS = new Set([
 var TIER_1_CLASS_ANNOTATIONS = new Set([
   "RestController",
   "Controller",
+  "Service",
+  "Repository",
+  "Component",
   "Path",
   "WebServlet",
   "ServerEndpoint",
@@ -34517,7 +34520,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.90.1";
+var version = "3.91.0";
 
 // src/formatters.ts
 var SINK_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.90.1",
+  "version": "3.91.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.90.1"
+    "circle-ir": "^3.91.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",