cognium-dev 4.13.2 → 4.14.1

package/README.md

@@ -307,9 +307,9 @@ Filter to security findings only: `cognium-dev scan ./src --category security`
 | Rust | `.rs` | Actix-web, Rocket, Axum |
 | Bash | `.sh`, `.bash` | Shell scripts |
 | HTML | `.html`, `.htm` | Web extraction preprocessor |
-| C#/.NET _(experimental)_ | `.cs` | ASP.NET Core, ADO.NET, EF Core |
+| C#/.NET _(Preview)_ | `.cs` | ASP.NET Core, ADO.NET (EF Core not yet verified) |
 
-> **C#/.NET is experimental / preview** (since 4.0.0). Straight-line taint
+> **C#/.NET is Preview** (since 4.0.0). Straight-line taint
 > analysis across 10 CWE families (SQLi, command injection, path traversal,
 > SSRF, code injection, XSS, deserialization, LDAP, XPath, XXE). Not yet
 > benchmark-verified — expect gaps in branch/alias precision and detector breadth.
@@ -455,15 +455,9 @@ Cognium is built for speed:
 - **Core Engine**: [circle-ir](https://github.com/cogniumhq/cognium-dev/tree/main/packages/circle-ir) - High-performance SAST library
 - **Dependencies**: Only 1 runtime dependency (circle-ir)
 
-## LLM Enhancement (Optional)
+## Data handling
 
-The core static analysis engine runs deterministically without any LLM. Optionally, you can enable LLM-based discovery modes for enhanced detection:
-
-- **Discovery Mode**: LLM reads source code to locate vulnerable methods from scratch
-- **Verification Mode**: Confirms whether static findings are actually exploitable
-- **Semantic Extraction**: Extracts design intent for automated gap analysis
-
-For details on LLM integration and benchmark improvements (42.5% → 78.3% on CWE-Bench with Claude Opus), visit [cognium.net](https://cognium.net).
+cognium-dev is fully deterministic and runs entirely on your machine: source code is not sent to Cognium or any third-party service. Optional AI-assisted analysis is a separate product, [cognium-ai](https://cognium.net), which can send code snippets to a configured model endpoint; use cognium-dev (or cognium-ai with AI-assisted mode off and no remote engine configured) for air-gapped scanning.
 
 ## Benchmark Results
 

package/dist/cli.js

@@ -5515,6 +5515,14 @@ function csharpBareName(node) {
   }
   return getNodeText(node);
 }
+function csharpCreatedSimpleType(creation) {
+  const typeNode = creation.childForFieldName("type");
+  if (!typeNode)
+    return null;
+  const bare = csharpBareName(typeNode).replace(/<[^>]*>/g, "");
+  const simple = bare.split(".").pop()?.trim() ?? "";
+  return simple && simple !== "var" ? simple : null;
+}
 function extractCSharpCalls(tree, cache) {
   const calls = [];
   const typeMap = buildCSharpReceiverTypeMap(tree, cache);
@@ -5523,11 +5531,15 @@ function extractCSharpCalls(tree, cache) {
     const fn = inv.childForFieldName("function");
     let methodName = "unknown";
     let receiver = null;
+    let receiverTypeFromCreation = null;
     if (fn?.type === "member_access_expression") {
       const nameNode = fn.childForFieldName("name");
       const exprNode = fn.childForFieldName("expression");
       methodName = nameNode ? csharpBareName(nameNode) : "unknown";
       receiver = exprNode ? getNodeText(exprNode) : null;
+      if (exprNode?.type === "object_creation_expression") {
+        receiverTypeFromCreation = csharpCreatedSimpleType(exprNode);
+      }
     } else if (fn) {
       methodName = csharpBareName(fn);
     }
@@ -5545,7 +5557,7 @@ function extractCSharpCalls(tree, cache) {
     calls.push({
       method_name: methodName,
       receiver,
-      receiver_type: receiver ? typeMap.get(receiver) ?? null : null,
+      receiver_type: receiverTypeFromCreation ?? (receiver ? typeMap.get(receiver) ?? null : null),
       receiver_type_fqn: null,
       arguments: args2,
       location: { line: inv.startPosition.row + 1, column: inv.startPosition.column },
@@ -9629,6 +9641,38 @@ function extractFieldDefs(body2, startId) {
 function extractJSParameterDefs(params, startId) {
   const defs = [];
   let id = startId;
+  const addPatternDefs = (patternNode, line) => {
+    if (patternNode.type === "identifier" || patternNode.type === "shorthand_property_identifier_pattern") {
+      defs.push({
+        id: id++,
+        variable: getNodeText(patternNode),
+        line,
+        kind: "param"
+      });
+      return;
+    }
+    if (patternNode.type === "rest_pattern" || patternNode.type === "rest_element") {
+      const nameNode = patternNode.namedChildCount > 0 ? patternNode.namedChild(0) : null;
+      if (!nameNode)
+        return;
+      addPatternDefs(nameNode, line);
+      return;
+    }
+    if (patternNode.type === "assignment_pattern") {
+      const leftNode = patternNode.childForFieldName("left");
+      if (leftNode)
+        addPatternDefs(leftNode, line);
+      return;
+    }
+    if (patternNode.type === "object_pattern" || patternNode.type === "array_pattern") {
+      const destructDefs = extractDestructuringDefs(patternNode, id);
+      for (const def of destructDefs) {
+        def.kind = "param";
+        defs.push(def);
+        id++;
+      }
+    }
+  };
   for (let i2 = 0;i2 < params.childCount; i2++) {
     const param = params.child(i2);
     if (!param)
@@ -9678,14 +9722,8 @@ function extractJSParameterDefs(params, startId) {
       }
     } else if (param.type === "required_parameter" || param.type === "optional_parameter") {
       const patternNode = param.childForFieldName("pattern");
-      if (patternNode && patternNode.type === "identifier") {
-        defs.push({
-          id: id++,
-          variable: getNodeText(patternNode),
-          line: param.startPosition.row + 1,
-          kind: "param"
-        });
-      }
+      if (patternNode)
+        addPatternDefs(patternNode, param.startPosition.row + 1);
     }
   }
   return defs;
@@ -11410,6 +11448,7 @@ var DEFAULT_SOURCES = [
   { method: "getFileName", class: "MimeBodyPart", type: "file_input", severity: "high", return_tainted: true },
   { method: "getDisposition", class: "Part", type: "file_input", severity: "medium", return_tainted: true },
   { method: "getName", class: "ZipEntry", type: "file_input", severity: "high", return_tainted: true },
+  { method: "getName", class: "JarEntry", type: "file_input", severity: "high", return_tainted: true },
   { method: "getName", class: "ZipArchiveEntry", type: "file_input", severity: "high", return_tainted: true },
   { method: "getName", class: "TarArchiveEntry", type: "file_input", severity: "high", return_tainted: true },
   { method: "getName", class: "ArchiveEntry", type: "file_input", severity: "high", return_tainted: true },
@@ -11858,7 +11897,7 @@ var DEFAULT_SINKS = [
   { method: "checkout", class: "SCM", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "retrieve", class: "LibraryAdder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "add", class: "LibraryAdder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
-  { method: "CpsFlowExecution", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  { method: "CpsFlowExecution", class: "constructor", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "CpsFlowDefinition", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "FlowExecution", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "processControlCommand", class: "TransportConnection", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
@@ -13795,7 +13834,8 @@ function findSources(calls, types, patterns, sourceLines, language) {
         continue;
       for (const param of method.parameters) {
         const hasCSharpBindingAttr = language === "csharp" && param.annotations.some((a) => CSHARP_BINDING_ATTRS.has(a));
-        const isTaintable = hasCSharpBindingAttr ? true : param.type ? isInterproceduralTaintableType(param.type, language) : true;
+        const isDestructureBinding = param.name.startsWith("{") || param.name.startsWith("[");
+        const isTaintable = hasCSharpBindingAttr ? true : isDestructureBinding ? true : param.type ? isInterproceduralTaintableType(param.type, language) : true;
         if (isTaintable) {
           const paramLine = param.line ?? method.start_line;
           sources.push({
@@ -14009,12 +14049,14 @@ function isInterproceduralTaintableType(typeName, language) {
 function isParameterizedQueryCall(call, pattern) {
   if (pattern.type !== "sql_injection")
     return false;
-  const queryArg = call.arguments.find((a) => a.position === 0);
+  const queryPos = pattern.arg_positions.length > 0 ? Math.min(...pattern.arg_positions) : 0;
+  const queryArg = call.arguments.find((a) => a.position === queryPos);
   if (queryArg) {
     const queryText = queryArg.literal ?? queryArg.expression ?? "";
     const hasPlaceholders = /(\?(?:\s|,|$|\))|\$\d+|:\w+|%s)/.test(queryText);
     const hasConcatenation = /\+\s*[^+]/.test(queryText) || queryText.includes("${");
-    if (hasPlaceholders && !hasConcatenation && call.arguments.length >= 2) {
+    const hasBoundArg = queryPos === 0 ? call.arguments.length >= 2 : call.arguments.some((a) => a.position > queryPos);
+    if (hasPlaceholders && !hasConcatenation && hasBoundArg) {
       return true;
     }
   }
@@ -14757,6 +14799,17 @@ function isSafeJinjaRenderCall(call, pattern, language, sourceLines) {
   }
   return false;
 }
+function isArgumentlessJsResponseWriter(call, pattern, language) {
+  if (pattern.type !== "xss" || pattern.class !== "Response")
+    return false;
+  if (language !== "javascript" && language !== "typescript")
+    return false;
+  const positions = pattern.arg_positions;
+  if (!positions || positions.length === 0)
+    return false;
+  const argc = call.arguments?.length ?? 0;
+  return positions.every((pos) => pos >= argc);
+}
 function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types) {
   const patternsForLanguage = language === undefined ? patterns : patterns.filter((p) => sinkPatternAppliesTo(p, language));
   const sinkMap = new Map;
@@ -14817,6 +14870,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
             continue;
           }
         }
+        if (isArgumentlessJsResponseWriter(call, pattern, language)) {
+          continue;
+        }
         if ((pattern.type === "command_injection" || pattern.type === "sql_injection") && call.method_name === "exec" && (language === "javascript" || language === "typescript") && isRegexReceiver(call.receiver, sourceLines)) {
           continue;
         }
@@ -18235,6 +18291,9 @@ function buildSanitizersByLine(sanitizers) {
   }
   return out2;
 }
+function concatOutsideStrings(expression) {
+  return expression.replace(/"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'/g, " ").includes("+");
+}
 function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanitizers, sanitizersArg) {
   let graph;
   let sources;
@@ -18266,6 +18325,7 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
   }
   const taintedVars = [];
   const flows = [];
+  const javaConcat = graph.ir.meta.language === "java";
   const reachableSinks = new Map;
   const defsByLine = graph.defsByLine;
   const usesByLine = graph.usesByLine;
@@ -18298,12 +18358,14 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
             continue;
           }
         }
-        const candidateUses = arg.variable ? usesAtSink.filter((u) => u.variable === arg.variable) : usesAtSink;
+        const expr = typeof arg.expression === "string" ? arg.expression : "";
+        const compoundConcat = javaConcat && !!arg.variable && expr !== arg.variable && concatOutsideStrings(expr);
+        const candidateUses = arg.variable && !compoundConcat ? usesAtSink.filter((u) => u.variable === arg.variable) : usesAtSink;
         {
           for (const use of candidateUses) {
             if (use.def_id !== null) {
               if (allTaintedDefIds.has(use.def_id)) {
-                if (!arg.variable) {
+                if (!arg.variable || compoundConcat) {
                   if (typeof arg.expression !== "string" || arg.expression.length === 0)
                     continue;
                   const re = new RegExp(`(?:^|[^A-Za-z0-9_$])${use.variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[^A-Za-z0-9_$]|$)`);
@@ -24259,6 +24321,17 @@ class VuePlugin extends BaseLanguagePlugin {
 }
 
 // ../circle-ir/dist/languages/plugins/go.js
+function sqlSinks(cls, methods) {
+  return methods.map(([method, argPositions]) => ({
+    method,
+    class: cls,
+    type: "sql_injection",
+    cwe: "CWE-89",
+    severity: "critical",
+    argPositions
+  }));
+}
+
 class GoPlugin extends BaseLanguagePlugin {
   id = "go";
   name = "Go";
@@ -24443,6 +24516,32 @@ class GoPlugin extends BaseLanguagePlugin {
         severity: "critical",
         argPositions: [0]
       },
+      ...sqlSinks("DB", [
+        ["QueryContext", [1]],
+        ["QueryRowContext", [1]],
+        ["ExecContext", [1]],
+        ["Prepare", [0]],
+        ["PrepareContext", [1]]
+      ]),
+      ...sqlSinks("Tx", [
+        ["Exec", [0]],
+        ["QueryRow", [0]],
+        ["QueryContext", [1]],
+        ["QueryRowContext", [1]],
+        ["ExecContext", [1]],
+        ["Prepare", [0]],
+        ["PrepareContext", [1]]
+      ]),
+      ...sqlSinks("Conn", [
+        ["Query", [0]],
+        ["QueryRow", [0]],
+        ["Exec", [0]],
+        ["QueryContext", [1]],
+        ["QueryRowContext", [1]],
+        ["ExecContext", [1]],
+        ["Prepare", [0]],
+        ["PrepareContext", [1]]
+      ]),
       {
         method: "Command",
         class: "exec",
@@ -36411,6 +36510,22 @@ function evaluateSimpleExpression(expr, symbols) {
     return String(Math.floor(result));
   return expr;
 }
+var ARGUMENT_IDENT_SKIP = new Set(["new", "true", "false", "null", "this", "super"]);
+function isStringConcat(expression) {
+  return expression.replace(/"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'/g, " ").includes("+");
+}
+function argumentIdentifiers(expression) {
+  const stripped = expression.replace(/"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'/g, " ");
+  const found = stripped.match(/[A-Za-z_$][A-Za-z0-9_$]*/g) ?? [];
+  const out2 = [];
+  for (const id of found) {
+    if (ARGUMENT_IDENT_SKIP.has(id))
+      continue;
+    if (!out2.includes(id))
+      out2.push(id);
+  }
+  return out2;
+}
 function isStringLiteralExpression(expr) {
   const trimmed = expr.trim();
   if (trimmed.length < 2)
@@ -36489,22 +36604,30 @@ function filterCleanVariableSinks(sinks, calls, taintedVars, symbols, dfg, sanit
         if (language === "bash" && arg.expression === call.method_name && !arg.variable && arg.literal == null)
           continue;
         if (arg.variable && !arg.expression?.includes("[")) {
-          const varName = arg.variable;
-          const scopedName = methodName ? `${methodName}:${varName}` : varName;
-          if (fieldNames.has(varName) && !isInSynchronizedBlock) {
-            allArgsAreClean = false;
-            continue;
+          const expr = arg.expression ?? "";
+          const concatNames = language === "java" && isStringConcat(expr) ? argumentIdentifiers(expr) : [];
+          const names = concatNames.length > 0 ? concatNames : [arg.variable];
+          let argClean = true;
+          for (const varName of names) {
+            const scopedName = methodName ? `${methodName}:${varName}` : varName;
+            if (fieldNames.has(varName) && !isInSynchronizedBlock) {
+              argClean = false;
+              break;
+            }
+            if (sanitizedVars?.has(scopedName) || sanitizedVars?.has(varName))
+              continue;
+            if (taintedVars.has(scopedName) || taintedVars.has(varName)) {
+              argClean = false;
+              break;
+            }
+            const symbolValue = symbols.get(scopedName) ?? symbols.get(varName);
+            if (symbolValue && symbolValue.type !== "unknown")
+              continue;
+            argClean = false;
+            break;
           }
-          if (sanitizedVars?.has(scopedName) || sanitizedVars?.has(varName))
-            continue;
-          if (taintedVars.has(scopedName) || taintedVars.has(varName)) {
+          if (!argClean)
             allArgsAreClean = false;
-            continue;
-          }
-          const symbolValue = symbols.get(scopedName) ?? symbols.get(varName);
-          if (symbolValue && symbolValue.type !== "unknown")
-            continue;
-          allArgsAreClean = false;
         } else {
           if (arg.literal != null)
             continue;
@@ -39947,6 +40070,8 @@ function analyzeInterprocedural2(graphOrTypes, callsOrSources, dfgOrSinks, sourc
     "QueryRowContext",
     "Exec",
     "ExecContext",
+    "Prepare",
+    "PrepareContext",
     "EscapeString",
     "HTMLEscapeString",
     "JSEscapeString",
@@ -44880,7 +45005,7 @@ function isGeneratedFile(file) {
 var PROVIDER_PATTERNS = [
   {
     name: "AWS access key",
-    regex: /\bAKIA[0-9A-Z]{16}\b/,
+    regex: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/,
     severity: "critical",
     level: "error",
     fix: "Rotate the AWS access key immediately and move it to an environment variable or AWS Secrets Manager."
@@ -44948,6 +45073,20 @@ var PROVIDER_PATTERNS = [
     level: "warning",
     fix: "Publishable keys are not secret but should still not be checked in to back-end source files; verify front-end vs back-end context."
   },
+  {
+    name: "Stripe test secret key",
+    regex: /\bsk_test_[A-Za-z0-9]{24,}\b/,
+    severity: "high",
+    level: "warning",
+    fix: "Rotate the Stripe test secret key in the Stripe Dashboard and load it from a secrets manager."
+  },
+  {
+    name: "Stripe test restricted key",
+    regex: /\brk_test_[A-Za-z0-9]{24,}\b/,
+    severity: "high",
+    level: "warning",
+    fix: "Rotate the Stripe test restricted key in the Stripe Dashboard and load it from a secrets manager."
+  },
   {
     name: "OpenAI API key",
     regex: /\bsk-[A-Za-z0-9]{48}\b/,
@@ -45292,7 +45431,7 @@ class ScanSecretsPass {
         const m = pattern.regex.exec(lineText);
         if (!m)
           continue;
-        if ((pattern.name === "Stripe live restricted key" || pattern.name === "GitLab personal access token") && PLACEHOLDER_RE.test(m[0])) {
+        if ((pattern.name === "Stripe live restricted key" || pattern.name === "Stripe test secret key" || pattern.name === "Stripe test restricted key" || pattern.name === "GitLab personal access token") && PLACEHOLDER_RE.test(m[0])) {
           continue;
         }
         if (pattern.name === "PEM private key" && !pemHasInlineBody(lines, i2)) {
@@ -50396,6 +50535,27 @@ function longestLineLength(code) {
   return max;
 }
 var MAX_ANALYZABLE_LINE_LENGTH = 1e4;
+function neutralizeOverlongLines(code) {
+  if (longestLineLength(code) <= MAX_ANALYZABLE_LINE_LENGTH) {
+    return { code, dropped: 0 };
+  }
+  let out2 = "";
+  let start2 = 0;
+  let dropped = 0;
+  for (let i2 = 0;i2 <= code.length; i2++) {
+    if (i2 !== code.length && code.charCodeAt(i2) !== 10)
+      continue;
+    if (i2 - start2 > MAX_ANALYZABLE_LINE_LENGTH)
+      dropped++;
+    else if (i2 > start2)
+      out2 += code.slice(start2, i2);
+    if (i2 < code.length)
+      out2 += `
+`;
+    start2 = i2 + 1;
+  }
+  return { code: out2, dropped };
+}
 async function analyze(code, filePath, language, options = {}) {
   if (!initialized) {
     await initAnalyzer(options);
@@ -50414,6 +50574,15 @@ async function analyze(code, filePath, language, options = {}) {
       parseGrammar = "tsx";
     }
   }
+  const neutralized = neutralizeOverlongLines(code);
+  if (neutralized.dropped > 0) {
+    logger.warn("Neutralized over-long lines before analysis", {
+      filePath,
+      language,
+      droppedLines: neutralized.dropped
+    });
+    code = neutralized.code;
+  }
   logger.debug("Analyzing file", { filePath, language, parseGrammar, codeLength: code.length });
   const phaseTimingEnabled = globalThis.__circleIrPassTiming === true;
   const phaseStart = () => phaseTimingEnabled ? Date.now() : 0;
@@ -51986,7 +52155,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.13.2";
+var version = "4.14.1";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -52447,6 +52616,21 @@ function formatSARIF(results, crossFileData, profileSummary) {
           }
         },
         results: generateSarifResults(results, crossFileData),
+        ...crossFileData?.projectSizeBudgetExceeded ? {
+          invocations: [
+            {
+              executionSuccessful: false,
+              toolExecutionNotifications: [
+                {
+                  level: "warning",
+                  message: {
+                    text: `Project size ceiling reached — analysed ${crossFileData.filesAnalysed ?? "?"} of ${crossFileData.filesTotal ?? "?"} files.`
+                  }
+                }
+              ]
+            }
+          ]
+        } : {},
         ...profileSummary ? { properties: { projectProfile: profileSummary } } : {}
       }
     ]
@@ -52538,8 +52722,8 @@ function generateSarifResults(results, crossFileData) {
 
 // src/build-info.ts
 var buildInfo = {
-  gitSha: "3937b7b",
-  builtAt: "2026-10-08T19:28:03.582Z"
+  gitSha: "c8c74e9",
+  builtAt: "2026-10-11T07:15:24.915Z"
 };
 
 // src/utils/args.ts
@@ -52781,6 +52965,38 @@ function spinner(text) {
 }
 
 // src/cli.ts
+function collapseWs(s) {
+  return s.replace(/\s+/g, " ").trim();
+}
+function fileMatches(suppFile, findingFile, basePath) {
+  const wanted = suppFile.replace(/^\.\//, "");
+  const relativeFile = relative4(basePath, findingFile) || findingFile;
+  return wanted === relativeFile || wanted === findingFile;
+}
+function findingMatchesSuppression(supp, finding, basePath, lineAt) {
+  if (supp.pass !== finding.pass && supp.pass !== finding.alsoPass)
+    return false;
+  if (supp.file && !fileMatches(supp.file, finding.file, basePath))
+    return false;
+  const snippet = supp.snippet ? collapseWs(supp.snippet) : "";
+  if (snippet) {
+    const fromFile = lineAt?.(finding.file, finding.line);
+    const text = fromFile !== undefined ? fromFile : finding.lineText;
+    return text !== undefined && collapseWs(text).includes(snippet);
+  }
+  if (supp.line !== undefined && supp.line !== finding.line)
+    return false;
+  return true;
+}
+function staleSuppressions(suppressions, matched) {
+  return suppressions.filter((_, i2) => !matched.has(i2));
+}
+function reportStaleSuppressions(suppressions, matched) {
+  for (const supp of staleSuppressions(suppressions, matched)) {
+    const where = [supp.file, supp.snippet ? "snippet" : "", supp.line !== undefined && !supp.snippet ? `line ${supp.line}` : ""].filter(Boolean).join(" ");
+    console.error(colors.dim(`Suppression for ${supp.pass}${where ? ` (${where})` : ""} matched no finding`));
+  }
+}
 function loadConfig(profilePath) {
   const configPath = profilePath || "cognium.config.json";
   if (!existsSync(configPath)) {
@@ -52833,22 +53049,15 @@ function convertConfigToPassOptions(config) {
   }
   return { passOptions, disabledPasses };
 }
-function applySuppressionsToResults(results, suppressions, basePath) {
+function applySuppressionsToResults(results, suppressions, basePath, match) {
   if (suppressions.length === 0)
     return results;
   return results.map((result) => {
-    const relativeFile = relative4(basePath, result.file) || result.file;
     const filteredVulns = result.vulnerabilities.filter((vuln) => {
-      for (const supp of suppressions) {
-        if (supp.pass !== vuln.type)
-          continue;
-        if (supp.file) {
-          const suppFile = supp.file.replace(/^\.\//, "");
-          if (suppFile !== relativeFile && suppFile !== result.file)
-            continue;
-        }
-        if (supp.line !== undefined && supp.line !== vuln.line)
+      for (let i2 = 0;i2 < suppressions.length; i2++) {
+        if (!findingMatchesSuppression(suppressions[i2], { pass: vuln.type, file: result.file, line: vuln.line }, basePath, match?.lineAt))
           continue;
+        match?.matched?.add(i2);
         return false;
       }
       return true;
@@ -52856,22 +53065,20 @@ function applySuppressionsToResults(results, suppressions, basePath) {
     return { ...result, vulnerabilities: filteredVulns };
   });
 }
-function applySuppressionsToTaintPaths(paths, suppressions, basePath) {
+function applySuppressionsToTaintPaths(paths, suppressions, basePath, match) {
   if (suppressions.length === 0)
     return paths;
   return paths.filter((path) => {
-    for (const supp of suppressions) {
-      const sinkType = path.sink.type;
-      if (supp.pass !== sinkType && supp.pass !== `cross-file-${sinkType}`)
-        continue;
-      if (supp.file) {
-        const suppFile = supp.file.replace(/^\.\//, "");
-        const relativeFile = relative4(basePath, path.sink.file) || path.sink.file;
-        if (suppFile !== relativeFile && suppFile !== path.sink.file)
-          continue;
-      }
-      if (supp.line !== undefined && supp.line !== path.sink.line)
-        continue;
+    for (let i2 = 0;i2 < suppressions.length; i2++) {
+      if (!findingMatchesSuppression(suppressions[i2], {
+        pass: path.sink.type,
+        alsoPass: `cross-file-${path.sink.type}`,
+        file: path.sink.file,
+        line: path.sink.line,
+        lineText: path.sink.code
+      }, basePath, match?.lineAt))
+        continue;
+      match?.matched?.add(i2);
       return false;
     }
     return true;
@@ -53394,14 +53601,35 @@ async function runScan(targetPath, options) {
     }
     if (suppressions.length > 0) {
       const beforeCount = results.reduce((sum, r) => sum + r.vulnerabilities.length, 0) + (crossFileData?.taintPaths.length ?? 0);
-      results = applySuppressionsToResults(results, suppressions, process.cwd());
+      const matched = new Set;
+      const needsLines = suppressions.some((s) => s.snippet && collapseWs(s.snippet).length > 0);
+      const lineCache = new Map;
+      const lineAt = needsLines ? (file, line) => {
+        let lines = lineCache.get(file);
+        if (lines === undefined) {
+          try {
+            lines = readFileSync(file, "utf-8").split(`
+`);
+          } catch {
+            lines = null;
+          }
+          lineCache.set(file, lines);
+        }
+        if (!lines || line < 1)
+          return;
+        return lines[line - 1];
+      } : undefined;
+      const match = { lineAt, matched };
+      results = applySuppressionsToResults(results, suppressions, process.cwd(), match);
       if (crossFileData) {
-        crossFileData.taintPaths = applySuppressionsToTaintPaths(crossFileData.taintPaths, suppressions, process.cwd());
+        crossFileData.taintPaths = applySuppressionsToTaintPaths(crossFileData.taintPaths, suppressions, process.cwd(), match);
       }
       const afterCount = results.reduce((sum, r) => sum + r.vulnerabilities.length, 0) + (crossFileData?.taintPaths.length ?? 0);
       if (!options.quiet && beforeCount !== afterCount) {
         console.error(colors.dim(`Suppressed ${beforeCount - afterCount} finding(s) via config`));
       }
+      if (!options.quiet)
+        reportStaleSuppressions(suppressions, matched);
     }
     const severityOrder = ["low", "medium", "high", "critical"];
     if (options.severity) {
@@ -54034,7 +54262,9 @@ main().catch((error) => {
   process.exit(2);
 });
 export {
+  staleSuppressions,
   resolveScanLanguage,
+  reportStaleSuppressions,
   matchesGlob,
   loadConfig,
   isTestFile2 as isTestFile,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.13.2",
+  "version": "4.14.1",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "bin": {
     "cognium-dev": "dist/cli.js"
@@ -65,7 +65,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "1.1.2",
-    "circle-ir": "4.13.2"
+    "circle-ir": "4.14.1"
   },
   "devDependencies": {
     "@types/node": "^26.6.4",