cognium-dev 4.9.9 → 4.9.11

package/dist/cli.js

@@ -5,7 +5,7 @@ var __require = /* @__PURE__ */ createRequire(import.meta.url);
 // src/cli.ts
 import { readFileSync, existsSync, writeFileSync } from "fs";
 import { stat as stat2, readdir as readdir2 } from "fs/promises";
-import { join as join2, dirname as dirname3, extname, resolve as resolve2, relative as relative4, basename } from "path";
+import { join as join2, dirname as dirname2, extname, resolve, relative as relative3, basename } from "path";
 import { createRequire as createRequire2 } from "module";
 
 // ../../node_modules/web-tree-sitter/web-tree-sitter.js
@@ -3232,7 +3232,7 @@ var Query = class {
   }
 };
 
-// ../circle-ir/dist/core/parser.js
+// node_modules/circle-ir/dist/core/parser.js
 var nodeModules = null;
 var moduleDir = null;
 async function getNodeModules() {
@@ -3472,7 +3472,7 @@ async function getDefaultLanguagePath(language) {
   }
   return `wasm/tree-sitter-${language}.wasm`;
 }
-// ../circle-ir/dist/core/extractors/meta.js
+// node_modules/circle-ir/dist/core/extractors/meta.js
 function extractMeta(code, tree, filePath, language) {
   const loc = countLinesOfCode(code);
   const hash = computeHash(code);
@@ -3554,7 +3554,7 @@ function extractPackage(tree, language) {
   }
   return null;
 }
-// ../circle-ir/dist/core/extractors/types.js
+// node_modules/circle-ir/dist/core/extractors/types.js
 function detectLanguage(tree) {
   const root = tree.rootNode;
   const jsNodeTypes = new Set([
@@ -5222,7 +5222,7 @@ function findChildByType(node, type) {
   }
   return null;
 }
-// ../circle-ir/dist/core/extractors/calls.js
+// node_modules/circle-ir/dist/core/extractors/calls.js
 function detectLanguageFromTree(tree, cache) {
   const rustStructs = getNodesFromCache(tree.rootNode, "struct_item", cache);
   const rustImpls = getNodesFromCache(tree.rootNode, "impl_item", cache);
@@ -5338,6 +5338,27 @@ var CSHARP_COMMAND_EXECUTE_METHODS = new Set([
   "ExecuteReaderAsync",
   "ExecuteNonQueryAsync"
 ]);
+var CSHARP_RECEIVER_URL_METHODS = new Set([
+  "GetAsync",
+  "PostAsync",
+  "PutAsync",
+  "PatchAsync",
+  "DeleteAsync",
+  "HeadAsync",
+  "GetStringAsync",
+  "GetByteArrayAsync",
+  "GetStreamAsync",
+  "GetJsonAsync"
+]);
+var CSHARP_HEADER_RECEIVER_RE = /(^|\.)Headers$/;
+function csharpBareName(node) {
+  if (node.type === "generic_name") {
+    const id = node.childForFieldName("name") ?? node.namedChild(0);
+    if (id)
+      return getNodeText(id);
+  }
+  return getNodeText(node);
+}
 function extractCSharpCalls(tree, cache) {
   const calls = [];
   const typeMap = buildCSharpReceiverTypeMap(tree, cache);
@@ -5349,16 +5370,22 @@ function extractCSharpCalls(tree, cache) {
     if (fn?.type === "member_access_expression") {
       const nameNode = fn.childForFieldName("name");
       const exprNode = fn.childForFieldName("expression");
-      methodName = nameNode ? getNodeText(nameNode) : "unknown";
+      methodName = nameNode ? csharpBareName(nameNode) : "unknown";
       receiver = exprNode ? getNodeText(exprNode) : null;
     } else if (fn) {
-      methodName = getNodeText(fn);
+      methodName = csharpBareName(fn);
     }
     const argsNode = inv.childForFieldName("arguments");
     let args2 = argsNode ? extractCSharpArguments(argsNode) : [];
     if (receiver && CSHARP_COMMAND_EXECUTE_METHODS.has(methodName)) {
       args2 = [{ position: 0, expression: receiver, variable: receiver, literal: null, value: null }, ...args2];
     }
+    if (methodName === "Add" && receiver && CSHARP_HEADER_RECEIVER_RE.test(receiver)) {
+      methodName = "AddHeader";
+    }
+    if (receiver && args2.length === 0 && CSHARP_RECEIVER_URL_METHODS.has(methodName)) {
+      args2 = [{ position: 0, expression: receiver, variable: receiver, literal: null, value: null }];
+    }
     calls.push({
       method_name: methodName,
       receiver,
@@ -5374,7 +5401,7 @@ function extractCSharpCalls(tree, cache) {
     const typeNode = creation.childForFieldName("type");
     const argsNode = creation.childForFieldName("arguments");
     calls.push({
-      method_name: typeNode ? getNodeText(typeNode) : "unknown",
+      method_name: typeNode ? csharpBareName(typeNode) : "unknown",
       receiver: null,
       receiver_type: null,
       receiver_type_fqn: null,
@@ -5387,6 +5414,41 @@ function extractCSharpCalls(tree, cache) {
   const assignments = getNodesFromCache(tree.rootNode, "assignment_expression", cache);
   for (const asn of assignments) {
     const left = asn.childForFieldName("left");
+    if (left?.type === "element_access_expression") {
+      const target = left.childForFieldName("expression");
+      const right2 = asn.childForFieldName("right");
+      if (!target || !right2)
+        continue;
+      if (!CSHARP_HEADER_RECEIVER_RE.test(getNodeText(target)))
+        continue;
+      const subscript = left.childForFieldName("subscript") ?? left.namedChild(1);
+      const rhsText2 = getNodeText(right2);
+      calls.push({
+        method_name: "AddHeader",
+        receiver: getNodeText(target),
+        receiver_type: null,
+        receiver_type_fqn: null,
+        arguments: [
+          {
+            position: 0,
+            expression: subscript ? getNodeText(subscript) : "",
+            variable: null,
+            literal: subscript ? getNodeText(subscript) : null,
+            value: null
+          },
+          {
+            position: 1,
+            expression: rhsText2,
+            variable: right2.type === "identifier" ? rhsText2 : null,
+            literal: right2.type === "string_literal" ? rhsText2 : null,
+            value: null
+          }
+        ],
+        location: { line: asn.startPosition.row + 1, column: asn.startPosition.column },
+        in_method: findEnclosingMethod(asn)
+      });
+      continue;
+    }
     if (left?.type !== "member_access_expression")
       continue;
     const nameNode = left.childForFieldName("name");
@@ -7274,7 +7336,7 @@ function extractGoTypeLastSegment(typeNode) {
   }
   return null;
 }
-// ../circle-ir/dist/core/extractors/imports.js
+// node_modules/circle-ir/dist/core/extractors/imports.js
 function detectLanguage2(tree) {
   const root = tree.rootNode;
   const jsNodeTypes = new Set([
@@ -7961,7 +8023,7 @@ function findGoChildByType(node, type) {
   }
   return null;
 }
-// ../circle-ir/dist/core/extractors/exports.js
+// node_modules/circle-ir/dist/core/extractors/exports.js
 function extractExports(types) {
   const exports = [];
   for (const type of types) {
@@ -8014,7 +8076,7 @@ function getVisibilityFromModifiers(modifiers) {
   }
   return "package";
 }
-// ../circle-ir/dist/core/extractors/cfg.js
+// node_modules/circle-ir/dist/core/extractors/cfg.js
 function detectLanguage3(tree) {
   const root = tree.rootNode;
   const jsNodeTypes = new Set([
@@ -8663,7 +8725,7 @@ function isGoStatement(node) {
   ]);
   return goStatementTypes.has(node.type);
 }
-// ../circle-ir/dist/core/extractors/dfg.js
+// node_modules/circle-ir/dist/core/extractors/dfg.js
 function detectLanguage4(tree) {
   const root = tree.rootNode;
   const jsNodeTypes = new Set([
@@ -10184,7 +10246,7 @@ function extractGoAddressableVarName(node) {
   }
   return null;
 }
-// ../circle-ir/dist/core/extractors/runtime-registrations.js
+// node_modules/circle-ir/dist/core/extractors/runtime-registrations.js
 var HTTP_VERB_METHODS = new Set([
   "get",
   "post",
@@ -10932,7 +10994,7 @@ function parseDistributedSliceAttribute(attrItem) {
     }
   };
 }
-// ../circle-ir/dist/analysis/config-loader.js
+// node_modules/circle-ir/dist/analysis/config-loader.js
 var DEFAULT_SOURCES = [
   { method: "getParameter", class: "HttpServletRequest", type: "http_param", severity: "high", return_tainted: true },
   { method: "getParameterValues", class: "HttpServletRequest", type: "http_param", severity: "high", return_tainted: true },
@@ -12474,6 +12536,17 @@ var DEFAULT_SINKS = [
   { method: "ExecuteSqlRawAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "FromSqlRaw", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "FromSqlRawAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Query", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryFirst", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryFirstAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryFirstOrDefault", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryFirstOrDefaultAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QuerySingle", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QuerySingleOrDefault", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "QueryMultiple", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "Execute", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
+  { method: "ExecuteAsync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "CommandText", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "Filter", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "ExecuteScalar", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["csharp"] },
@@ -12515,12 +12588,16 @@ var DEFAULT_SINKS = [
   { method: "DeleteAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "GetStringAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "GetByteArrayAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "GetJsonAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "PatchAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "HeadAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "GetStreamAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "SendAsync", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DownloadString", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DownloadData", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DownloadFile", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [1], languages: ["csharp"] },
   { method: "Create", class: "WebRequest", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "RestClient", class: "constructor", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "EvaluateAsync", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "RunAsync", class: "CSharpScript", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
   { method: "Load", class: "Assembly", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["csharp"] },
@@ -12538,6 +12615,7 @@ var DEFAULT_SINKS = [
   { method: "Write", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "HtmlString", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "MarkupString", class: "constructor", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "Content", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "Format", class: "String", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["csharp"] },
   { method: "DirectorySearcher", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "DirectoryEntry", type: "ldap_injection", cwe: "CWE-90", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -12546,12 +12624,18 @@ var DEFAULT_SINKS = [
   { method: "AddHeader", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["csharp"] },
   { method: "AppendHeader", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["csharp"] },
   { method: "Parse", class: "BsonDocument", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["csharp"] },
+  { method: "BsonJavaScript", class: "constructor", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "LogInformation", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
   { method: "LogWarning", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
   { method: "LogError", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
   { method: "LogDebug", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
   { method: "LogCritical", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
   { method: "LogTrace", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0], languages: ["csharp"] },
+  { method: "IsMatch", class: "Regex", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "Match", class: "Regex", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "Matches", class: "Regex", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "Replace", class: "Regex", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [1], languages: ["csharp"] },
+  { method: "Regex", class: "constructor", type: "redos", cwe: "CWE-1333", severity: "medium", arg_positions: [0], languages: ["csharp"] },
   { method: "Log", class: "ILogger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1], languages: ["csharp"] },
   { method: "SelectSingleNode", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
   { method: "SelectNodes", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0], languages: ["csharp"] },
@@ -12691,6 +12775,8 @@ var DEFAULT_SANITIZERS = [
   { method: "encodeToString", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
   { method: "encodeHexString", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
   { method: "encodeForURL", removes: ["xss", "ssrf", "open_redirect"] },
+  { method: "IsLocalUrl", removes: ["open_redirect"] },
+  { method: "LocalRedirect", removes: ["open_redirect"] },
   { method: "encodeURL", removes: ["xss", "ssrf", "open_redirect"] },
   { method: "urlEncode", removes: ["xss", "ssrf", "open_redirect"] },
   { method: "escapeUrl", removes: ["xss", "ssrf", "open_redirect"] },
@@ -13011,7 +13097,7 @@ var DEFAULT_HEADER_RULES = [
     note: "Fires when the value is not a string literal (likely reflected from request)"
   }
 ];
-// ../circle-ir/dist/analysis/arg-type-resolver.js
+// node_modules/circle-ir/dist/analysis/arg-type-resolver.js
 function findEnclosingType(callInMethod, types) {
   if (!callInMethod)
     return null;
@@ -13089,7 +13175,7 @@ function isArgvContainerType(rawType) {
   return /^(?:List|ArrayList|LinkedList|Collection|Iterable|Deque|Queue)\s*<\s*(?:String|CharSequence|java\.lang\.String)\b/.test(s);
 }
 
-// ../circle-ir/dist/analysis/taint-matcher.js
+// node_modules/circle-ir/dist/analysis/taint-matcher.js
 var PYTHON_TAINTED_PATTERNS = [
   { pattern: /\brequest\.args\b/, sourceType: "http_param" },
   { pattern: /\brequest\.form\b/, sourceType: "http_body" },
@@ -15094,7 +15180,7 @@ function formatSanitizerMethod(call) {
   return `${call.method_name}()`;
 }
 
-// ../circle-ir/dist/analysis/unresolved.js
+// node_modules/circle-ir/dist/analysis/unresolved.js
 function detectUnresolved(calls, types, dfg) {
   const unresolved = [];
   unresolved.push(...detectVirtualDispatch(calls));
@@ -15258,7 +15344,7 @@ function formatCallCode(call) {
   }
   return `${call.method_name}(${args2})`;
 }
-// ../circle-ir/dist/analysis/non-executable-lines.js
+// node_modules/circle-ir/dist/analysis/non-executable-lines.js
 function isNonExecutableSourceLine(sourceCode, line, language) {
   if (!sourceCode || line < 1)
     return false;
@@ -15318,7 +15404,7 @@ function isNonExecutablePython(trimmed) {
   return false;
 }
 
-// ../circle-ir/dist/analysis/sanitizer-index.js
+// node_modules/circle-ir/dist/analysis/sanitizer-index.js
 var SANITIZER_SET_CACHE = new WeakMap;
 function getSanitizesSet(san) {
   let s = SANITIZER_SET_CACHE.get(san);
@@ -15332,7 +15418,7 @@ function sanitizerCoversSink(san, sinkType) {
   return getSanitizesSet(san).has(sinkType);
 }
 
-// ../circle-ir/dist/analysis/dfg-walk.js
+// node_modules/circle-ir/dist/analysis/dfg-walk.js
 var walkBackwardDefsMemo = new WeakMap;
 function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
   const maxHops = options.maxHops ?? 32;
@@ -15385,15 +15471,15 @@ function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
   return result;
 }
 
-// ../circle-ir/dist/analysis/findings.js
+// node_modules/circle-ir/dist/analysis/findings.js
 function canSourceReachSink(sourceType, sinkType) {
   const sourceToSinkMapping = {
-    http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
+    http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "xxe", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     http_body: ["sql_injection", "command_injection", "deserialization", "xxe", "xss", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     http_header: ["sql_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     http_cookie: ["sql_injection", "xss", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     http_path: ["path_traversal", "sql_injection", "ssrf", "mybatis_mapper_call", "open_redirect", "trust_boundary", "xss", "log_injection", "format_string", "prompt_injection"],
-    http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
+    http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "xxe", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
     io_input: ["command_injection", "path_traversal", "deserialization", "xxe", "code_injection", "xss", "ssrf", "log_injection", "format_string", "prompt_injection"],
     env_input: ["command_injection", "path_traversal"],
     db_input: ["xss", "sql_injection", "log_injection"],
@@ -15416,7 +15502,7 @@ function sourceSemanticsAllowed(source, sinkType) {
   return true;
 }
 
-// ../circle-ir/dist/analysis/findings-instrumentation.js
+// node_modules/circle-ir/dist/analysis/findings-instrumentation.js
 var instrumentEnabled = false;
 function setFindingsInstrumentation(enabled) {
   instrumentEnabled = enabled;
@@ -15479,7 +15565,7 @@ function emitFindingsInstrumentation(filePath, findings, taint) {
   };
   console.error(`[findings-summary] ${JSON.stringify(summary)}`);
 }
-// ../circle-ir/dist/graph/code-graph.js
+// node_modules/circle-ir/dist/graph/code-graph.js
 class CodeGraph {
   ir;
   constructor(ir) {
@@ -15689,7 +15775,7 @@ class CodeGraph {
     return result;
   }
 }
-// ../circle-ir/dist/resolution/type-hierarchy.js
+// node_modules/circle-ir/dist/resolution/type-hierarchy.js
 class TypeHierarchyResolver {
   types = new Map;
   nameToFqn = new Map;
@@ -16261,7 +16347,7 @@ function registerCommonLibraries(resolver) {
   resolver.registerFactoryReturnType("HttpClients", "createSystem", "org.apache.http.impl.client.CloseableHttpClient");
   resolver.registerFactoryReturnType("HttpClients", "createMinimal", "org.apache.http.impl.client.MinimalHttpClient");
 }
-// ../circle-ir/dist/resolution/symbol-table.js
+// node_modules/circle-ir/dist/resolution/symbol-table.js
 class SymbolTable {
   exports = new Map;
   nameToFqns = new Map;
@@ -16484,7 +16570,7 @@ class SymbolTable {
     return "package";
   }
 }
-// ../circle-ir/dist/resolution/cross-file.js
+// node_modules/circle-ir/dist/resolution/cross-file.js
 function buildFileIndex(ir) {
   const callsByLine = new Map;
   for (const c of ir.calls) {
@@ -17572,7 +17658,7 @@ class CrossFileResolver {
     return this.fieldTaintInfo.get(`${typeFqn}.${fieldName}`);
   }
 }
-// ../circle-ir/dist/graph/project-graph.js
+// node_modules/circle-ir/dist/graph/project-graph.js
 class ProjectGraph {
   files = new Map;
   _symbolTable = null;
@@ -17624,7 +17710,7 @@ class ProjectGraph {
     return this._resolver;
   }
 }
-// ../circle-ir/dist/graph/analysis-pass.js
+// node_modules/circle-ir/dist/graph/analysis-pass.js
 class AnalysisPipeline {
   passes = [];
   add(pass) {
@@ -17671,7 +17757,7 @@ class AnalysisPipeline {
     return { results, findings };
   }
 }
-// ../circle-ir/dist/analysis/taint-propagation.js
+// node_modules/circle-ir/dist/analysis/taint-propagation.js
 function buildSanitizersByLine(sanitizers) {
   const out2 = new Map;
   for (const san of sanitizers) {
@@ -17970,7 +18056,7 @@ function buildTaintFlow(source, sink, taintInfo) {
     confidence: taintInfo.confidence * 0.9
   };
 }
-// ../circle-ir/dist/analysis/constant-propagation/ast-utils.js
+// node_modules/circle-ir/dist/analysis/constant-propagation/ast-utils.js
 function isKnown(cv) {
   return cv.type !== "unknown";
 }
@@ -17987,7 +18073,7 @@ function getNodeLine(node) {
   return node.startPosition.row + 1;
 }
 
-// ../circle-ir/dist/analysis/constant-propagation/evaluator.js
+// node_modules/circle-ir/dist/analysis/constant-propagation/evaluator.js
 class ExpressionEvaluator {
   source;
   getSymbol;
@@ -18257,7 +18343,7 @@ class ExpressionEvaluator {
   }
 }
 
-// ../circle-ir/dist/analysis/constant-propagation/patterns.js
+// node_modules/circle-ir/dist/analysis/constant-propagation/patterns.js
 var TAINT_PATTERNS = [
   "request.getParameter",
   "request.getHeader",
@@ -18452,7 +18538,7 @@ var PROPAGATOR_METHODS = new Set([
   "decodeRequestString"
 ]);
 
-// ../circle-ir/dist/analysis/constant-propagation/propagator.js
+// node_modules/circle-ir/dist/analysis/constant-propagation/propagator.js
 class ConstantPropagator {
   symbols = new Map;
   tainted = new Set;
@@ -20309,7 +20395,7 @@ class ConstantPropagator {
   }
 }
 
-// ../circle-ir/dist/analysis/constant-propagation/index.js
+// node_modules/circle-ir/dist/analysis/constant-propagation/index.js
 function analyzeConstantPropagation(tree, sourceCode, options = {}) {
   const propagator = new ConstantPropagator;
   return propagator.analyze(tree, sourceCode, options.additionalTaintPatterns ?? [], options.sanitizerMethods ?? [], options.taintedParameters ?? []);
@@ -20397,7 +20483,7 @@ function normalizeCondition(cond) {
   }
   return normalized;
 }
-// ../circle-ir/dist/utils/logger.js
+// node_modules/circle-ir/dist/utils/logger.js
 var LOG_LEVELS = {
   trace: 0,
   debug: 1,
@@ -20469,7 +20555,7 @@ var logger = {
   }
 };
 
-// ../circle-ir/dist/analysis/per-file-finding-cap.js
+// node_modules/circle-ir/dist/analysis/per-file-finding-cap.js
 var DEFAULT_PER_FILE_FINDING_CAP = 1000;
 var SATURATED_FILE_RULE_ID = "saturated-file";
 function applyPerFileFindingCap(filePath, findings, cap) {
@@ -20505,7 +20591,7 @@ function applyPerFileFindingCap(filePath, findings, cap) {
   return [advisory];
 }
 
-// ../circle-ir/dist/analysis/confidence-filter.js
+// node_modules/circle-ir/dist/analysis/confidence-filter.js
 function applyConfidenceFilter(findings, includeSpeculative) {
   if (includeSpeculative)
     return findings;
@@ -20515,7 +20601,7 @@ function isHighConfidence(finding) {
   return finding.confidence === undefined || finding.confidence === "high";
 }
 
-// ../circle-ir/dist/analysis/library-api-surface-downgrade.js
+// node_modules/circle-ir/dist/analysis/library-api-surface-downgrade.js
 var LIBRARY_API_SURFACE_TAG = "library-api-surface:caller-responsibility";
 function applyLibraryApiSurfaceDowngrade(findings) {
   return findings.map((f) => {
@@ -20532,7 +20618,7 @@ function applyLibraryApiSurfaceDowngrade(findings) {
   });
 }
 
-// ../circle-ir/dist/analysis/note-coalescer.js
+// node_modules/circle-ir/dist/analysis/note-coalescer.js
 var CLICKJACKING_PAIR = new Set(["missing-x-frame-options", "missing-csp-frame-ancestors"]);
 function levelRank(level) {
   return level === "error" ? 0 : level === "warning" ? 1 : 2;
@@ -20596,7 +20682,7 @@ function coalesceNoteLevelFindings(findings) {
   return out2;
 }
 
-// ../circle-ir/dist/analysis/entry-point-detection.js
+// node_modules/circle-ir/dist/analysis/entry-point-detection.js
 var TIER_1_METHOD_ANNOTATIONS = new Set([
   "RequestMapping",
   "GetMapping",
@@ -21253,7 +21339,7 @@ function methodIsRuntimeRegistrationHandler(method, regs) {
   return false;
 }
 
-// ../circle-ir/dist/analysis/require-entry-path.js
+// node_modules/circle-ir/dist/analysis/require-entry-path.js
 var RULE_ID_REQUIRE_ENTRY_PATH = "require-entry-path";
 var MAX_VISITED_METHODS = 2000;
 var TAINT_FLOW_RULE_IDS = new Set([
@@ -21642,7 +21728,7 @@ function normalizeDisabled(input) {
   return new Set(input);
 }
 
-// ../circle-ir/dist/analysis/project-profile-transform.js
+// node_modules/circle-ir/dist/analysis/project-profile-transform.js
 var DOWNGRADE_ELIGIBLE_RULE_IDS = new Set([
   "code_injection",
   "template_injection",
@@ -21704,7 +21790,7 @@ function applyProjectProfileTransform(findings, resolveProfile) {
   });
 }
 
-// ../circle-ir/dist/languages/registry.js
+// node_modules/circle-ir/dist/languages/registry.js
 class DefaultLanguageRegistry {
   plugins = new Map;
   extensionMap = new Map;
@@ -21751,7 +21837,7 @@ function registerLanguage(plugin) {
 function getLanguagePlugin(language) {
   return getLanguageRegistry().get(language);
 }
-// ../circle-ir/dist/languages/plugins/base.js
+// node_modules/circle-ir/dist/languages/plugins/base.js
 class BaseLanguagePlugin {
   parser = null;
   async initialize(parser) {
@@ -21812,7 +21898,7 @@ class BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/java.js
+// node_modules/circle-ir/dist/languages/plugins/java.js
 class JavaPlugin extends BaseLanguagePlugin {
   id = "java";
   name = "Java";
@@ -22069,7 +22155,7 @@ class JavaPlugin extends BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/javascript.js
+// node_modules/circle-ir/dist/languages/plugins/javascript.js
 class JavaScriptPlugin extends BaseLanguagePlugin {
   id = "javascript";
   name = "JavaScript/TypeScript";
@@ -22735,7 +22821,7 @@ class JavaScriptPlugin extends BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/python.js
+// node_modules/circle-ir/dist/languages/plugins/python.js
 class PythonPlugin extends BaseLanguagePlugin {
   id = "python";
   name = "Python";
@@ -23011,7 +23097,7 @@ class PythonPlugin extends BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/rust.js
+// node_modules/circle-ir/dist/languages/plugins/rust.js
 class RustPlugin extends BaseLanguagePlugin {
   id = "rust";
   name = "Rust";
@@ -23170,13 +23256,6 @@ class RustPlugin extends BaseLanguagePlugin {
         severity: "high",
         argPositions: [0]
       },
-      {
-        method: "format!",
-        type: "format_string",
-        cwe: "CWE-134",
-        severity: "medium",
-        argPositions: [0]
-      },
       {
         method: "from_raw_parts",
         type: "unsafe_memory",
@@ -23251,7 +23330,7 @@ class RustPlugin extends BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/bash.js
+// node_modules/circle-ir/dist/languages/plugins/bash.js
 class BashPlugin extends BaseLanguagePlugin {
   id = "bash";
   name = "Bash/Shell";
@@ -23457,7 +23536,7 @@ class BashPlugin extends BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/html.js
+// node_modules/circle-ir/dist/languages/plugins/html.js
 class HtmlPlugin extends BaseLanguagePlugin {
   id = "html";
   name = "HTML";
@@ -23522,7 +23601,7 @@ class HtmlPlugin extends BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/vue.js
+// node_modules/circle-ir/dist/languages/plugins/vue.js
 class VuePlugin extends BaseLanguagePlugin {
   id = "vue";
   name = "Vue";
@@ -23587,7 +23666,7 @@ class VuePlugin extends BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/go.js
+// node_modules/circle-ir/dist/languages/plugins/go.js
 class GoPlugin extends BaseLanguagePlugin {
   id = "go";
   name = "Go";
@@ -24236,7 +24315,7 @@ class GoPlugin extends BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/csharp.js
+// node_modules/circle-ir/dist/languages/plugins/csharp.js
 class CSharpPlugin extends BaseLanguagePlugin {
   id = "csharp";
   name = "C#";
@@ -24295,7 +24374,7 @@ class CSharpPlugin extends BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/index.js
+// node_modules/circle-ir/dist/languages/plugins/index.js
 function registerBuiltinPlugins() {
   registerLanguage(new JavaPlugin);
   registerLanguage(new JavaScriptPlugin);
@@ -24307,7 +24386,7 @@ function registerBuiltinPlugins() {
   registerLanguage(new GoPlugin);
   registerLanguage(new CSharpPlugin);
 }
-// ../circle-ir/dist/analysis/passes/cross-file-pass.js
+// node_modules/circle-ir/dist/analysis/passes/cross-file-pass.js
 class CrossFilePass {
   run(projectGraph, sourceLines, options = {}) {
     const resolver = projectGraph.resolver;
@@ -24633,7 +24712,7 @@ function findCrossInstanceAliasingPaths(projectGraph, _sourceLines) {
   return paths;
 }
 
-// ../circle-ir/dist/analysis/html/html-extractor.js
+// node_modules/circle-ir/dist/analysis/html/html-extractor.js
 var EVENT_HANDLER_ATTRS = new Set([
   "onclick",
   "ondblclick",
@@ -24788,7 +24867,7 @@ function stripQuotes2(text) {
   return text;
 }
 
-// ../circle-ir/dist/analysis/html/html-attribute-security-pass.js
+// node_modules/circle-ir/dist/analysis/html/html-attribute-security-pass.js
 function runHtmlAttributeSecurityChecks(rootNode, filePath) {
   const findings = [];
   walkForSecurityChecks(rootNode, filePath, findings);
@@ -25014,7 +25093,7 @@ function truncate(s, maxLen) {
   return s.length > maxLen ? s.slice(0, maxLen) + "..." : s;
 }
 
-// ../circle-ir/dist/analysis/html/vue-template-xss-pass.js
+// node_modules/circle-ir/dist/analysis/html/vue-template-xss-pass.js
 var DANGEROUS_BINDINGS = new Set([
   "v-html",
   "v-bind:innerhtml",
@@ -25134,7 +25213,7 @@ function collectTaintedNames(blocks) {
   return names;
 }
 
-// ../circle-ir/dist/analysis/html/html-merge.js
+// node_modules/circle-ir/dist/analysis/html/html-merge.js
 function mergeHtmlResults(htmlMeta, scriptResults, attributeFindings) {
   const allTypes = [];
   const allCalls = [];
@@ -25284,7 +25363,7 @@ function mergeHtmlResults(htmlMeta, scriptResults, attributeFindings) {
   };
 }
 
-// ../circle-ir/dist/analysis/passes/taint-matcher-pass.js
+// node_modules/circle-ir/dist/analysis/passes/taint-matcher-pass.js
 class TaintMatcherPass {
   name = "taint-matcher";
   category = "security";
@@ -25345,7 +25424,7 @@ class TaintMatcherPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/constant-propagation-pass.js
+// node_modules/circle-ir/dist/analysis/passes/constant-propagation-pass.js
 class ConstantPropagationPass {
   tree;
   name = "constant-propagation";
@@ -25375,7 +25454,7 @@ class ConstantPropagationPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/language-sources-pass.js
+// node_modules/circle-ir/dist/analysis/passes/language-sources-pass.js
 var JS_DOM_XSS_SINKS = [
   { pattern: /\.innerHTML\s*=/, type: "xss", cwe: "CWE-79", severity: "critical" },
   { pattern: /\.outerHTML\s*=/, type: "xss", cwe: "CWE-79", severity: "critical" },
@@ -26134,12 +26213,21 @@ function findCSharpRequestSources(sourceCode, language) {
   const requestReadRe = /\bRequest\s*\.\s*(?:Query|Form|Headers|Cookies|QueryString|RouteValues|Body|Files|Params)\b/;
   const consoleReadRe = /\bConsole\s*\.\s*ReadLine\s*\(/;
   const envReadRe = /\bEnvironment\s*\.\s*GetEnvironmentVariables?\s*(?:\(|\[)/;
+  const formFileParams = new Set;
+  const formFileDeclRe = /\bIFormFile\s+([A-Za-z_]\w*)/g;
+  for (const line of lines) {
+    const re = new RegExp(formFileDeclRe.source, "g");
+    let d;
+    while ((d = re.exec(line)) !== null)
+      formFileParams.add(d[1]);
+  }
+  const formFileReadRe = formFileParams.size > 0 ? new RegExp(`\\b(?:${[...formFileParams].join("|")})\\s*\\.\\s*(?:FileName|ContentType)\\b`) : null;
   for (let i2 = 0;i2 < lines.length; i2++) {
     const m = assignRe.exec(lines[i2]);
     if (!m)
       continue;
     const [, varName, rhs] = m;
-    const type = requestReadRe.test(rhs) ? "http_param" : consoleReadRe.test(rhs) ? "io_input" : envReadRe.test(rhs) ? "env_input" : null;
+    const type = requestReadRe.test(rhs) ? "http_param" : formFileReadRe?.test(rhs) ? "http_param" : consoleReadRe.test(rhs) ? "io_input" : envReadRe.test(rhs) ? "env_input" : null;
     if (!type)
       continue;
     const lineNumber = i2 + 1;
@@ -32423,7 +32511,7 @@ function findJsTemplateInjectionSstiFindings(code, file) {
   return findings;
 }
 
-// ../circle-ir/dist/analysis/passes/source-semantics-pass.js
+// node_modules/circle-ir/dist/analysis/passes/source-semantics-pass.js
 var DEMO_PATH_RE = /(?:^|\/)(?:demo|example|examples|samples|integration-tests|integration_tests)(?:\/|$)/i;
 var CONST_STRING_ASSIGN_RE = /^\s*(?:final\s+|static\s+final\s+)?[A-Za-z_][\w.<>\[\]]*\s+[A-Za-z_]\w*\s*=\s*"[^"]*"\s*;?\s*$/;
 var STATIC_FINAL_RE = /^\s*(?:public\s+|private\s+|protected\s+)?static\s+final\s+/;
@@ -32511,7 +32599,7 @@ class SourceSemanticsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/library-profile-source-gate-pass.js
+// node_modules/circle-ir/dist/analysis/passes/library-profile-source-gate-pass.js
 var SPECULATIVE_SOURCE_TYPES = new Set([
   "interprocedural_param",
   "constructor_field"
@@ -32566,7 +32654,7 @@ class LibraryProfileSourceGatePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/mybatis-annotation-sql-sink-pass.js
+// node_modules/circle-ir/dist/analysis/passes/mybatis-annotation-sql-sink-pass.js
 var MYBATIS_SQL_ANNOTATIONS = new Set([
   "Select",
   "Update",
@@ -32793,7 +32881,7 @@ class MyBatisAnnotationSqlSinkPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/sink-filter-pass.js
+// node_modules/circle-ir/dist/analysis/passes/sink-filter-pass.js
 function escapeReSf(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -34597,7 +34685,7 @@ function isXPathQuoteEscapedOnLine(lineText, varName) {
   return seen > 0;
 }
 
-// ../circle-ir/dist/analysis/passes/sink-semantics-pass.js
+// node_modules/circle-ir/dist/analysis/passes/sink-semantics-pass.js
 function buildRegistry(entries) {
   const registry = new Map;
   for (const entry of entries) {
@@ -34645,7 +34733,7 @@ class SinkSemanticsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/dependency-versions.js
+// node_modules/circle-ir/dist/analysis/dependency-versions.js
 function resolveFastjsonFromPom(pomXml) {
   if (!pomXml)
     return null;
@@ -34823,7 +34911,7 @@ function fileConfiguresSnakeYamlSafely(source) {
   return false;
 }
 
-// ../circle-ir/dist/analysis/passes/deserialization-safety-gate-pass.js
+// node_modules/circle-ir/dist/analysis/passes/deserialization-safety-gate-pass.js
 var FASTJSON_METHODS = new Set(["parseObject", "parse"]);
 var FASTJSON_CLASSES = new Set(["JSON", "JSONObject"]);
 var JACKSON_METHODS = new Set(["readValue", "convertValue", "treeToValue"]);
@@ -34900,7 +34988,7 @@ class DeserializationSafetyGatePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/prompt-injection-safety-gate-pass.js
+// node_modules/circle-ir/dist/analysis/passes/prompt-injection-safety-gate-pass.js
 function isDelimiterLiteral(lit) {
   const s = lit.trim();
   if (s.length === 0)
@@ -35143,7 +35231,7 @@ class PromptInjectionSafetyGatePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/speculative-prompt-param-source-pass.js
+// node_modules/circle-ir/dist/analysis/passes/speculative-prompt-param-source-pass.js
 function returnOrAssignRhs(text) {
   const t = text.trim();
   const ret = t.match(/^return\s+(.+?);?$/);
@@ -35269,7 +35357,7 @@ class SpeculativePromptParamSourcePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/cli-main-reflection-suppress-pass.js
+// node_modules/circle-ir/dist/analysis/passes/cli-main-reflection-suppress-pass.js
 var REFLECTION_SINK_METHODS = new Set([
   "forName",
   "newInstance",
@@ -35457,7 +35545,7 @@ class CliMainReflectionSuppressPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/library-profile-sink-gate-pass.js
+// node_modules/circle-ir/dist/analysis/passes/library-profile-sink-gate-pass.js
 var DROPPED_SINK_TYPES = new Set([
   "log_injection"
 ]);
@@ -35563,7 +35651,7 @@ class LibraryProfileCwe22PathGatePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/library-profile-xss-gate-pass.js
+// node_modules/circle-ir/dist/analysis/passes/library-profile-xss-gate-pass.js
 var XSS_NON_HTML_OUTPUT_CLASSES = new Set([
   "StringBuilder",
   "StringBuffer",
@@ -35644,7 +35732,7 @@ class LibraryProfileXssGatePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/taint-propagation-pass.js
+// node_modules/circle-ir/dist/analysis/passes/taint-propagation-pass.js
 class TaintPropagationPass {
   name = "taint-propagation";
   category = "security";
@@ -36874,7 +36962,7 @@ function pickScopedSource(sources, sinkLine, methodName, types, taintedVar) {
   return sources[0];
 }
 
-// ../circle-ir/dist/analysis/interprocedural.js
+// node_modules/circle-ir/dist/analysis/interprocedural.js
 function analyzeInterprocedural2(graphOrTypes, callsOrSources, dfgOrSinks, sourcesOrSanitizers, sinksOrOptions, sanitizersArg, optionsArg = {}) {
   let graph;
   let sources;
@@ -37388,7 +37476,7 @@ function findTaintBridges2(result) {
   return bridges;
 }
 
-// ../circle-ir/dist/analysis/passes/interprocedural-pass.js
+// node_modules/circle-ir/dist/analysis/passes/interprocedural-pass.js
 class InterproceduralPass {
   name = "interprocedural";
   category = "security";
@@ -37594,7 +37682,7 @@ class InterproceduralPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/dead-code-pass.js
+// node_modules/circle-ir/dist/analysis/passes/dead-code-pass.js
 class DeadCodePass {
   name = "dead-code";
   category = "reliability";
@@ -37670,7 +37758,7 @@ class DeadCodePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/missing-await-pass.js
+// node_modules/circle-ir/dist/analysis/passes/missing-await-pass.js
 var ASYNC_METHODS = new Set([
   "readFile",
   "writeFile",
@@ -37749,7 +37837,7 @@ class MissingAwaitPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/n-plus-one-pass.js
+// node_modules/circle-ir/dist/analysis/passes/n-plus-one-pass.js
 var HIGH_CONFIDENCE_DB_METHODS = new Set([
   "executeQuery",
   "executeUpdate",
@@ -37872,7 +37960,7 @@ class NPlusOnePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/missing-public-doc-pass.js
+// node_modules/circle-ir/dist/analysis/passes/missing-public-doc-pass.js
 var TEST_PATH_RE = /[/._](test|tests|spec|specs|__tests?__|__mocks?__)[/._]/i;
 var UTIL_DIR_RE = /[/](utils?|helpers?|internal|private|common|shared)[/]/i;
 function hasDocCommentBefore(lines, startLine) {
@@ -37979,7 +38067,7 @@ class MissingPublicDocPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/todo-in-prod-pass.js
+// node_modules/circle-ir/dist/analysis/passes/todo-in-prod-pass.js
 var TEST_PATH_RE2 = /[/._](test|tests|spec|specs|__tests?__|__mocks?__)[/._]/i;
 var MARKER_RE = /(?:\/\/|#|--|^\s*\*)\s*(TODO|FIXME|HACK|XXX)\b/i;
 function markerSeverity(marker) {
@@ -38025,7 +38113,7 @@ class TodoInProdPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/string-concat-loop-pass.js
+// node_modules/circle-ir/dist/analysis/passes/string-concat-loop-pass.js
 var CONCAT_RE = /\b([a-zA-Z_$][a-zA-Z0-9_$]*)\s*\+=/;
 var NUMERIC_VAR_RE = /^(i|j|k|n|m|x|y|z|count|sum|total|size|index|len|length|num|idx|score|counter|offset|pos|col|row|result|ret|value|acc|bits|byte|bytes|flag|flags|step|delta|diff|dist|min|max|avg|mean|page|line|err|error)$/i;
 var NUMERIC_SUFFIX_RE = /(Count|Sum|Total|Size|Index|Length|Offset|Position|Score|Counter|Num|Amount|Val|Idx|Len|Max|Min|Avg|Delta|Diff|Step|Flag|Flags|Bits|Byte|Bytes|Calls|Items|Nodes|Edges|Blocks|Lines|Chars|Entries|Records|Rows)$/;
@@ -38088,7 +38176,7 @@ class StringConcatLoopPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/sync-io-async-pass.js
+// node_modules/circle-ir/dist/analysis/passes/sync-io-async-pass.js
 var BLOCKING_METHODS = new Set([
   "sleep"
 ]);
@@ -38149,7 +38237,7 @@ class SyncIoAsyncPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/unchecked-return-pass.js
+// node_modules/circle-ir/dist/analysis/passes/unchecked-return-pass.js
 var MUST_CHECK_HIGH = new Set([
   "createNewFile",
   "mkdir",
@@ -38222,7 +38310,7 @@ class UncheckedReturnPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/null-deref-pass.js
+// node_modules/circle-ir/dist/analysis/passes/null-deref-pass.js
 var NULL_EXPR_RE = /^\s*(null|None|undefined)\s*$/;
 function escRe(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -38304,7 +38392,7 @@ class NullDerefPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/resource-leak-pass.js
+// node_modules/circle-ir/dist/analysis/passes/resource-leak-pass.js
 function escapeRegex2(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -38581,7 +38669,7 @@ class ResourceLeakPass {
   }
 }
 
-// ../circle-ir/dist/graph/scope-graph.js
+// node_modules/circle-ir/dist/graph/scope-graph.js
 function hasDeclKeyword(lineText, language) {
   switch (language) {
     case "java":
@@ -38621,7 +38709,7 @@ class ScopeGraph {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/variable-shadowing-pass.js
+// node_modules/circle-ir/dist/analysis/passes/variable-shadowing-pass.js
 var SKIP_NAMES = new Set([
   "let",
   "const",
@@ -38779,7 +38867,7 @@ class VariableShadowingPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/leaked-global-pass.js
+// node_modules/circle-ir/dist/analysis/passes/leaked-global-pass.js
 var SKIP_NAMES2 = new Set([
   "_",
   "e",
@@ -38866,7 +38954,7 @@ class LeakedGlobalPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/unused-variable-pass.js
+// node_modules/circle-ir/dist/analysis/passes/unused-variable-pass.js
 var SKIP_NAMES3 = new Set([
   "_",
   "unused",
@@ -39011,7 +39099,7 @@ class UnusedVariablePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/dependency-fan-out-pass.js
+// node_modules/circle-ir/dist/analysis/passes/dependency-fan-out-pass.js
 var DEFAULT_THRESHOLD = 20;
 
 class DependencyFanOutPass {
@@ -39043,7 +39131,7 @@ class DependencyFanOutPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/stale-doc-ref-pass.js
+// node_modules/circle-ir/dist/analysis/passes/stale-doc-ref-pass.js
 var DOC_BLOCK_RE = /\/\*\*([\s\S]*?)\*\//g;
 var LINK_RE = /\{@link\s+([\w.#]+)/g;
 var SEE_RE = /@see\s+([\w.#]+)/g;
@@ -39122,7 +39210,7 @@ class StaleDocRefPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/infinite-loop-pass.js
+// node_modules/circle-ir/dist/analysis/passes/infinite-loop-pass.js
 var EXIT_KEYWORDS = /\b(return|throw|raise|break|System\.exit|process\.exit|os\._exit|exit!\()\b/;
 var ITERATOR_LOOP_PATTERNS = [
   /\bfor\s*\([^)]*\s+of\s+/,
@@ -39241,7 +39329,7 @@ class InfiniteLoopPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/deep-inheritance-pass.js
+// node_modules/circle-ir/dist/analysis/passes/deep-inheritance-pass.js
 var DEPTH_THRESHOLD = 5;
 var CYCLE_GUARD = 20;
 
@@ -39304,7 +39392,7 @@ class DeepInheritancePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/redundant-loop-pass.js
+// node_modules/circle-ir/dist/analysis/passes/redundant-loop-pass.js
 var LENGTH_PATTERN = /\b([A-Za-z_$][A-Za-z0-9_$]*)\s*\.\s*(?:length|size\(\)|count\(\))/g;
 var LENGTH_PATTERN_METHODS = /\b([A-Za-z_$][A-Za-z0-9_$]*)\s*\.\s*(?:size\(\)|count\(\))/g;
 var OBJECT_STATIC_PATTERN = /\bObject\s*\.\s*(?:keys|values|entries)\s*\(\s*([A-Za-z_$][A-Za-z0-9_$]*)\s*\)/g;
@@ -39427,7 +39515,7 @@ class RedundantLoopPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/unbounded-collection-pass.js
+// node_modules/circle-ir/dist/analysis/passes/unbounded-collection-pass.js
 var GROW_METHODS = {
   java: new Set(["add", "put", "offer", "push", "addAll", "addFirst", "addLast", "enqueue", "insert"]),
   javascript: new Set(["push", "set", "add", "unshift", "append", "prepend"]),
@@ -39551,7 +39639,7 @@ class UnboundedCollectionPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/serial-await-pass.js
+// node_modules/circle-ir/dist/analysis/passes/serial-await-pass.js
 var AWAIT_ASSIGN_RE = /(?:const|let|var)?\s*(\w+)\s*=\s*await\s/;
 var AWAIT_RE = /\bawait\s/;
 
@@ -39647,7 +39735,7 @@ class SerialAwaitPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/react-inline-jsx-pass.js
+// node_modules/circle-ir/dist/analysis/passes/react-inline-jsx-pass.js
 var JSX_COMPONENT_RE = /<[A-Z][A-Za-z0-9]*/;
 var INLINE_OBJECT_RE = /\s([A-Za-z][A-Za-z0-9_]*)=\{\{/g;
 var INLINE_ARROW_RE = /\s([A-Za-z][A-Za-z0-9_]*)=\{(?:\(|[A-Za-z_$]).*?=>/g;
@@ -39751,7 +39839,7 @@ class ReactInlineJsxPass {
   }
 }
 
-// ../circle-ir/dist/graph/exception-flow-graph.js
+// node_modules/circle-ir/dist/graph/exception-flow-graph.js
 class ExceptionFlowGraph2 {
   pairs;
   catchEntryIds;
@@ -39802,7 +39890,7 @@ class ExceptionFlowGraph2 {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/swallowed-exception-pass.js
+// node_modules/circle-ir/dist/analysis/passes/swallowed-exception-pass.js
 var MEANINGFUL_ACTION_RE = /\b(throw|raise|log|logger|console\.(error|warn|log|debug|info)|System\.(out|err)\.|print(?:ln|f)?|warn|error|debug|info|fatal|LOGGER|LOG|logging\.(warning|error|debug|info|critical))\b|\breturn\s+\S/;
 
 class SwallowedExceptionPass {
@@ -39900,7 +39988,7 @@ class SwallowedExceptionPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/broad-catch-pass.js
+// node_modules/circle-ir/dist/analysis/passes/broad-catch-pass.js
 var JAVA_BROAD_RE = /catch\s*\(\s*(Exception|Throwable|RuntimeException|Error)\s/;
 var PYTHON_BROAD_RE = /^\s*except\s*:|except\s+(Exception|BaseException)\b/;
 
@@ -39956,7 +40044,7 @@ class BroadCatchPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/unhandled-exception-pass.js
+// node_modules/circle-ir/dist/analysis/passes/unhandled-exception-pass.js
 var JS_THROW_RE = /^\s*throw\s+/;
 var PYTHON_RAISE_RE = /^\s*raise\b/;
 function isValidationThrow(lines, throwLine) {
@@ -40126,7 +40214,7 @@ class UnhandledExceptionPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/double-close-pass.js
+// node_modules/circle-ir/dist/analysis/passes/double-close-pass.js
 var RESOURCE_CTORS2 = new Set([
   "FileInputStream",
   "FileOutputStream",
@@ -40241,7 +40329,7 @@ class DoubleClosePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/use-after-close-pass.js
+// node_modules/circle-ir/dist/analysis/passes/use-after-close-pass.js
 var RESOURCE_CTORS3 = new Set([
   "FileInputStream",
   "FileOutputStream",
@@ -40349,7 +40437,7 @@ class UseAfterClosePass {
   }
 }
 
-// ../circle-ir/dist/graph/dominator-graph.js
+// node_modules/circle-ir/dist/graph/dominator-graph.js
 function computeRPO(cfg, entryId) {
   const outgoing = new Map;
   for (const edge of cfg.edges) {
@@ -40514,7 +40602,7 @@ class DominatorGraph2 {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/cleanup-verify-pass.js
+// node_modules/circle-ir/dist/analysis/passes/cleanup-verify-pass.js
 var RESOURCE_CTORS4 = new Set([
   "FileInputStream",
   "FileOutputStream",
@@ -40639,7 +40727,7 @@ class CleanupVerifyPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/missing-override-pass.js
+// node_modules/circle-ir/dist/analysis/passes/missing-override-pass.js
 class MissingOverridePass {
   name = "missing-override";
   category = "maintainability";
@@ -40726,7 +40814,7 @@ class MissingOverridePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/unused-interface-method-pass.js
+// node_modules/circle-ir/dist/analysis/passes/unused-interface-method-pass.js
 class UnusedInterfaceMethodPass {
   name = "unused-interface-method";
   category = "maintainability";
@@ -40769,7 +40857,7 @@ class UnusedInterfaceMethodPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/blocking-main-thread-pass.js
+// node_modules/circle-ir/dist/analysis/passes/blocking-main-thread-pass.js
 var HTTP_DECORATORS = new Set([
   "Get",
   "Post",
@@ -40872,7 +40960,7 @@ class BlockingMainThreadPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/excessive-allocation-pass.js
+// node_modules/circle-ir/dist/analysis/passes/excessive-allocation-pass.js
 var ALLOC_PATTERNS = {
   javascript: /\bnew\s+(Array|Map|Set|Object|WeakMap|WeakSet|Error|RegExp|Date|Buffer|Uint8Array|Int8Array|Float32Array|ArrayBuffer)\s*[(<]|\bArray\.from\s*\(|\bstructuredClone\s*\(|\bObject\.create\s*\(/,
   typescript: /\bnew\s+(Array|Map|Set|Object|WeakMap|WeakSet|Error|RegExp|Date|Buffer|Uint8Array|Int8Array|Float32Array|ArrayBuffer)\s*[(<]|\bArray\.from\s*\(|\bstructuredClone\s*\(|\bObject\.create\s*\(/,
@@ -40939,7 +41027,7 @@ class ExcessiveAllocationPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/missing-stream-pass.js
+// node_modules/circle-ir/dist/analysis/passes/missing-stream-pass.js
 var JS_WHOLE_LOAD_RE = /\b(?:readFileSync|fs\.readFile\b|response\.text\b|response\.json\b|res\.text\b|res\.json\b|body\.text\b|body\.json\b)\s*\(/;
 var JS_STREAM_RE = /\.pipe\s*\(|\.on\s*\(\s*['"]data['"]|for\s+await\s*\(|\bcreateReadStream\b|\bstream\b/i;
 var JAVA_WHOLE_READ_RE = /\bFiles\.readAllBytes\s*\(|\bFiles\.readAllLines\s*\(|\bFiles\.readString\s*\(|\bnew\s+BufferedReader\s*\(|\bFileInputStream\b/;
@@ -41086,7 +41174,7 @@ class MissingStreamPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/god-class-pass.js
+// node_modules/circle-ir/dist/analysis/passes/god-class-pass.js
 var WMC_THRESHOLD = 47;
 var LCOM2_THRESHOLD = 0.8;
 var CBO_THRESHOLD = 14;
@@ -41252,7 +41340,7 @@ class GodClassPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/naming-convention-pass.js
+// node_modules/circle-ir/dist/analysis/passes/naming-convention-pass.js
 var PASCAL_CASE_RE = /^[A-Z][A-Za-z0-9]*$/;
 var CAMEL_CASE_RE = /^[a-z][a-zA-Z0-9]*$/;
 var SNAKE_CASE_RE = /^[a-z_][a-z0-9_]*$/;
@@ -41392,7 +41480,7 @@ class NamingConventionPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/security-headers-pass.js
+// node_modules/circle-ir/dist/analysis/passes/security-headers-pass.js
 var HEADER_WRITE_METHODS = new Set([
   "setHeader",
   "addHeader",
@@ -41853,7 +41941,7 @@ function mapReturnValueToCorsRule(returnValue) {
   };
 }
 
-// ../circle-ir/dist/analysis/passes/_fp-allowlists.js
+// node_modules/circle-ir/dist/analysis/passes/_fp-allowlists.js
 var PEM_BODY_RE = /[A-Za-z0-9+/]{30,}/;
 function pemHasInlineBody(lines, hitLineIdx) {
   const end = Math.min(hitLineIdx + 5, lines.length);
@@ -41880,7 +41968,7 @@ function isProtocolMandatedCryptoFile(file, code) {
   return false;
 }
 
-// ../circle-ir/dist/analysis/passes/scan-secrets-pass.js
+// node_modules/circle-ir/dist/analysis/passes/scan-secrets-pass.js
 function applyDemoDowngrade(demoPath, severity, level) {
   if (!demoPath)
     return { severity, level };
@@ -42458,7 +42546,7 @@ class ScanSecretsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/python-receiver-taint-format-pass.js
+// node_modules/circle-ir/dist/analysis/passes/python-receiver-taint-format-pass.js
 class PythonReceiverTaintFormatPass {
   name = "python-receiver-taint-format";
   category = "security";
@@ -42510,7 +42598,7 @@ class PythonReceiverTaintFormatPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/spring4shell-pass.js
+// node_modules/circle-ir/dist/analysis/passes/spring4shell-pass.js
 var CONTROLLER_ANNOTATIONS = new Set([
   "Controller",
   "RestController",
@@ -42718,7 +42806,7 @@ function isPotentialPojo(type) {
   return first >= 65 && first <= 90;
 }
 
-// ../circle-ir/dist/analysis/passes/insecure-cookie-pass.js
+// node_modules/circle-ir/dist/analysis/passes/insecure-cookie-pass.js
 var COOKIE_RESPONSE_RECEIVERS = new Set([
   "res",
   "response",
@@ -42954,7 +43042,7 @@ class InsecureCookiePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/weak-hash-pass.js
+// node_modules/circle-ir/dist/analysis/passes/weak-hash-pass.js
 var WEAK_HASH_NAMES = new Set([
   "md2",
   "md4",
@@ -43174,7 +43262,7 @@ class WeakHashPass {
   }
 }
 
-// ../circle-ir/dist/analysis/path-classification.js
+// node_modules/circle-ir/dist/analysis/path-classification.js
 var TEST_PATH_PATTERNS = [
   /(^|\/)test\//i,
   /(^|\/)tests\//i,
@@ -43211,7 +43299,7 @@ function isTestPath(filepath) {
   return false;
 }
 
-// ../circle-ir/dist/analysis/passes/weak-crypto-pass.js
+// node_modules/circle-ir/dist/analysis/passes/weak-crypto-pass.js
 var WEAK_CIPHER_BASES = new Set([
   "des",
   "3des",
@@ -43716,7 +43804,7 @@ class WeakCryptoPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/weak-random-pass.js
+// node_modules/circle-ir/dist/analysis/passes/weak-random-pass.js
 var JAVA_RANDOM_METHODS = new Set([
   "nextInt",
   "nextLong",
@@ -43889,7 +43977,7 @@ class WeakRandomPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/_credential-helpers.js
+// node_modules/circle-ir/dist/analysis/passes/_credential-helpers.js
 var CRED_KEYWORD_RE2 = /(?:password|passwd|pwd|secret|api[_-]?key|auth[_-]?token|private[_-]?key|access[_-]?key|credential)/i;
 function isCredentialIdentifier(name2) {
   if (!name2)
@@ -43982,7 +44070,7 @@ function priorHashOf(varName, priorCalls) {
   return false;
 }
 
-// ../circle-ir/dist/analysis/passes/weak-password-hash-pass.js
+// node_modules/circle-ir/dist/analysis/passes/weak-password-hash-pass.js
 var FAST_HASH_NAMES = new Set([
   "sha224",
   "sha-224",
@@ -44141,7 +44229,7 @@ class WeakPasswordHashPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/weak-password-encoding-pass.js
+// node_modules/circle-ir/dist/analysis/passes/weak-password-encoding-pass.js
 function isBasicAuthContext(call, code) {
   const line = call.location.line;
   if (line < 1)
@@ -44253,7 +44341,7 @@ class WeakPasswordEncodingPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/info-disclosure-stacktrace-pass.js
+// node_modules/circle-ir/dist/analysis/passes/info-disclosure-stacktrace-pass.js
 var RESPONSE_RECEIVER_RE = /^(res|response|w|writer|ctx|c)$/i;
 var LOGGER_RECEIVER_RE = /^(log|logger|slog|console|pino|winston|sentry)$/i;
 var RESPONSE_SEND_METHODS = new Set([
@@ -44439,7 +44527,7 @@ class InfoDisclosureStacktracePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/unrestricted-file-upload-pass.js
+// node_modules/circle-ir/dist/analysis/passes/unrestricted-file-upload-pass.js
 var UPLOAD_NAME_RE = /(?:getOriginalFilename|getSubmittedFileName|originalname|originalName|\.filename|\.Filename|FileHeader\.Filename|UploadFile)/;
 var FILE_SAFE_CALL_RE = /(?:secure_filename|FilenameUtils\.getExtension|\.lastIndexOf\(['"]\.['"]\)|ALLOWED_EXT|ALLOWED_EXTENSIONS|allowedExtensions|\bfileFilter\b|filepath\.Ext|path\.extname)/;
 function lineWindow(lines, startLine, endLine) {
@@ -44590,7 +44678,7 @@ class UnrestrictedFileUploadPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/missing-sanitizer-gate-pass.js
+// node_modules/circle-ir/dist/analysis/passes/missing-sanitizer-gate-pass.js
 var HTML_OUTPUT_SINKS = new Set([
   "addAttribute",
   "setAttribute",
@@ -44738,7 +44826,7 @@ function methodAcceptsHtmlShapedParam(method) {
   return false;
 }
 
-// ../circle-ir/dist/analysis/passes/insecure-deserialization-config-pass.js
+// node_modules/circle-ir/dist/analysis/passes/insecure-deserialization-config-pass.js
 var ANY_TYPE_PERMISSION_RE = /\bAnyTypePermission\b/;
 
 class InsecureDeserializationConfigPass {
@@ -44816,7 +44904,7 @@ class InsecureDeserializationConfigPass {
 }
 var INSECURE_TYPE_NAME_HANDLING_RE = /\bTypeNameHandling\s*=\s*(?:Newtonsoft\.Json\.)?TypeNameHandling\.(All|Auto|Objects|Arrays)\b/;
 
-// ../circle-ir/dist/analysis/passes/plaintext-password-storage-pass.js
+// node_modules/circle-ir/dist/analysis/passes/plaintext-password-storage-pass.js
 function isWriteStorageCall(call, language) {
   const method = call.method_name ?? "";
   const receiver = call.receiver ?? "";
@@ -44927,7 +45015,7 @@ class PlaintextPasswordStoragePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/cleartext-credential-transport-pass.js
+// node_modules/circle-ir/dist/analysis/passes/cleartext-credential-transport-pass.js
 var LOCALHOST_RE = /^(?:localhost|127\.0\.0\.1|0\.0\.0\.0)(?::\d+)?$/i;
 function isInsecureHttpUrl(urlLiteral) {
   if (!urlLiteral)
@@ -45055,7 +45143,7 @@ class CleartextCredentialTransportPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/tls-verify-disabled-pass.js
+// node_modules/circle-ir/dist/analysis/passes/tls-verify-disabled-pass.js
 var PY_HTTP_METHODS = new Set([
   "get",
   "post",
@@ -45268,7 +45356,7 @@ class TlsVerifyDisabledPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/module-side-effect-pass.js
+// node_modules/circle-ir/dist/analysis/passes/module-side-effect-pass.js
 var JS_EXEC_METHODS = new Set([
   "exec",
   "spawn",
@@ -45499,7 +45587,7 @@ class ModuleSideEffectPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/cache-no-vary-pass.js
+// node_modules/circle-ir/dist/analysis/passes/cache-no-vary-pass.js
 function isSharedCacheable(value) {
   const v = value.toLowerCase();
   if (/\b(private|no-store|no-cache)\b/.test(v))
@@ -45786,7 +45874,7 @@ class CacheNoVaryPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/jwt-verify-disabled-pass.js
+// node_modules/circle-ir/dist/analysis/passes/jwt-verify-disabled-pass.js
 var PY_VERIFY_SIGNATURE_FALSE_RE = /["']verify_signature["']\s*:\s*False\b/;
 var PY_VERIFY_KW_FALSE_RE = /\bverify\s*=\s*False\b/;
 var PY_ALG_NONE_RE = /\balgorithms\s*=\s*[\[\(]\s*["']none["']/i;
@@ -45911,7 +45999,7 @@ class JwtVerifyDisabledPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/csrf-protection-disabled-pass.js
+// node_modules/circle-ir/dist/analysis/passes/csrf-protection-disabled-pass.js
 var JAVA_CSRF_DISABLE_RE = /\.csrf\s*\([^)]*\)\s*\.\s*disable\b/;
 var JAVA_CSRF_LAMBDA_DISABLE_RE = /\bcsrf\s*\(\s*\w+\s*->\s*\w+\s*\.\s*disable\s*\(/;
 var JAVA_CSRF_METHODREF_RE = /\bcsrf\s*\(\s*[\w.]+::disable\s*\)/;
@@ -46047,7 +46135,7 @@ class CsrfProtectionDisabledPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/xml-entity-expansion-pass.js
+// node_modules/circle-ir/dist/analysis/passes/xml-entity-expansion-pass.js
 var JAVA_FACTORIES = new Set([
   "SAXParserFactory",
   "DocumentBuilderFactory",
@@ -46187,7 +46275,7 @@ class XmlEntityExpansionPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/mass-assignment-pass.js
+// node_modules/circle-ir/dist/analysis/passes/mass-assignment-pass.js
 var PY_KWARGS_SPLAT_RE = /\*\*\s*(?:request|self\.request|flask\.request|ctx|self)\s*\.\s*(?:form|args|values|json|get_json\s*\(\s*\)|files|data)/;
 var JS_OBJECT_SPREAD_RE = /\{\s*\.\.\.\s*(?:req|request|ctx|context)(?:\.request)?\s*\.\s*(?:body|query|params|form)\b/;
 
@@ -46271,7 +46359,7 @@ class MassAssignmentPass {
   }
 }
 
-// ../circle-ir/dist/graph/import-graph.js
+// node_modules/circle-ir/dist/graph/import-graph.js
 function dirname(filePath) {
   const idx = filePath.lastIndexOf("/");
   return idx >= 0 ? filePath.slice(0, idx) : "";
@@ -46404,7 +46492,7 @@ class ImportGraph2 {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/circular-dependency-pass.js
+// node_modules/circle-ir/dist/analysis/passes/circular-dependency-pass.js
 class CircularDependencyPass {
   run(_projectGraph, importGraph) {
     const findings = [];
@@ -46431,7 +46519,7 @@ class CircularDependencyPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/orphan-module-pass.js
+// node_modules/circle-ir/dist/analysis/passes/orphan-module-pass.js
 class OrphanModulePass {
   run(_projectGraph, importGraph) {
     const findings = [];
@@ -46455,7 +46543,7 @@ class OrphanModulePass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/passes/size-metrics-pass.js
+// node_modules/circle-ir/dist/analysis/metrics/passes/size-metrics-pass.js
 class SizeMetricsPass {
   name = "size-metrics";
   run(ctx) {
@@ -46511,7 +46599,7 @@ class SizeMetricsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/passes/complexity-metrics-pass.js
+// node_modules/circle-ir/dist/analysis/metrics/passes/complexity-metrics-pass.js
 class ComplexityMetricsPass {
   name = "complexity-metrics";
   run(ctx) {
@@ -46575,7 +46663,7 @@ class ComplexityMetricsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/passes/halstead-metrics-pass.js
+// node_modules/circle-ir/dist/analysis/metrics/passes/halstead-metrics-pass.js
 var KEYWORDS = new Set([
   "if",
   "else",
@@ -46730,7 +46818,7 @@ class HalsteadMetricsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/passes/data-flow-metrics-pass.js
+// node_modules/circle-ir/dist/analysis/metrics/passes/data-flow-metrics-pass.js
 class DataFlowMetricsPass {
   name = "data-flow-metrics";
   run(ctx) {
@@ -46748,7 +46836,7 @@ class DataFlowMetricsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/passes/coupling-metrics-pass.js
+// node_modules/circle-ir/dist/analysis/metrics/passes/coupling-metrics-pass.js
 class CouplingMetricsPass {
   name = "coupling-metrics";
   run(ctx) {
@@ -46826,7 +46914,7 @@ class CouplingMetricsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/passes/inheritance-metrics-pass.js
+// node_modules/circle-ir/dist/analysis/metrics/passes/inheritance-metrics-pass.js
 class InheritanceMetricsPass {
   name = "inheritance-metrics";
   run(ctx) {
@@ -46886,7 +46974,7 @@ class InheritanceMetricsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/passes/cohesion-metrics-pass.js
+// node_modules/circle-ir/dist/analysis/metrics/passes/cohesion-metrics-pass.js
 class CohesionMetricsPass {
   name = "cohesion-metrics";
   run(ctx) {
@@ -46969,7 +47057,7 @@ class CohesionMetricsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/passes/documentation-metrics-pass.js
+// node_modules/circle-ir/dist/analysis/metrics/passes/documentation-metrics-pass.js
 class DocumentationMetricsPass {
   name = "documentation-metrics";
   run(ctx) {
@@ -47022,7 +47110,7 @@ class DocumentationMetricsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/passes/composite-metrics-pass.js
+// node_modules/circle-ir/dist/analysis/metrics/passes/composite-metrics-pass.js
 class CompositeMetricsPass {
   name = "composite-metrics";
   run(ctx) {
@@ -47081,7 +47169,7 @@ class CompositeMetricsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/metric-runner.js
+// node_modules/circle-ir/dist/analysis/metrics/metric-runner.js
 class MetricRunner {
   passes = [
     new SizeMetricsPass,
@@ -47103,7 +47191,7 @@ class MetricRunner {
     return accumulated;
   }
 }
-// ../circle-ir/dist/analyzer.js
+// node_modules/circle-ir/dist/analyzer.js
 var initialized = false;
 async function initAnalyzer(options = {}) {
   if (initialized)
@@ -47775,7 +47863,7 @@ function deriveProjectRoot(paths) {
   }
   return common.join("/") || "/";
 }
-// ../circle-ir/dist/analysis/sbom.js
+// node_modules/circle-ir/dist/analysis/sbom.js
 function purlVersion(spec) {
   const stripped = spec.trim().replace(/^[\s^~=<>]+/, "");
   if (/^v?[0-9][\w.\-+]*$/.test(stripped))
@@ -48210,14 +48298,14 @@ function toSpdx(deps, meta = {}) {
     relationships
   };
 }
-// ../project-profile-detect/dist/index.js
-import { relative as relative3 } from "path";
+// node_modules/@cognium/project-profile-detect/dist/index.js
+import { relative as relative2 } from "path";
 
-// ../project-profile-detect/dist/walk.js
+// node_modules/@cognium/project-profile-detect/dist/walk.js
 import { readdir, readFile, stat } from "fs/promises";
-import { join, relative as relative2 } from "path";
+import { join, relative } from "path";
 
-// ../project-profile-detect/dist/maven-parse.js
+// node_modules/@cognium/project-profile-detect/dist/maven-parse.js
 var TAG = (name2) => new RegExp(`<${name2}\\b[^>]*>([\\s\\S]*?)<\\/${name2}>`, "i");
 var ALL_TAGS = (name2) => new RegExp(`<${name2}\\b[^>]*>([\\s\\S]*?)<\\/${name2}>`, "gi");
 function firstTag(xml, name2) {
@@ -48241,12 +48329,7 @@ var MAVEN_PLUGIN_MAP = {
   "exec-maven-plugin": "application",
   "maven-assembly-plugin": "application"
 };
-var MAVEN_PUBLISH_PLUGIN_URLS = {
-  "central-publishing-maven-plugin": "https://central.sonatype.com/",
-  "nexus-staging-maven-plugin": "https://oss.sonatype.org/"
-};
 function parseMavenPom(xml, moduleRoot, buildFile, directorySignals) {
-  const parentRef = extractParentRef(xml);
   const stripped = xml.replace(/<parent\b[\s\S]*?<\/parent>/i, "");
   const groupId = firstTag(stripped, "groupId");
   const artifactId = firstTag(stripped, "artifactId");
@@ -48255,15 +48338,10 @@ function parseMavenPom(xml, moduleRoot, buildFile, directorySignals) {
   const buildBlock = firstTag(xml, "build") ?? "";
   const pluginBlocks = allTags(buildBlock, "plugin");
   const plugins = new Set;
-  const publishUrls = new Set;
   for (const p of pluginBlocks) {
     const aid = firstTag(p, "artifactId");
-    if (!aid)
-      continue;
-    if (MAVEN_PLUGIN_MAP[aid])
+    if (aid && MAVEN_PLUGIN_MAP[aid])
       plugins.add(MAVEN_PLUGIN_MAP[aid]);
-    if (MAVEN_PUBLISH_PLUGIN_URLS[aid])
-      publishUrls.add(MAVEN_PUBLISH_PLUGIN_URLS[aid]);
   }
   if (/<parent\b[\s\S]*?<artifactId>\s*spring-boot-starter-parent\s*<\/artifactId>/i.test(xml)) {
     plugins.add("spring-boot");
@@ -48276,8 +48354,7 @@ function parseMavenPom(xml, moduleRoot, buildFile, directorySignals) {
     plugins.add("maven-plugin");
   const distBlock = firstTag(xml, "distributionManagement") ?? "";
   const urls = [
-    ...allTags(distBlock, "url"),
-    ...publishUrls
+    ...allTags(distBlock, "url")
   ].map((u) => u.trim()).filter(Boolean);
   const signals = {
     ...directorySignals,
@@ -48292,36 +48369,11 @@ function parseMavenPom(xml, moduleRoot, buildFile, directorySignals) {
     groupId,
     artifactId,
     version,
-    signals,
-    parentRef
+    signals
   };
 }
-function extractParentRef(xml) {
-  const block = TAG("parent").exec(xml);
-  if (!block)
-    return;
-  const inner = block[1];
-  const groupId = firstTag(inner, "groupId");
-  const artifactId = firstTag(inner, "artifactId");
-  const version = firstTag(inner, "version");
-  let relativePath;
-  let emptyRelativePath = false;
-  const selfClosing = /<relativePath\b[^>]*\/\s*>/i.test(inner);
-  if (selfClosing) {
-    emptyRelativePath = true;
-  } else {
-    const rp = firstTag(inner, "relativePath");
-    if (rp !== undefined) {
-      if (rp.length === 0)
-        emptyRelativePath = true;
-      else
-        relativePath = rp;
-    }
-  }
-  return { groupId, artifactId, version, relativePath, emptyRelativePath };
-}
 
-// ../project-profile-detect/dist/gradle-parse.js
+// node_modules/@cognium/project-profile-detect/dist/gradle-parse.js
 var GRADLE_PLUGIN_MAP = {
   "org.springframework.boot": "spring-boot",
   "io.spring.dependency-management": "spring-boot",
@@ -48386,71 +48438,7 @@ function parseGradleBuild(text, moduleRoot, buildFile, buildSystem, directorySig
   };
 }
 
-// ../project-profile-detect/dist/maven-inherit.js
-import { dirname as dirname2, isAbsolute, normalize, relative, resolve } from "path";
-var MAX_DEPTH = 6;
-var DEFAULT_RELATIVE_PATH = "../pom.xml";
-function mergeMavenInheritance(modules, scanRoot) {
-  const normalizedScanRoot = normalize(scanRoot);
-  const byBuildFile = new Map;
-  for (const m of modules) {
-    if (m.buildSystem === "maven") {
-      byBuildFile.set(normalize(m.buildFile), m);
-    }
-  }
-  for (const child of modules) {
-    if (child.buildSystem !== "maven")
-      continue;
-    if (!child.parentRef)
-      continue;
-    const inheritedUrls = new Set;
-    const inheritedPlugins = new Set;
-    walkParents(child, byBuildFile, normalizedScanRoot, inheritedUrls, inheritedPlugins);
-    if (inheritedUrls.size === 0 && inheritedPlugins.size === 0)
-      continue;
-    const existingUrls = new Set(child.signals.distributionUrls);
-    for (const u of inheritedUrls) {
-      if (!existingUrls.has(u))
-        child.signals.distributionUrls.push(u);
-    }
-    const existingPlugins = new Set(child.signals.plugins);
-    for (const p of inheritedPlugins) {
-      if (!existingPlugins.has(p))
-        child.signals.plugins.push(p);
-    }
-  }
-}
-function walkParents(start2, byBuildFile, scanRoot, outUrls, outPlugins) {
-  const visited = new Set([normalize(start2.buildFile)]);
-  let current = start2;
-  for (let depth = 0;depth < MAX_DEPTH; depth++) {
-    const ref = current.parentRef;
-    if (!ref)
-      return;
-    if (ref.emptyRelativePath)
-      return;
-    const childDir = dirname2(current.buildFile);
-    const rel = ref.relativePath ?? DEFAULT_RELATIVE_PATH;
-    const candidateAbs = normalize(isAbsolute(rel) ? rel : resolve(childDir, rel));
-    const parentBuildFile = candidateAbs.endsWith("pom.xml") ? candidateAbs : normalize(resolve(candidateAbs, "pom.xml"));
-    const relToRoot = relative(scanRoot, parentBuildFile);
-    if (relToRoot.startsWith("..") || isAbsolute(relToRoot))
-      return;
-    if (visited.has(parentBuildFile))
-      return;
-    visited.add(parentBuildFile);
-    const parent = byBuildFile.get(parentBuildFile);
-    if (!parent)
-      return;
-    for (const u of parent.signals.distributionUrls)
-      outUrls.add(u);
-    for (const p of parent.signals.plugins)
-      outPlugins.add(p);
-    current = parent;
-  }
-}
-
-// ../project-profile-detect/dist/walk.js
+// node_modules/@cognium/project-profile-detect/dist/walk.js
 var BUILD_FILES = ["pom.xml", "build.gradle", "build.gradle.kts"];
 var SKIP_DIRS = new Set([
   "node_modules",
@@ -48470,7 +48458,6 @@ var SKIP_DIRS = new Set([
 async function discoverBuildModules(scanRoot) {
   const modules = [];
   await walk(scanRoot, modules);
-  mergeMavenInheritance(modules, scanRoot);
   return modules;
 }
 async function walk(dir, out2) {
@@ -48612,7 +48599,7 @@ function ownerOf(file, modules) {
   return best;
 }
 
-// ../project-profile-detect/dist/publication-detect.js
+// node_modules/@cognium/project-profile-detect/dist/publication-detect.js
 var PUBLIC_REGISTRY_HOSTS = new Set([
   "repo.maven.apache.org",
   "repo1.maven.org",
@@ -48637,7 +48624,7 @@ function isPubliclyPublished(urls) {
   return false;
 }
 
-// ../project-profile-detect/dist/shape-resolve.js
+// node_modules/@cognium/project-profile-detect/dist/shape-resolve.js
 function resolveShape(mod) {
   const sig = mod.signals;
   const has = (tag) => sig.plugins.includes(tag);
@@ -48678,15 +48665,11 @@ function resolveShape(mod) {
     reasons.push(...libSignals, "no public-registry distribution (internal helper)");
     return { shape: "application", reasons };
   }
-  if (isPubliclyPublished(sig.distributionUrls)) {
-    reasons.push("public-registry distribution", "no application/server/plugin signals → implicit library");
-    return { shape: "library", reasons };
-  }
   reasons.push("no shape signals");
   return { shape: "unknown", reasons };
 }
 
-// ../project-profile-detect/dist/env-resolve.js
+// node_modules/@cognium/project-profile-detect/dist/env-resolve.js
 var TEST_RE = /(?:^|\/)tests?\//;
 var SAMPLE_RE = /(?:^|\/)(?:samples?|examples?|demos?|fixtures?)\//;
 var BENCHMARK_RE = /(?:^|\/)benchmarks?\//;
@@ -48704,7 +48687,7 @@ function resolveEnv(absoluteFile) {
   return "dev";
 }
 
-// ../project-profile-detect/dist/overrides.js
+// node_modules/@cognium/project-profile-detect/dist/overrides.js
 function compileGlob(glob) {
   let re = "";
   let i2 = 0;
@@ -48751,7 +48734,7 @@ function applyOverrides(relativePath, compiled) {
   return;
 }
 
-// ../project-profile-detect/dist/index.js
+// node_modules/@cognium/project-profile-detect/dist/index.js
 async function detectProjectProfiles(scanRoot, options = {}) {
   const modules = await discoverBuildModules(scanRoot);
   const files = await enumerateScanFiles(scanRoot);
@@ -48769,7 +48752,7 @@ async function detectProjectProfiles(scanRoot, options = {}) {
   const profileByFile = new Map;
   const unknownFiles = [];
   for (const file of files) {
-    const rel = relative3(scanRoot, file);
+    const rel = relative2(scanRoot, file);
     const ov = applyOverrides(rel, compiledOverrides);
     if (ov) {
       profileByFile.set(file, ov.profile);
@@ -48821,7 +48804,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.9.9";
+var version = "4.9.11";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -49374,8 +49357,8 @@ function generateSarifResults(results, crossFileData) {
 
 // src/build-info.ts
 var buildInfo = {
-  gitSha: "5c476ca",
-  builtAt: "2026-08-26T20:08:56.375Z"
+  gitSha: "6c811aa",
+  builtAt: "2026-09-10T06:22:49.258Z"
 };
 
 // src/utils/args.ts
@@ -49663,7 +49646,7 @@ function applySuppressionsToResults(results, suppressions, basePath) {
   if (suppressions.length === 0)
     return results;
   return results.map((result) => {
-    const relativeFile = relative4(basePath, result.file) || result.file;
+    const relativeFile = relative3(basePath, result.file) || result.file;
     const filteredVulns = result.vulnerabilities.filter((vuln) => {
       for (const supp of suppressions) {
         if (supp.pass !== vuln.type)
@@ -49719,6 +49702,22 @@ var LANG_MAP = {
   ".html": "html",
   ".htm": "html"
 };
+var VULN_SEVERITY_RANK = { critical: 3, high: 2, medium: 1, low: 0 };
+function dedupeVulnerabilities(vulns) {
+  const best = new Map;
+  const order = [];
+  for (const v of vulns) {
+    const key = `${v.type}:${v.line}`;
+    const current = best.get(key);
+    if (current === undefined) {
+      best.set(key, v);
+      order.push(key);
+    } else if ((VULN_SEVERITY_RANK[v.severity] ?? -1) > (VULN_SEVERITY_RANK[current.severity] ?? -1)) {
+      best.set(key, v);
+    }
+  }
+  return order.map((k) => best.get(k));
+}
 function detectLanguage7(filePath) {
   const ext = extname(filePath).toLowerCase();
   return LANG_MAP[ext] || null;
@@ -49753,7 +49752,7 @@ async function collectFiles(targetPath, options = {}) {
       return files;
     }
     if (fileMatchesLanguage(targetPath, language)) {
-      const relativePath = basePath ? relative4(basePath, targetPath) : targetPath;
+      const relativePath = basePath ? relative3(basePath, targetPath) : targetPath;
       if (includePatterns && includePatterns.length > 0) {
         if (!matchesAnyPattern(relativePath, includePatterns)) {
           return files;
@@ -49772,7 +49771,7 @@ async function collectFiles(targetPath, options = {}) {
       if (excludeTests && /^(test|tests|__tests__|spec|__mocks__)$/i.test(entry.name))
         continue;
       const fullPath = join2(targetPath, entry.name);
-      const relativePath = basePath ? relative4(basePath, fullPath) : fullPath;
+      const relativePath = basePath ? relative3(basePath, fullPath) : fullPath;
       if (excludePatterns && entry.isDirectory()) {
         const dirPattern = relativePath + "/";
         if (excludePatterns.some((p) => matchesGlob(dirPattern, p) || matchesGlob(relativePath, p))) {
@@ -49813,7 +49812,7 @@ async function scanFile(filePath, language, analyzeOpts) {
         ...finding.tags && finding.tags.length > 0 ? { tags: [...finding.tags] } : {}
       });
     }
-    return { file: filePath, vulnerabilities };
+    return { file: filePath, vulnerabilities: dedupeVulnerabilities(vulnerabilities) };
   } catch (error) {
     return {
       file: filePath,
@@ -49856,7 +49855,7 @@ async function scanProject(files, language, analyzeOpts, crossFileBudgetMs) {
         ...finding.tags && finding.tags.length > 0 ? { tags: [...finding.tags] } : {}
       });
     }
-    return { file, vulnerabilities };
+    return { file, vulnerabilities: dedupeVulnerabilities(vulnerabilities) };
   });
   return {
     results,
@@ -49870,14 +49869,14 @@ async function scanProject(files, language, analyzeOpts, crossFileBudgetMs) {
 async function initWasm(spin) {
   const isStandalone = import.meta.url.includes("/$bunfs/");
   if (isStandalone) {
-    const { dirname: dirname4, join: join3 } = await import("path");
-    const binaryDir = dirname4(process.execPath);
+    const { dirname: dirname3, join: join3 } = await import("path");
+    const binaryDir = dirname3(process.execPath);
     const cwd = process.cwd();
     let scriptDir = null;
     if (!import.meta.url.includes("/$bunfs/")) {
       try {
         const { fileURLToPath } = await import("url");
-        scriptDir = dirname4(fileURLToPath(import.meta.url));
+        scriptDir = dirname3(fileURLToPath(import.meta.url));
       } catch {}
     }
     const wasmLocations = [
@@ -49932,7 +49931,7 @@ Please ensure the wasm/ directory is located next to the binary or in your curre
   } else {
     const require2 = createRequire2(import.meta.url);
     const circleIrPkg = require2.resolve("circle-ir/package.json");
-    const wasmBasePath = join2(dirname3(circleIrPkg), "dist", "wasm") + "/";
+    const wasmBasePath = join2(dirname2(circleIrPkg), "dist", "wasm") + "/";
     await initAnalyzer({
       wasmPath: wasmBasePath + "web-tree-sitter.wasm",
       languagePaths: {
@@ -49963,7 +49962,7 @@ function buildProfileSummary(scanRoot, modules, resolvedProfiles) {
   return {
     scanRoot,
     modules: modules.map((m) => ({
-      root: relative4(scanRoot, m.module.root) || ".",
+      root: relative3(scanRoot, m.module.root) || ".",
       profile: m.profile,
       reasons: m.reasons,
       buildSystem: m.module.buildSystem
@@ -49992,9 +49991,9 @@ function printProfileExplain(scanRoot, detection) {
     out2.push("  (no pom.xml, build.gradle, or build.gradle.kts found)");
   } else {
     for (const r of detection.modules) {
-      const rel = relative4(scanRoot, r.module.root) || ".";
+      const rel = relative3(scanRoot, r.module.root) || ".";
       out2.push(`  ${colors.cyan(rel || ".")}  →  ${colors.bold(r.profile)}`);
-      out2.push(`     build: ${r.module.buildSystem}  (${relative4(scanRoot, r.module.buildFile)})`);
+      out2.push(`     build: ${r.module.buildSystem}  (${relative3(scanRoot, r.module.buildFile)})`);
       if (r.module.artifactId) {
         out2.push(`     coords: ${r.module.groupId ?? "?"}:${r.module.artifactId}:${r.module.version ?? "?"}`);
       }
@@ -50039,7 +50038,7 @@ async function runScan(targetPath, options) {
     await initWasm(spin);
     if (spin)
       spin.text = "Collecting files...";
-    const absPath = resolve2(targetPath);
+    const absPath = resolve(targetPath);
     if (!existsSync(absPath)) {
       if (spin)
         spin.fail(`Path not found: ${absPath}`);
@@ -50103,7 +50102,7 @@ async function runScan(targetPath, options) {
       results = [];
       let processed = 0;
       const formatCurrentFile = (file) => {
-        const rel = relative4(absPath, file) || file;
+        const rel = relative3(absPath, file) || file;
         return rel.length > 80 ? `...${rel.slice(-77)}` : rel;
       };
       const concurrency = options.threads;
@@ -50279,7 +50278,7 @@ async function runMetrics(targetPath, options) {
     await initWasm(spin);
     if (spin)
       spin.text = "Collecting files...";
-    const absPath = resolve2(targetPath);
+    const absPath = resolve(targetPath);
     if (!existsSync(absPath)) {
       if (spin)
         spin.fail(`Path not found: ${absPath}`);
@@ -50307,7 +50306,7 @@ async function runMetrics(targetPath, options) {
         continue;
       }
       if (spin) {
-        const rel = relative4(absPath, file) || file;
+        const rel = relative3(absPath, file) || file;
         const maxLen = 80;
         const label = rel.length > maxLen ? `...${rel.slice(-(maxLen - 3))}` : rel;
         spin.text = `Analyzing ${label}... (${processed}/${totalFiles})`;
@@ -50352,7 +50351,7 @@ async function runMetrics(targetPath, options) {
     } else {
       const lines = [];
       for (const fm of filtered) {
-        const rel = relative4(absPath, fm.file) || fm.file;
+        const rel = relative3(absPath, fm.file) || fm.file;
         lines.push(rel);
         const byCategory = new Map;
         for (const m of fm.metrics) {
@@ -50580,7 +50579,7 @@ async function collectManifestFiles(targetPath) {
   return found;
 }
 async function runSbom(targetPath, options) {
-  const absPath = resolve2(targetPath);
+  const absPath = resolve(targetPath);
   if (!existsSync(absPath)) {
     console.error(colors.red(`Error: path not found: ${targetPath}`));
     process.exit(2);
@@ -50594,9 +50593,9 @@ async function runSbom(targetPath, options) {
   for (const m of manifests) {
     const superseded = SBOM_SUPERSEDES[basename(m)];
     if (superseded)
-      supersededInDir.add(`${dirname3(m)}\x00${superseded}`);
+      supersededInDir.add(`${dirname2(m)}\x00${superseded}`);
   }
-  const effective = manifests.filter((m) => !supersededInDir.has(`${dirname3(m)}\x00${basename(m)}`));
+  const effective = manifests.filter((m) => !supersededInDir.has(`${dirname2(m)}\x00${basename(m)}`));
   let projectName = options.name;
   let projectLicense;
   {
@@ -50756,6 +50755,7 @@ export {
   loadConfig,
   isTestFile2 as isTestFile,
   detectLanguage7 as detectLanguage,
+  dedupeVulnerabilities,
   convertConfigToPassOptions,
   applySuppressionsToResults,
   PASS_REGISTRY