fullshield 2.0.1 → 2.0.2

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to FullShield are documented here.
 
+## 2.0.2 — 2026-10-26
+
+### Fixes
+
+- Phase 537: `SAST-CRLF-001` `set` fires only when the receiver is `res`, `resp`, `response`, or `reply`. `setHeader`, `append`, `header`, and `writeHead` stay. `cache.set` does not fire. Off by default.
+- Phase 538: `SAST-MAIL-001` `send` fires only on a mail client receiver (`mail`, `transporter`, `transport`, `sg`, `mg`, or a name that contains `mail`). `sendMail` stays. `res.send` does not fire. Off by default.
+- Phase 539: `SAST-FORMULA-001` `write` and `format` do not fire on `res`, `resp`, `response`, or `reply`. `stringify`, `writeToPath`, and a `.csv` `writeFile` stay. Off by default.
+
 ## 2.0.1 — 2026-10-26
 
 ### Experimental

package/README.md

@@ -1,6 +1,6 @@
 # FullShield
 
-**v2.0.1.** One install for Node.js/TypeScript backends: detect → classify → report → notify → fix → gate (CI `--fail-on` + runtime monitor). It does not stop attacks by itself.
+**v2.0.2.** One install for Node.js/TypeScript backends: detect → classify → report → notify → fix → gate (CI `--fail-on` + runtime monitor). It does not stop attacks by itself.
 
 **Headline: dependency reachability.** A lockfile CVE is not the same as an unused package. FullShield classifies each OSV hit as `reachable` (imported and called), `imported-not-called` (−1), `reachable-via-dependency` (lockfile path from an imported direct dep — **severity kept**, path shown, e.g. `express > body-parser > qs`), `not-imported` (−2, only when no such path exists), or `reachability-unknown` (severity kept) when the lockfile format has no parsed dependency edges. DevDependency-only vulns are `info` with a `dev-only` note unless production sources import the package. Pair it with `fullshield sbom --format cyclonedx`.
 
@@ -10,7 +10,7 @@ npx fullshield scan --json --fail-on high
 npx fullshield scan --sarif fullshield.sarif
 ```
 
-2.0.1 is the version of this tree. The stable contract is [docs/stability.md](docs/stability.md). The 1.0.1 release moved values that only experimental flags produce out of Stable. Experimental flags stay off unless you set them. Do not treat a scan as a penetration test. Reviewed recall for untouched apps is not published. The stored Next.js cold scan is 71.7 seconds, above the 60-second target.
+2.0.2 is the version of this tree. The stable contract is [docs/stability.md](docs/stability.md). The 1.0.1 release moved values that only experimental flags produce out of Stable. Experimental flags stay off unless you set them. Do not treat a scan as a penetration test. Reviewed recall for untouched apps is not published. The stored Next.js cold scan is 71.7 seconds, above the 60-second target.
 
 **Supported runtime is Node.js >= 22.13.** `package.json` `engines` and `doctor` enforce that floor. `node:sqlite` runs without `--experimental-sqlite` from 22.13.0 (the module is still experimental and is loaded only by history/confirm, not by `--import` register).
 
@@ -243,9 +243,9 @@ app.use(shieldGuard({ mode: 'monitor', authRoutes: ['/login'] }));
 | `scan --experimental-markup` | **Experimental** (`FULLSHIELD_EXPERIMENTAL_MARKUP=1`). `SAST-MARKUP-001`: `markdown-it` is constructed with `html: true` and `render` is called with request data, or `marked` / `marked.parse` is called with request data. The file must import that package. Literal markdown does not fire. Off by default. |
 | `scan --experimental-trust-host` | **Experimental** (`FULLSHIELD_EXPERIMENTAL_TRUSTHOST=1`). `SAST-TRUSTHOST-001`: a file that mentions `next-auth`, `@auth/`, or `NextAuth` sets `trustHost: true`. `false` or omitted does not fire. Off by default. |
 | `scan --experimental-deep` | **Experimental** (`FULLSHIELD_EXPERIMENTAL_DEEP=1`). Extra matches on the existing rules: `res.end` when the body contains HTML, `http.request` / `https.request` option objects, `Bun.file` and `fs` `glob` / `opendir`, `location`, `jwt.verify` with an empty or non-literal algorithm list, and `Object.assign` / `assign`. Off by default. Default `scan --json` is unchanged for these. |
-| `scan --experimental-crlf` | **Experimental** (`FULLSHIELD_EXPERIMENTAL_CRLF=1`). `SAST-CRLF-001`: request data used as the value of `setHeader`, `append`, `header`, `set`, or a `writeHead` header object. A literal value does not fire. A status code alone does not fire. Off by default. |
-| `scan --experimental-mail` | **Experimental** (`FULLSHIELD_EXPERIMENTAL_MAIL=1`). `SAST-MAIL-001`: `nodemailer`, `@sendgrid/mail`, or `mailgun.js` copies request data into `to`, `cc`, `bcc`, `subject`, `from`, `replyTo`, `html`, or `text`. A literal field does not fire. Off by default. |
-| `scan --experimental-formula` | **Experimental** (`FULLSHIELD_EXPERIMENTAL_FORMULA=1`). `SAST-FORMULA-001`: request data passed to `stringify`, `write`, `writeToPath`, or `format` from `csv-stringify`, `fast-csv`, `json2csv`, or `csv`, or written to a `.csv` path. A literal row does not fire. Off by default. |
+| `scan --experimental-crlf` | **Experimental** (`FULLSHIELD_EXPERIMENTAL_CRLF=1`). `SAST-CRLF-001`: request data used as the value of `setHeader`, `append`, `header`, or a `writeHead` header object. `set` fires only when the receiver is `res`, `resp`, `response`, or `reply`. A literal value does not fire. A status code alone does not fire. Off by default. |
+| `scan --experimental-mail` | **Experimental** (`FULLSHIELD_EXPERIMENTAL_MAIL=1`). `SAST-MAIL-001`: `nodemailer`, `@sendgrid/mail`, or `mailgun.js` copies request data into `to`, `cc`, `bcc`, `subject`, `from`, `replyTo`, `html`, or `text`. `sendMail` fires on any receiver. `send` fires only when the receiver is `mail`, `transporter`, `transport`, `sg`, or `mg`, or the receiver name contains `mail`. A literal field does not fire. Off by default. |
+| `scan --experimental-formula` | **Experimental** (`FULLSHIELD_EXPERIMENTAL_FORMULA=1`). `SAST-FORMULA-001`: request data passed to `stringify`, `write`, `writeToPath`, or `format` from `csv-stringify`, `fast-csv`, `json2csv`, or `csv`, or written to a `.csv` path. `write` and `format` do not fire when the receiver is `res`, `resp`, `response`, or `reply`. A literal row does not fire. Off by default. |
 | `scan --experimental-browser` | **Experimental** (`FULLSHIELD_EXPERIMENTAL_BROWSER=1`). Sets the existing browser flag. `SAST-BROWSER-001`: `puppeteer`, `puppeteer-core`, `playwright`, or `@playwright/test` passes request data to `goto`, `setContent`, or `pdf`. A literal URL or HTML body does not fire. Phase 101 browser rules stay on this same flag. Off by default. |
 | `scan --experimental-dynimport` | **Experimental** (`FULLSHIELD_EXPERIMENTAL_DYNIMPORT=1`). `SAST-DYNIMPORT-001`: `import()` called with request data. A string-literal specifier does not fire. Off by default. |
 | `scan --experimental-frameworks` | **Experimental** Next.js / NestJS / Hono / Koa taint sources and AUTH (`FULLSHIELD_EXPERIMENTAL_FRAMEWORKS=1`). Default `scan` is unchanged. Runtime adapters: `fullshield/runtime/koa`, `fullshield/runtime/hono` (optional peers). |