gadriel 1.0.0 → 1.1.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +19 -0
- package/package.json +6 -6
package/README.md
CHANGED
|
@@ -62,6 +62,25 @@ gadriel code scan .
|
|
|
62
62
|
open .security/reports/index.html
|
|
63
63
|
```
|
|
64
64
|
|
|
65
|
+
> **New in 1.1.2 — Effective Risk + cross-language false-positive prevention:**
|
|
66
|
+
> - **Effective Risk** — every finding now carries a confidence-adjusted risk
|
|
67
|
+
> (severity × confidence), the same idea as CVSS Report Confidence. A
|
|
68
|
+
> low-confidence "critical" no longer reads as a confirmed one: it shows as
|
|
69
|
+
> Low with an **UNVERIFIED** badge, while genuine high-confidence findings
|
|
70
|
+
> stay at the top. Effective Risk is the primary axis across the CLI, the
|
|
71
|
+
> HTML report, the Executive PDF, and the compliance PDFs (raw severity +
|
|
72
|
+
> confidence are shown in the detail tables). KPIs and headline counts are
|
|
73
|
+
> computed on Effective Risk; the effective band never exceeds the raw
|
|
74
|
+
> severity. Validated across C/Rust/Go/Python repos.
|
|
75
|
+
> - **Cross-language SAST false-positive prevention (ADR-120/121)** — measured
|
|
76
|
+
> ~−21% SAST findings on a fresh 10-repo out-of-sample benchmark with recall
|
|
77
|
+
> preserved. Source-provenance taxonomy, format-string/macro and
|
|
78
|
+
> variadic-forwarder gates, web-framework-import gating for request-only
|
|
79
|
+
> rules, argument-shape narrowing, test/fuzz-path down-ranking, and
|
|
80
|
+
> protocol-mandated weak-crypto suppression via C/C++ caller-context.
|
|
81
|
+
> - **Offline recovery hints** now point at `PREFLIGHT_OFFLINE=1` (the env var
|
|
82
|
+
> that actually works) instead of a non-existent `--offline` flag.
|
|
83
|
+
>
|
|
65
84
|
> **🎉 1.0.0 — General Availability.** The first stable release of the
|
|
66
85
|
> Gadriel code-security CLI. Highlights across the suite:
|
|
67
86
|
> - **6 scan domains in one pass** — SAST, SCA/CVE, secrets, config/IaC,
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "gadriel",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.1.2",
|
|
4
4
|
"description": "Gadriel - Code-security CLI for AI-assisted development",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"security",
|
|
@@ -36,10 +36,10 @@
|
|
|
36
36
|
"node": ">=18"
|
|
37
37
|
},
|
|
38
38
|
"optionalDependencies": {
|
|
39
|
-
"@gadriel/cli-linux-x64": "1.
|
|
40
|
-
"@gadriel/cli-linux-arm64": "1.
|
|
41
|
-
"@gadriel/cli-darwin-x64": "1.
|
|
42
|
-
"@gadriel/cli-darwin-arm64": "1.
|
|
43
|
-
"@gadriel/cli-win32-x64": "1.
|
|
39
|
+
"@gadriel/cli-linux-x64": "1.1.2",
|
|
40
|
+
"@gadriel/cli-linux-arm64": "1.1.2",
|
|
41
|
+
"@gadriel/cli-darwin-x64": "1.1.2",
|
|
42
|
+
"@gadriel/cli-darwin-arm64": "1.1.2",
|
|
43
|
+
"@gadriel/cli-win32-x64": "1.1.2"
|
|
44
44
|
}
|
|
45
45
|
}
|