gadriel 1.1.0 → 1.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +34 -0
  2. package/package.json +6 -6
package/README.md CHANGED
@@ -62,6 +62,40 @@ gadriel code scan .
62
62
  open .security/reports/index.html
63
63
  ```
64
64
 
65
+ > **New in 1.1.3 — Effective Risk consistency + bullet-proofing audit:**
66
+ > - **Effective Risk now drives every report surface** — the Executive PDF's
67
+ > "Risk Prevented" headline + band chips and the HTML report's home severity
68
+ > bar are computed on confidence-adjusted Effective Risk (were raw severity),
69
+ > so a low-confidence critical FP no longer shows as a confirmed critical
70
+ > anywhere. The effective band never exceeds the raw severity (confidence only
71
+ > de-escalates), validated across C/Rust/Go/Python repos.
72
+ > - **Self-skip for Gadriel's own rule corpus** — repos that vendor
73
+ > `gadriel-code-policies` no longer get false secret hits from the example
74
+ > patterns inside the rule definitions.
75
+ > - **Systematic FP prevention** (10-repo audit, ADR-122) — non-production trees
76
+ > (sample/example/integration/extras/bench/profiling/doc/build scripts) are
77
+ > demoted, and three more web-framework rules are gated behind a framework
78
+ > import. See `docs/adr/ADR-122` for the full FP-class remediation roadmap.
79
+ >
80
+ > **New in 1.1.2 — Effective Risk + cross-language false-positive prevention:**
81
+ > - **Effective Risk** — every finding now carries a confidence-adjusted risk
82
+ > (severity × confidence), the same idea as CVSS Report Confidence. A
83
+ > low-confidence "critical" no longer reads as a confirmed one: it shows as
84
+ > Low with an **UNVERIFIED** badge, while genuine high-confidence findings
85
+ > stay at the top. Effective Risk is the primary axis across the CLI, the
86
+ > HTML report, the Executive PDF, and the compliance PDFs (raw severity +
87
+ > confidence are shown in the detail tables). KPIs and headline counts are
88
+ > computed on Effective Risk; the effective band never exceeds the raw
89
+ > severity. Validated across C/Rust/Go/Python repos.
90
+ > - **Cross-language SAST false-positive prevention (ADR-120/121)** — measured
91
+ > ~−21% SAST findings on a fresh 10-repo out-of-sample benchmark with recall
92
+ > preserved. Source-provenance taxonomy, format-string/macro and
93
+ > variadic-forwarder gates, web-framework-import gating for request-only
94
+ > rules, argument-shape narrowing, test/fuzz-path down-ranking, and
95
+ > protocol-mandated weak-crypto suppression via C/C++ caller-context.
96
+ > - **Offline recovery hints** now point at `PREFLIGHT_OFFLINE=1` (the env var
97
+ > that actually works) instead of a non-existent `--offline` flag.
98
+ >
65
99
  > **🎉 1.0.0 — General Availability.** The first stable release of the
66
100
  > Gadriel code-security CLI. Highlights across the suite:
67
101
  > - **6 scan domains in one pass** — SAST, SCA/CVE, secrets, config/IaC,
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "gadriel",
3
- "version": "1.1.0",
3
+ "version": "1.1.3",
4
4
  "description": "Gadriel - Code-security CLI for AI-assisted development",
5
5
  "keywords": [
6
6
  "security",
@@ -36,10 +36,10 @@
36
36
  "node": ">=18"
37
37
  },
38
38
  "optionalDependencies": {
39
- "@gadriel/cli-linux-x64": "1.1.0",
40
- "@gadriel/cli-linux-arm64": "1.1.0",
41
- "@gadriel/cli-darwin-x64": "1.1.0",
42
- "@gadriel/cli-darwin-arm64": "1.1.0",
43
- "@gadriel/cli-win32-x64": "1.1.0"
39
+ "@gadriel/cli-linux-x64": "1.1.3",
40
+ "@gadriel/cli-linux-arm64": "1.1.3",
41
+ "@gadriel/cli-darwin-x64": "1.1.3",
42
+ "@gadriel/cli-darwin-arm64": "1.1.3",
43
+ "@gadriel/cli-win32-x64": "1.1.3"
44
44
  }
45
45
  }