sourcecode 5.5.4__tar.gz → 5.5.5__tar.gz

{sourcecode-5.5.4 → sourcecode-5.5.5}/CHANGELOG.md

@@ -2,6 +2,31 @@
 
 ## [Unreleased]
 
+## [5.5.5] — 2026-08-13
+
+**MSAS performance-audit corrections and read-only hygiene verification.**
+
+### Fixed
+- `spring-audit` now preserves full default JSON when it fits the stdout
+  budget; only oversized answers are bounded, and the notice points to
+  `--output` for the complete report.
+- SEC-004 ignores import-only deprecated encoders and reports concrete
+  construction or factory evidence instead.
+- `pr-impact --files -` fails immediately on a terminal stdin with a pipe
+  instruction instead of waiting indefinitely.
+- `ask config` now distinguishes declared custom security annotations from
+  mechanisms inferred with Likely confidence.
+
+### Verification
+- Re-ran read-only hygiene over the `spaghetti-api` and `eureka` fixtures.
+  The commands leave their checkouts untouched; `cold-start` reports `no_ris`
+  explicitly where no semantic model is available.
+
+### Documentation
+- Recorded the MSAS findings, their reproductions, the resolved commits, and
+  the remaining bounded-output, schema, timeline, benchmark, and Git-basis
+  work in the roadmap.
+
 ## [5.5.4] — 2026-08-13
 
 **Re-audit performance and HTTP contract corrections.**

{sourcecode-5.5.4 → sourcecode-5.5.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.5.4
+Version: 5.5.5
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.5.4-blue)
+![Version](https://img.shields.io/badge/version-5.5.5-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -126,7 +126,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.5.4 — and, on a build that has aged,
+ask version                    # ask 5.5.5 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.5.4 → sourcecode-5.5.5}/README.md

@@ -4,7 +4,7 @@
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.5.4-blue)
+![Version](https://img.shields.io/badge/version-5.5.5-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -88,7 +88,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.5.4 — and, on a build that has aged,
+ask version                    # ask 5.5.5 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.5.4 → sourcecode-5.5.5}/docs/DEFECT-LEDGER.md

@@ -24,6 +24,10 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 | AS-02 | Route projection emitted declarations from abstract Spring controllers, creating phantom routes and inflating the unprotected census. | 5.4.2 re-audit | Low | **closed 5.4.2** — abstract declarers are excluded while concrete subtype projection remains admitted; the route-surface regression covers both sides. |
 | AS-03 | The distributed ledger could leave `C3-123` open after the 5.4.1 build already excluded static assets. | 5.4.2 re-audit | Informational | **closed 5.4.2** — the stale state was synchronized to the wheel it documents. |
 | AS-04 | An unconstrained `@RequestMapping` was described by consumers as GET although Spring admits every verb. | 5.5.1 audit | Medium | **closed 5.5.1** — primary `method` is `ANY`; 5.5.4 adds the concrete `methods` list so consumers do not need to infer its expansion. |
+| AS-05 | Test-source endpoint exclusion was neither visible nor reversible for modules whose test code lives below `src/main`. | 5.5.1 audit | High | **closed 5.5.3** — `--include-tests` changes admission and the production answer counts exclusions; 5.5.4 recovery adds the matched path basis. |
+| AS-06 | `@InitBinder` alone was treated as evidence of programmatic validation, contaminating gaps and confidence. | 5.5.1 audit | High | **closed 5.5.1** — only a Spring `Validator` implementation or `setValidator` wiring declares the limit; 5.5.4 recovery publishes that population separately from annotation validators. |
+| AS-07 | Nested types used as field types were reported statically unreferenced by modernization. | 5.5.1 audit | Medium | **closed 5.5.1** — field-type references contribute an incoming static edge. |
+| AS-08 | `spring-audit` severity census could sum to zero beside nonzero findings. | 5.5.4 re-audit | High | **closed 5.5.4** — severity partitions reconcile to `total_findings`; this is asserted in the audit battery. |
 
 ---
 
@@ -46,7 +50,7 @@ The facts these rows are keyed to are published: `ask schema facts-v1` prints th
 | C1-13 | **Hub-guard publishes `endpoints_total: 0` instead of `unknown`.** A service with 780 callers is capped at `depth=1` for cost — defensible — but reports 0 endpoints reached, contradicting the epistemic standard the tool imposes on itself everywhere else. Hubs are precisely where blast radius is asked for | 3.2.1 (eval #4) | Medium | **closed 3.6.0** — no battery repository crosses the guard (openmrs-core's largest hub, `Context`, has 215 caller classes against a threshold of 500), so it was reproduced on a generated fixture: `bfs_truncated: true`, `depth_reached: 1`, `endpoints_affected_count: 0` beside four more zeros nothing looked for. A reach-derived count of 0 under the cap is now `null`, named in `stats.unknown_under_cap`. The distinction is the point and is asserted both ways: a **non-zero** count under the cap stays a number (it is a floor the effect block already describes), and an **uncapped** run keeps its measured zero, because converting that would be the mirror-image defect. The hub threshold moved to module level so the fixture crosses the real guard instead of a copy of its value |
 | C1-14 | **File-count drift across commands**: 3 334 / 3 337 / 3 342 / 3 374 files for one repository in one session. No command is wrong in isolation; together they cost the one thing a deterministic tool cannot lose — that its numbers agree with themselves | 3.2.1 (eval #4) | Medium | **within-document half closed 3.6.0 · cross-command half does not reproduce.** Of six commands measured on openmrs-core (`--compact`, `endpoints`, `spring-audit`, `migrate-check`, `modernize`, `validation`) only `migrate-check` publishes a scanned-file count at all, so there are no two figures left to disagree. What does reproduce is the same defect *inside one document*: `affected_files` named two populations — 265 under `summary` (every finding, any scope) against 264 under `effort_breakdown` (blocking findings only). Both correct; the shared name was the contradiction. Same remedy as C1-5: the narrower becomes `blocking_affected_files`, both carry a `_basis`, the old key stays an alias, and the battery asserts the two diverge exactly when a finding is non-blocking |
 | C1-15 | **Analysis assumes a single destination.** Asked about a JDK move, `migrate-check` answers `headline_blocker: boot3_migration` and emits fix hints that send a developer to migrate namespaces they never planned to touch (481 `javax.persistence` under MIG-001). There is no way to say "JDK 11, keep Boot 2.7" | 3.2.1 (eval #4) | **High (product)** | **closed 3.6.0** — `--target-jdk N` and `--keep-boot` say which migration is being planned, filtered over the `migration_target` vocabulary every rule already carried rather than a parallel one. Measured on openmrs-core with `--target-jdk 11 --keep-boot`, the row's own acceptance: **MIG-001 85 → 0**, blocking 114 → 0, `headline_blocker` `hibernate_rewrite` → `none_applicable`, and the Hibernate 5→6 rewrite drops with it because Hibernate 6 arrives with Boot 3. Narrowing is not silencing: `metadata.route` publishes the target, the flag and every excluded axis, a `limitations` entry states how many findings were left out and that they are unresolved rather than fixed, and the route's own blockers stay (a JDK 11 route still reports MIG-021, asserted). The default is untouched, verified identical on three repositories |
-| C1-16 | **Four fan-in figures for one class, and the note that promises the relationship is itself false.** Field: `modernize.in_degree` 1 026 / `impact-chain.direct_callers` 611 / `explain.incoming_callers` 519 / `impact.stats.direct_caller_count` 484 for one service, plus 3 222 vs 3 458 endpoints affected. **Re-measured on the battery, 3.4.0, `Money` @ BroadleafCommerce: 673 / 1 868 / 151 / 418** — `impact-chain` is absent from the published relationship and is **2,8× larger than the figure the note declares "always the largest of the three"**, while `explain` vs `impact` differ by **177 %**, not the *"small margin"* the same note promises. In the same runs `impact.stats.endpoints_affected_count: 0` against a populated `endpoints_affected` from `impact-chain` — a **false zero** on the blast-radius axis | 3.2.1 (eval #5) | **High** — this is the number a risk decision is taken with: *"¿el blast radius son 484 o 611 clases?"* | **closed 4.10.0** — the caller-axis unit fix closed in 3.5.0 (`caller_metrics.caller_classes`, unit-named figures, generated note, no `len(display_list)` in `compare`). The endpoint reach half then bound `impact`, `impact-chain` and `migrate-check --blast-radius` to `caller_reach`, crossing class→method keys and DI interface boundaries without admitting structural `implements`/`extends` edges as callers. The remaining asymmetry is now closed too: `impact` expands class/interface seeds to in-repo subtypes before BFS, using `ImplementationGraph` and a class-aware seed resolver so a base-class query reaches callers of subclass members the same way `impact-chain` does. Tests cover DI parity, endpoint count/list parity, caller-unit stability and the base-class subtype regression fixture |
+| C1-16 | **Four fan-in figures for one class, and the note that promises the relationship is itself false.** Field: `modernize.in_degree` 1 026 / `impact-chain.direct_callers` 611 / `explain.incoming_callers` 519 / `impact.stats.direct_caller_count` 484 for one service, plus 3 222 vs 3 458 endpoints affected. **Re-measured on the battery, 3.4.0, `Money` @ BroadleafCommerce: 673 / 1 868 / 151 / 418** — `impact-chain` is absent from the published relationship and is **2,8× larger than the figure the note declares "always the largest of the three"**, while `explain` vs `impact` differ by **177 %**, not the *"small margin"* the same note promises. In the same runs `impact.stats.endpoints_affected_count: 0` against a populated `endpoints_affected` from `impact-chain` — a **false zero** on the blast-radius axis | 3.2.1 (eval #5), reopened 5.5.4 | **High** — this is the number a risk decision is taken with: *"¿el blast radius son 484 o 611 clases?"* | **reopened 5.5.4.** The DI and subtype fixtures remain closed, but the claimed one-authority implementation was false for service locators: `impact` kept a local BFS that elevated `Locator#accessor` to every caller of `Locator`, while `impact-chain` used `caller_reach` and did not. 5.5.4 recovery removes that elevation and adds a two-accessor regression fixture; authority unification and cross-command parity remain open as Q-03. |
 | C1-17 | **A fact with an authority still contradicts itself across two commands**: `--compact.analysis_gaps` says *"1 test file for 3 336 Java files"* while `review-pr.test_coverage_risk.repository_has_test_sources` says `false`, in the same repository. C1-2 was closed in 3.2.1 with five consumers rebound, and this evaluation ran **on 3.2.1** | 3.2.1 (eval #5) | Medium | **does not reproduce (measured 3.6.0)** — re-measured as the row instructed. On openmrs-core, keycloak and spring-petclinic neither statement is emitted, and both consumers reach one authority: `--compact` through `analyze_test_sources`, `review-pr` through `is_test_path`. What was missing is now asserted: the authority has **two entry points** and nothing held them to each other, which is exactly the shape a sixth consumer would take. Zero mismatches across a case table including the C1-2 discriminator (a `test` package inside a *main* source root is production code), plus the literal contradiction — "N test files" and "no test sources" — asserted unreachable in both directions |
 | C1-18 | **The profile population differs per command, and the narrower one is what an agent reads.** Field: `--agent` reports a two-name profile set while `prepare-context fix-bug` reports four for the same repository in the same session — and the two names missing from the agent payload are the ones the *build* names for its deployable artefacts. Every finding about conditional security is keyed on that set, so the default agent surface answers the profile question with the population that lost the environments | 3.5.0 (eval #6) | **High** — it is the input to the one capability nothing else in the market has | **closed (unreleased)** — **fixture first, as C1-10 required**, and it reproduced worse than reported: on `tests/fixtures/spring_profile_population` the same repository in one session answered **`["qa","dev"]`** (default view — filenames + overlay directories), **`["dev","prod","staging"]`** (`posture` — config documents + `@Profile`) and **`["dev","prod","qa","staging"]`** (`--agent` / `fix-bug`, the union). Three populations under one name; every conditional-security finding is keyed on it. Authority `spring_profiles.profile_population`: four named signals (`file_naming`, `overlay_directory`, `config_documents`, `annotations`, plus `caller_supplied`), the union, and `by_signal` published so a name's provenance is auditable. The stack detector, `posture` and the serializer section all read it — asserted per surface, not claimed. Closing it exposed two false positives in the signals it inherited, both fixed structurally (never by name — VAI): an `application-{x}` file counts only **beside its base config** (alfresco's `alfresco/messages/application-model_de.properties` + 19 siblings invented twenty environments; now 0) and an overlay directory counts only when it **holds a config file** (spring-petclinic's `db/ messages/ static/ templates/` reported four; now `mysql, postgres`, which are its real profiles) |
 | C1-19 | **File-count drift across commands, with witnesses this time.** 3 337 (`compact.project_summary`) / 3 336 (`analysis_gaps.testing`) / 3 342 (`migrate-check.metadata.java_files_scanned`) for one repository in one session | 3.8.0 (eval #7) | Medium | **closed 3.9.0** — measured, not equalised: the three figures count code-extension files in any language, the non-test denominator of a test ratio, and the .java files handed to the migration rules. Each names its population now, and `migrate-check.files_scanned_basis` states the two it is not. Original note: open — **C1-14's cross-command half, reopened.** 3.6.0 recorded that half as *not reproducing* because on openmrs-core only `migrate-check` published a scanned-file count at all; eval #7 shows three commands publishing one on a repository we do not have. Three populations are plausible and each may be right in isolation (all Java files / files admitted to the graph / files the migration rules scanned), which is exactly the C1-5 remedy: name the unit per figure, or bind them to one authority. Do not fix by making the numbers equal — measure which population each counts first |

{sourcecode-5.5.4 → sourcecode-5.5.5}/docs/USER_GUIDE.md

@@ -136,7 +136,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.5.4
+# ask 5.5.5
 ```
 
 Requires Python 3.9+.

{sourcecode-5.5.4 → sourcecode-5.5.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.5.4"
+version = "5.5.5"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.5.4 → sourcecode-5.5.5}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.5.4"
+__version__ = "5.5.5"

{sourcecode-5.5.4 → sourcecode-5.5.5}/src/sourcecode/cli.py

@@ -2081,6 +2081,14 @@ def _resolve_files_option(
 
     raw = str(files).replace(_text_input.BOM_CHAR, "").strip()
     if raw == "-":
+        if sys.stdin.isatty():
+            _emit_error_json(
+                INVALID_INPUT_CODE,
+                "--files - reads the file list from stdin, but stdin is a terminal.",
+                hint=f"Pipe the list: git diff --name-only main | ask {command} . --files -",
+                expected="Piped stdin, a list file, or a comma-separated file list.",
+            )
+            raise typer.Exit(code=1)
         return _text_input.parse_path_lines(_text_input.read_stdin_text()), "stdin"
     as_path = Path(raw)
     if as_path.is_file():
@@ -8867,7 +8875,8 @@ def spring_audit_cmd(
         help=(
             "Bounded summary: caps `findings` and the per-endpoint security projection "
             "to their top 5, most-severe first. Every count is still measured over the "
-            "whole population. The full report can exceed 1 MB on a monolith."
+            "whole population. Stdout also switches to this form only when the full "
+            "JSON exceeds its 50 KB budget; use --output for the complete report."
         ),
     ),
     table: bool = typer.Option(
@@ -9204,17 +9213,19 @@ def spring_audit_cmd(
                         "phase that never ran is not evidence there is none."
                     )
 
+            _full_data = combined.to_dict()
             _bounded_default = (
                 not compact and output_path is None and format == "json" and not table
+                and len(_json.dumps(_full_data, ensure_ascii=False).encode("utf-8")) > 50_000
             )
-            data = (
-                combined.to_compact_dict()
-                if compact or _bounded_default
-                else combined.to_dict()
-            )
+            data = combined.to_compact_dict() if compact or _bounded_default else _full_data
             if _bounded_default:
                 data.pop("mode", None)
                 data["default_output"] = "bounded"
+                data.pop("compact_note", None)
+                data["stdout_budget_note"] = (
+                    "Capped by the stdout payload budget; use --output <file> for the complete report."
+                )
             data.setdefault("metadata", {})["cache_layers"] = _cache_state
             if _stopped_early:
                 # C3-87: the block is composed by `PhasedRun.status`, which is the
@@ -9249,17 +9260,19 @@ def spring_audit_cmd(
     elif format == "github-comment":
         output = _render_spring_audit_github_comment(combined, min_severity)
     else:
+        _full_data = combined.to_dict()
         _bounded_default = (
             not compact and output_path is None and format == "json" and not table
+            and len(_json.dumps(_full_data, ensure_ascii=False).encode("utf-8")) > 50_000
         )
-        data = (
-            combined.to_compact_dict()
-            if compact or _bounded_default
-            else combined.to_dict()
-        )
+        data = combined.to_compact_dict() if compact or _bounded_default else _full_data
         if _bounded_default:
             data.pop("mode", None)
             data["default_output"] = "bounded"
+            data.pop("compact_note", None)
+            data["stdout_budget_note"] = (
+                "Capped by the stdout payload budget; use --output <file> for the complete report."
+            )
         output = _serialize_dict(data, format)
 
     # F-AV: our own readers ask for the count under either spelling — the break
@@ -12870,7 +12883,8 @@ def config_cmd(
         _answer.say(f"Declaration: none at {_declaration_path}")
         _answer.say(
             "  Nothing is declared, so `data-exposure` answers "
-            "`answered: false` and no custom security annotation is recognised."
+            "`answered: false`. Custom security annotations may still be inferred "
+            "from usage with Likely confidence; declare them to make that policy Declared."
         )
     else:
         _answer.say(f"Declaration: {_declaration_path}")

{sourcecode-5.5.4 → sourcecode-5.5.5}/src/sourcecode/repository_ir.py

@@ -6448,6 +6448,7 @@ def extract_java_endpoints(
     # calls. One candidate list keeps that work bounded and reusable below.
     _config_files = sorted(root.rglob("application*.*"))
     _excluded_test_source_routes = 0
+    _excluded_test_patterns: set[str] = set()
     if not include_tests:
         _route_marker = _re.compile(
             r"@(GetMapping|PostMapping|PutMapping|DeleteMapping|PatchMapping|RequestMapping|GET|POST|PUT|DELETE|PATCH|Path)\b"
@@ -6456,6 +6457,15 @@ def extract_java_endpoints(
             _candidate_rel = _rel(_candidate)
             if not is_test_source_file(_candidate_rel):
                 continue
+            _candidate_parts = _candidate_rel.lower().split("/")
+            if "test-suite" in _candidate_parts:
+                _excluded_test_patterns.add("test-suite/")
+            elif "src/test/" in _candidate_rel.lower():
+                _excluded_test_patterns.add("src/test/")
+            elif "src/it/" in _candidate_rel.lower():
+                _excluded_test_patterns.add("src/it/")
+            else:
+                _excluded_test_patterns.add("test-source classification")
             try:
                 _excluded_test_source_routes += len(
                     _route_marker.findall(_candidate.read_text(encoding="utf-8", errors="replace"))
@@ -6962,6 +6972,11 @@ def extract_java_endpoints(
         result["test_util_included"] = len(_test_util_endpoints)
     if _excluded_test_source_routes:
         result["test_source_excluded"] = _excluded_test_source_routes
+        result["test_source_excluded_detail"] = {
+            "count": _excluded_test_source_routes,
+            "patterns_matched": sorted(_excluded_test_patterns),
+            "basis": "path classification; use --include-tests to include these routes",
+        }
         result.setdefault("notes", []).append(
             f"{_excluded_test_source_routes} route annotation(s) from test source trees "
             "were excluded; use --include-tests to include them."
@@ -7187,6 +7202,10 @@ _DISPLAY_INDIRECT_CALLERS = 50
 HUB_CALLER_THRESHOLD = 500
 HUB_SAMPLE_SIZE = 20
 HUB_SAMPLE_DEPTH = 2
+# A frontier is a hub for this query when it materially exceeds the target's
+# own fan-in, even if it does not reach the global safety cap above.
+HUB_RELATIVE_FANIN_MULTIPLIER = 3
+HUB_RELATIVE_FANIN_FLOOR = 20
 
 
 def _symbol_listing_advice(root: "Optional[Path]") -> str:
@@ -7339,21 +7358,15 @@ def compute_blast_radius(
     _rg_index = _class_method_index(reverse_graph)
 
     def _walk_callers(_node: str) -> list[str]:
-        """Expand method frontiers through their owning class as well.
+        """Return the one-authority caller set for this exact frontier node.
 
-        Service-locator accessors enter the frontier as ``Class#accessor`` while
-        callers of the class are indexed under its method keys. Keeping the
-        exact lookup preserves method-level reach; adding the enclosing class
-        lookup prevents that frontier from becoming a false terminal node.
+        `caller_reach` expands class nodes through their method keys, which is
+        required for DI-normalized class frontiers. It deliberately does not
+        invert that containment for a method: callers of `Locator#getA` are a
+        subset of callers of `Locator`, and adding the latter leaks users of
+        every other locator accessor into the blast cone.
         """
-        candidates = list(_all_callers_from_rg(
-            _node, reverse_graph, _rg_index, _impl_graph
-        ))
-        if "#" in _node:
-            candidates.extend(_all_callers_from_rg(
-                _enclosing_class(_node), reverse_graph, _rg_index, _impl_graph
-            ))
-        return list(dict.fromkeys(candidates))
+        return _all_callers_from_rg(_node, reverse_graph, _rg_index, _impl_graph)
     # Callers inject the interface, not the implementation, so a walk that does not
     # know the implements relation stops one hop short of every DI consumer. Without
     # it this traversal reached 200 classes and **no controller at all** for
@@ -7473,6 +7486,26 @@ def compute_blast_radius(
                         if _effective_depth > 1:
                             queue.append((c, 1))
 
+    # A locator accessor can be a narrow method frontier on a broad class hub.
+    # Measure the owner only to classify that frontier, never to expand it: the
+    # latter would merge callers of unrelated accessors (Q-01).
+    _seed_fan_in = max(1, len(set(direct_callers)))
+    _hub_frontier_cutoff = max(
+        HUB_RELATIVE_FANIN_FLOOR,
+        _seed_fan_in * HUB_RELATIVE_FANIN_MULTIPLIER,
+    )
+
+    def _is_hub_frontier(_node: str) -> bool:
+        _fan_in = len(_walk_callers(_node))
+        if "#" in _node:
+            _fan_in = max(
+                _fan_in,
+                len(_all_callers_from_rg(
+                    _enclosing_class(_node), reverse_graph, _rg_index, _impl_graph
+                )),
+            )
+        return _fan_in > _hub_frontier_cutoff
+
     # BFS for indirect callers
     indirect_callers: list[str] = []
     _indirect_parent: dict[str, str] = {}
@@ -7484,7 +7517,7 @@ def compute_blast_radius(
         if depth >= _effective_depth:
             continue
         _node_callers = _walk_callers(node)
-        if len(_node_callers) > _HUB_CALLER_THRESHOLD:
+        if _is_hub_frontier(node):
             _hub_frontier_nodes.add(node)
         for caller in _node_callers:
             if caller not in visited:
@@ -7735,7 +7768,7 @@ def compute_blast_radius(
         if _depth >= _effective_depth:
             continue
         _next = _walk_callers(_node)
-        if len(_next) > _HUB_CALLER_THRESHOLD:
+        if _is_hub_frontier(_node):
             continue
         for _caller in _next:
             if _caller not in _without_hubs_seen:

{sourcecode-5.5.4 → sourcecode-5.5.5}/src/sourcecode/security_config_scan.py

@@ -276,7 +276,13 @@ def _scan_java(source: str, rel: str) -> "list[SecurityConfigObservation]":
                 ))
                 break  # one observation per algorithm per file
         for encoder in _DEPRECATED_ENCODERS:
-            m = re.search(re.escape(encoder), source)
+            # An import only makes the type available; it is not evidence that
+            # a password encoder is used. Require construction or the legacy
+            # factory call so the witness opens on a remediation site.
+            m = re.search(
+                rf"(?:new\s+{re.escape(encoder)}\b|{re.escape(encoder)}\s*\.\s*getInstance\s*\()",
+                source,
+            )
             if m:
                 out.append(SecurityConfigObservation(
                     rule="SEC-004",

{sourcecode-5.5.4 → sourcecode-5.5.5}/src/sourcecode/servlet_surface.py

@@ -83,12 +83,12 @@ def _child_text(elem: "ET.Element", name: str) -> str:
     return ""
 
 
-def _from_web_xml(xml_path: Path, relative: str) -> "list[ServletMapping]":
+def _from_web_xml(xml_path: Path, relative: str) -> "tuple[list[ServletMapping], int]":
     try:
         text = xml_path.read_text(encoding="utf-8", errors="replace")
         root = ET.fromstring(text)
     except Exception:
-        return []
+        return [], 0
     classes: "dict[str, str]" = {}
     for elem in root.iter():
         if _local(elem.tag) != "servlet":
@@ -98,10 +98,17 @@ def _from_web_xml(xml_path: Path, relative: str) -> "list[ServletMapping]":
         if name:
             classes[name] = klass
     out: "list[ServletMapping]" = []
+    undeclared_servlet_mappings = 0
     for elem in root.iter():
         if _local(elem.tag) != "servlet-mapping":
             continue
         name = _child_text(elem, "servlet-name")
+        if not name or name not in classes:
+            undeclared_servlet_mappings += sum(
+                1 for child in elem.iter()
+                if _local(child.tag) == "url-pattern" and (child.text or "").strip()
+            )
+            continue
         for child in elem.iter():
             if _local(child.tag) != "url-pattern" or not (child.text or "").strip():
                 continue
@@ -122,10 +129,13 @@ def _from_web_xml(xml_path: Path, relative: str) -> "list[ServletMapping]":
             pattern_match = re.search(r"<url-pattern\b[^>]*>\s*([^<]+?)\s*</url-pattern>", block, re.DOTALL | re.IGNORECASE)
             if not pattern_match:
                 continue
+            servlet_name = name_match.group(1).strip() if name_match else ""
+            if not servlet_name or servlet_name not in classes:
+                continue
             candidate = ServletMapping(
                 url_pattern=pattern_match.group(1).strip(),
-                servlet_name=name_match.group(1).strip() if name_match else "",
-                servlet_class=classes.get(name_match.group(1).strip(), "") if name_match else "",
+                servlet_name=servlet_name,
+                servlet_class=classes[servlet_name],
                 source_file=relative,
                 source="web.xml",
             )
@@ -133,7 +143,7 @@ def _from_web_xml(xml_path: Path, relative: str) -> "list[ServletMapping]":
                 out.append(candidate)
     except Exception:
         pass
-    return out
+    return out, undeclared_servlet_mappings
 
 
 def _from_registration_beans(java_path: Path, relative: str) -> "list[ServletMapping]":
@@ -178,6 +188,7 @@ def build_servlet_surface(
 
     root = Path(root)
     mappings: "list[ServletMapping]" = []
+    undeclared_servlet_mappings = 0
     if files is None:
         candidates: list[Path] = []
         for directory, dirs, names in os.walk(root):
@@ -209,7 +220,9 @@ def build_servlet_surface(
         except ValueError:
             relative = Path(path).as_posix()
         if path.name == "web.xml":
-            mappings.extend(_from_web_xml(path, relative))
+            parsed, omitted = _from_web_xml(path, relative)
+            mappings.extend(parsed)
+            undeclared_servlet_mappings += omitted
         elif path.suffix == ".java":
             mappings.extend(_from_registration_beans(path, relative))
 
@@ -221,6 +234,7 @@ def build_servlet_surface(
     _unique: dict[str, ServletMapping] = {}
     for mapping in sorted(mappings, key=lambda m: (m.url_pattern, m.source_file, m.source)):
         _unique.setdefault(mapping.url_pattern, mapping)
+    declared_mappings = list(mappings)
     mappings = list(_unique.values())
     patterns = sorted(_unique)
     by_source: "dict[str, int]" = {}
@@ -232,15 +246,25 @@ def build_servlet_surface(
     )]
     shown = rows if limit is None else rows[:limit]
 
+    display_omitted = len(rows) - len(shown)
+    omitted_total = undeclared_servlet_mappings + display_omitted
+    omitted_by_reason: dict[str, int] = {}
+    if undeclared_servlet_mappings:
+        omitted_by_reason["servlet_not_declared"] = undeclared_servlet_mappings
+    if display_omitted:
+        omitted_by_reason["display_limit"] = display_omitted
+
     return {
         "schema_version": SCHEMA_VERSION,
         "population_key": POPULATION,
         "total_url_patterns": len(patterns),
-        "declarations": len(mappings),
+        "declarations": len(declared_mappings),
+        "declarations_unit": "live servlet-mapping declarations before URL-pattern deduplication",
         "by_source": dict(sorted(by_source.items())),
         "url_patterns": patterns,
         "mappings": shown,
-        "mappings_omitted": len(rows) - len(shown),
+        "mappings_omitted": omitted_total,
+        "mappings_omitted_by_reason": omitted_by_reason,
         "population": (
             "servlet mappings declared in `web.xml` or registered as a "
             "`ServletRegistrationBean` — HTTP surface that is NOT a Spring handler "

{sourcecode-5.5.4 → sourcecode-5.5.5}/src/sourcecode/validation_surface.py

@@ -614,7 +614,16 @@ def build_validation_surface(
         "summary": {
             "endpoints_with_body": len(out_endpoints),
             "validated_fields": total_validated_fields,
+            # This catalog contains annotation-based ConstraintValidator types.
+            # Spring Validator wiring is detected separately below and must not
+            # be read as zero just because it belongs to another population.
             "custom_validators_declared": len(custom_list),
+            "custom_validators_declared_unit": "annotation-based ConstraintValidator declarations",
+            "programmatic_validators_declared": len(programmatic_evidence),
+            "programmatic_validators_declared_unit": (
+                "detected org.springframework.validation.Validator implementations "
+                "or setValidator wiring; rules are not modeled per endpoint"
+            ),
             "custom_validators_linked": len(custom_used),
             "gaps": len(gaps),
         },