Highlights
- Java Taint Improvements: Enhanced taint tracking in Java, including handling JDK shims, chained call receivers, literal arguments, and type-test patterns.
- C# Taint Propagation: Improved taint propagation in C# with refinements to argument binding, tuple deconstruction, and await plumbing methods.
- Semantic Frontend Enhancements: Added in-process Jedi semantic frontend for Python and re-run semantic frontends on the watch path for more accurate analysis.
- Protocol Buffer Indexing: Introduced a canonical protobuf index with provenance manifest and a verify command for improved data integrity.
- Structural Analysis: Added structural snapshot diffs between protobuf indexes and structural ast-grep support for seven additional languages.
What's Changed
- fix(evals): probe javac/java -version so a broken JDK shim reports unavailable by @vitali87 in #1308
- chore(ruff): add PLR0917 to ignore list alongside PLR0913 by @aoright in #1312
- fix: ship libclang as the cpp extra and make frontend degradation actionable by @vitali87 in #1313
- fix: sweep legacy target-resolved File identities with positive ownership attribution by @vitali87 in #1314
- feat: model Dart Process.run and Socket.connect flows via a PROCESS ResourceKind by @vitali87 in #1315
- feat: taint Dart handle-read bindings and listen callback parameters by @vitali87 in #1317
- feat: persist start and name columns and rehydrate the col-keyed location indexes by @vitali87 in #1318
- feat: re-run semantic frontends and their joins on the watch path by @vitali87 in #1319
- feat: re-parse dependent callers of re-indexed files instead of restoring stale edges by @vitali87 in #1320
- feat: reclaim crashed frontend build locks and load nested Go modules per module root by @vitali87 in #1321
- feat: Scala io_access sink coverage closing the last READS_FROM/WRITES_TO language gap by @vitali87 in #1322
- feat: hand-labelled FLOWS_TO ground-truth corpus with per-metric eval scope reporting by @vitali87 in #1323
- feat: canonical protobuf index with provenance manifest and verify command by @vitali87 in #1326
- feat: structural snapshot diff between canonical protobuf indexes by @vitali87 in #1327
- feat: in-process Jedi semantic frontend for Python behind PYTHON_FRONTEND by @vitali87 in #1328
- feat: index annotation-processor generated sources with import binding and provenance by @vitali87 in #1329
- feat: call-relative closure-capture cell semantics in the Python flow walk by @vitali87 in #1330
- feat: delombok overlay parses Lombok-expanded sources keyed by the original path by @vitali87 in #1336
- feat(dead-code): report symbols in structural-tier languages as unanalyzed by @vitali87 in #1337
- feat: Roslyn argument and binding flow facts sharpen C# taint propagation by @vitali87 in #1338
- fix: return deterministic directory listings by @Whxuan0701 in #1309
- fix: skip distributions whose metadata cannot be read when fingerprinting parsers by @vitali87 in #1340
- fix: reject invalid source location ranges by @Whxuan0701 in #1310
- fix: reject invalid code snippet spans by @Whxuan0701 in #1311
- feat: bundled javac fact provider attributes Java call sites by @vitali87 in #1341
- fix: type Java chained call receivers by the inner call's return type by @vitali87 in #1343
- feat: bind Java calls through the javac facts and suppress proven-external edges by @vitali87 in #1345
- fix: type Java literal arguments so overloads bind by argument type by @vitali87 in #1346
- fix: type a nested Java call argument from its selected overload by @vitali87 in #1349
- feat: emit Roslyn out and ref write-back facts so the written local carries the call's taint by @vitali87 in #1351
- test: cover the local-function ref write-back path by @vitali87 in #1354
- feat: prove ref writes for callee bodies in referenced projects by @vitali87 in #1355
- feat: grade Java inheritance in the eval harness against the javac oracle by @vitali87 in #1357
- chore: remove stale suspension note and disabled badges by @vitali87 in #1358
- fix: treat C# await plumbing methods as taint transparent by @vitali87 in #1360
- fix: make C++ semantic frontend setup actionable by @alloutflo in #1198
- fix: bind C# tuple deconstruction so each name takes its own element's taint by @vitali87 in #1361
- fix: carry taint through C# type-test patterns that bind a name by @vitali87 in #1362
- feat: add structural ast-grep support for 7 more languages (#1352) by @vitali87 in #1359
- fix: lean-walk pass-through helpers keep their argument's taint (#1363) by @vitali87 in #1364
- fix: lock the Java oracle build so parallel test workers cannot race (#1366) by @vitali87 in #1369
- feat: Lua and Scala parameter slots complete the lean taint composition (#1365) by @vitali87 in #1375
- test: skip instead of aborting collection when an optional grammar is absent (#1371) by @vitali87 in #1376
- feat: lean-walk transitive pass-through chaining (closes #1363) by @vitali87 in #1377
- test: cover the expression-bodied and read-only local-function ref shapes (#1353) by @vitali87 in #1378
- docs: security guide describes the loopback bind that shipped with #1012 (#1372) by @vitali87 in #1379
- fix(flow): emit ENV source for python os.environ subscript reads by @rekcilyssup in #1325
- docs: explain why the newest tag runs ahead of the newest release (#1373) by @vitali87 in #1381
- test: make the Rust scan perf guard immune to runner load (#1382) by @vitali87 in #1385
- feat: make query_graph description demand verification of candidates by @vitali87 in #1387
New Contributors
- @Whxuan0701 made their first contribution in #1309
- @alloutflo made their first contribution in #1198
- @rekcilyssup made their first contribution in #1325
Full Changelog: v0.0.670...v0.0.720