DataFlowBench v0.6.1
A patch release, and a narrow one on purpose. It exists because a Bifrost fix
cycle closed against findings this benchmark published, so it re-pins Bifrost
from v0.10.7 to v0.10.8 and re-runs that analyzer's twenty slices. Nothing
else in the field moved: the fixture revision is unchanged, the other sixty-two
reports carry over byte-identical, and every other analyzer's numbers are
identical to v0.6.0's.
Three things in it are worth a reader's time, and only one of them is good
news. The fix cycle lands: four false positives corrected and eight declined
assertions newly decided. A regression comes with it, published rather than
held for. And a disagreement this project blamed on the engine for three
releases turns out to have been a bug in our own adapter.
Freeze identity
- Freeze ID (manifest SHA-256):
65638eafb36478120d268290479815114f244baa57994c47e19fac6b759e50ae - Manifest:
reports/freeze.json - Benchmark revision:
a8cde57(tagv0.6.1) - Fixture revision:
sha256:9df209ed3d7723a3ee33f2b289cf2afe34a3add781bdf2a2ac445de42b8d0151 - Case schema v2, normalized result schema v1
- 852 frozen cases, 82 bound reports, 3480 scored case results
- Score tiers:
calibration,core,language-extension,modeling - Model profiles:
benchmark-controlled,tool-native - Claim exclusions: none
The fixture revision is unchanged from v0.6.0 — and from v0.5.0 before it.
The benchmark did not grow in this release, and no case was edited: this is the
same exam, re-sat by one candidate.
What re-ran
Of the 82 bound reports, 20 were re-executed — every Bifrost slice: the
thirteen kernels, the three modeling reports, the three tool-native reports,
and the breadth smoke population. The remaining 62 are byte-identical to
the reports already in the tree, re-bound and re-digested into the new manifest
without being re-run. Of those 62, 54 were bound by v0.6.0 itself and 8 are the
modeling and tool-native rows produced by the amendment work that landed after
v0.6.0 was published (below).
The re-run was taken in a single settle-gated quiet window: twenty cold slices
between 03:07:00 and 03:09:35 local time on 2 September 2026, on the
Mac16,1 / 10-core arm64 machine whose stamp is retained at
reports/raw/bifrost/run-environment.json. The window's load gate (1.8–2.0) is
recorded in the run's commit record rather than in a raw artifact — the Bifrost
correctness slices retain a per-case phase-timing sidecar and a per-run
environment stamp, but no load sample. That is stated here rather than implied,
because this release note is not entitled to a number the evidence does not
carry.
The second pin-currency review (#92)
The full table is in docs/adapters.md.
In summary:
| Analyzer | Pin at v0.6.0 | Outcome |
|---|---|---|
| Bifrost | 0.10.7 |
Bumped to 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 |
| Joern | 4.0.614 |
Held, with a dated reason: upstream daily 4.0.615 is one day newer, and the release's delta is deliberately scoped to the Bifrost fix cycle |
| CodeQL CLI | 2.26.4 |
Evaluated — current |
| Semgrep CE | 1.175.0 |
Evaluated — current |
| OpenTaint | analyzer/2026.08.27.17eb0fe |
Evaluated — current (digest-pinned) |
| Infer | v1.3.0 |
Evaluated — current (digest-pinned) |
| FlowDroid | 2.15.1 |
Evaluated — current (digest-pinned) |
| Pysa | pyre-check 0.10.0 + Pyrefly 1.2.0 |
Evaluated — current (digest-pinned) |
The Joern hold is the one to read twice. Holding a pin one day behind upstream
is a choice, and it is recorded as a choice with its reason and its date, so
that the next review inherits an obligation rather than a silence. A pin held
without a stated reason is indistinguishable from a pin nobody looked at.
The Bifrost v0.10.8 fix cycle
Everything in this section is one analyzer column. Read it that way.
- Four false positives are fixed. The path-feasibility and loop-kill
negatives filed as BrokkAi/bifrost-dev#2731 —
dfb-taint-csharp-infeasible-branch-negative,
dfb-taint-csharp-loop-carried-negative,
dfb-taint-go-loop-carried-negative, and
dfb-taint-ruby-infeasible-branch-negative— all now readnot-reached.
Those four were published against Bifrost in v0.5.0 and again in v0.6.0. - Bifrost now has no decisive mistake anywhere in this freeze. Not one
false positive and not one false negative, across all 3480 case results, on
every tier and under both model profiles. No other analyzer in the freeze can
say that, and the reason Bifrost can is not free — see the inconclusive count
below. - Eight assertions are newly decided, and decided correctly. The
element-objectpairs in java, javascript, and typescript, and Rust's
recursive-carrypair, move frominconclusiveto a correct decision. These
bite into the declined families tracked as bifrost-dev#2839, which is
narrowed rather than closed: the remaining declines in those families are
still declines. - Decisive-correct on the thirteen kernels: 435 → 446. Bifrost now produces
446 decisive outcomes on the 738-assertion core population, of which all
446 are correct (v0.6.0: 440 decisive, 435 correct). Language by language:
csharp 32 → 34, java 37 → 40, javascript 36 → 38, ruby 21 → 22, rust 36 → 38,
typescript 34 → 36, and go 35 → 34. C, C++, Kotlin, PHP, Python, and
Scala are unchanged. - Core
inconclusive: 298 → 292, and still concentrated where it was:
Ruby 36 of 58, Kotlin 30, PHP and C++ 26 each, C# and Go 24 each; lightest is
C at 8 of 48. Declines, not misses — but on a page where seven other
analyzers decide these same cases definitively, that column's shape is the
price of the zero-mistake row above, and both belong in the same sentence. - Smoke: 117 of 118, unchanged. The single non-decision remains the
dfb-taint-java-modeled-externalcalibration case, which takesunsupported
and is not scored.
Honest negatives
A regression, taken rather than held for
Go's array-element pair — dfb-taint-go-array-element-positive and
dfb-taint-go-array-element-negative — was decided correctly under v0.10.7
and is inconclusive under v0.10.8. The retained raw evidence carries the
reason verbatim:
taint discovery is incomplete: procedure value-flow snapshot for
array_element_positive.go:array_element_positive.go.runis unsupported
(index_memory)
It is filed upstream as BrokkAi/bifrost-dev#2831.
The pin was taken with this loss visible. Holding v0.10.7 to keep one pair
decided would have suppressed a net improvement — four false positives fixed
and eight cells newly decided — and would have hidden the regression instead of
publishing it. It is the only cell in this release that moved backwards, it is
on the vendor's own engine, and it is on the templates page, the evidence page,
and here.
The java-direct disagreement was ours, not the engine's
This is the part of the release that is a correction to DataFlowBench.
For three releases — v0.4.0, v0.5.0, v0.6.0 — this project published an
unreconciled disagreement: dfb-taint-java-direct-positive was reached (true
positive) in reports/bifrost-smoke.json and not-reached (false negative) in
reports/bifrost-java-kernel.json, at the same build and the same fixture
revision. Each release described it as an observed instability of the engine,
retained both artifacts, and declined to re-run either to agreement.
bifrost-dev#2832 was filed upstream against the engine.
It was not an engine defect. The Java kernel adapter was force-selecting
core-java-kernel.rqlp in place of each selected case's own validated declared
policy. That kernel policy's dfb_source/dfb_sink selectors bind zero
endpoints in this legacy fixture, so the kernel run asked a question the
fixture could not answer and correctly reported not-reached. The smoke run,
which used the case's declared direct-positive.rqlp, was right the whole
time. The adapter now uses each case's declared policy while keeping the
configuration hash over every policy invoked; the fix is PR #118, with a
smoke/kernel policy-parity regression test beside it. bifrost-dev#2832 is
being closed as benchmark-side.
Under this freeze both populations reach it. Java's kernel goes 37/58 to 40/58,
and the classic-32 partition inside it goes 31/32 to 32/32, matching the
smoke population case for case.
Two things follow, and neither is comfortable. First: a benchmark published by
the vendor of one of the engines it measures spent three releases attributing
its own bug to that engine's competitor-facing column — which is to say, the
error ran against Bifrost, not for it, and it still should not have run. The
direction of a mistake is not what makes it acceptable. Second: the reason it
survived three releases is that the disagreement was documented rather than
investigated. Publishing an anomaly honestly is not the same as chasing it
down, and the freeze contract's refusal to re-run evidence to agreement — which
is the right rule — is not a reason to leave the discrepancy unexplained. The
policy-parity regression test added in #118 is what should have existed in
v0.4.0.
The v0.6.0 snapshot pages and release note are not rewritten. They stay as
published, bound to their own evidence commit, with an archived banner pointing
here. That is what an immutable snapshot means, and it is also what makes this
correction legible: both versions of the story remain readable side by side.
Everything else, unchanged
- The other seven analyzers. CodeQL, Joern, Semgrep CE, OpenTaint, Infer,
FlowDroid, and Pysa report exactly the numbers v0.6.0 published, from exactly
the same report bytes. On the kernels: CodeQL 506 decisive-correct, Joern
270, Semgrep CE 132, OpenTaint 99, Infer 140, FlowDroid 98, Pysa 47. - The modeling and tool-native tiers are unchanged except for Bifrost's six
rows, which are re-run and land on the same cells. - The core population stays at 738 assertions over 13 kernels in 13
languages, with the same case identifiers. - The latency tier was not re-measured. It is frozen at v0.6.0 and its
Bifrost rows keep naming v0.10.7, because that is the build they were
measured on. Re-labelling them to v0.10.8 would assert a measurement nobody
performed. The consequence is stated on both the latency page and the
analyzer-profiles page: in this snapshot Bifrost's radar mixes v0.10.8
correctness axes with a v0.10.7 latency axis, and that is called out rather
than smoothed over.
Amendments first bound by a freeze here
Amendments A13 through A24 were all dated 2026-09-01 and landed on main
after v0.6.0 was published. This is the first freeze to bind the evidence they
govern, which is why this manifest carries 82 reports where v0.6.0's carried
74:
- A13/A14 — Infer joins the modeling matrix (field-evaluated partition) and
the tool-native profile (declining on a measured silence). - A16/A17 — Pysa joins the modeling matrix and the tool-native profile.
- A18/A19/A20 — FlowDroid joins both, with three declared subprocess phases
on its modeling population. - A22/A23 — OpenTaint joins both; its shipped models archive is ruled
shipped product. - A15/A21 — the warm marginal cost, published as a range over retained
repeats. - A24 — per-invocation overhead, estimated for every adapter from a trivial
no-flow fixture and labelled an estimate everywhere it appears.
Amendments A1 through A12 remain in force and are unaffected. None of these
amendments moved a Bifrost cell, and none of them is the reason any number in
the fix-cycle section changed.
Bound evidence
Each report's build identity is the witnessed identity of the binary actually
invoked, including on the rows that decide nothing. The Status column
distinguishes the twenty reports this release produced from the sixty-two it
inherited; a carried-over report's digest is identical to the one v0.6.0 or the
amendment work bound, which is the check that it was not quietly re-run.
| Normalized report | SHA-256 | Analyzer | Cases | Status |
|---|---|---|---|---|
reports/bifrost-c-kernel.json |
4397ed7534c2ec040cb0f2c375a517c63a78989b8567781bb98ec6448a9b60cb |
Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 |
50 | re-run on v0.10.8 |
reports/bifrost-cpp-kernel.json |
6c9dfadd67b3b44cc2fa20fc9e57a2232f5243a8397bbf1d75ce35d3f0d7ec7e |
Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 |
56 | re-run on v0.10.8 |
reports/bifrost-csharp-kernel.json |
25166701816d4fb5ddf6b1d6fe7767df78b8fa21b64dc2f3ebf76bd98a0967c5 |
Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 |
58 | re-run on v0.10.8 |
reports/bifrost-go-kernel.json |
57dcaa2fef4f989c6da2f781aca6e016e9243801603edd0079d1f23d7697f4b2 |
Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 |
58 | re-run on v0.10.8 |
reports/bifrost-java-kernel.json |
c8ca6fea344dc9de8062e737cadf21e9c009b7afa4950f86a8c326be9ba5100f |
Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 |
58 | re-run on v0.10.8 |
reports/bifrost-java-modeling.json |
89afaf65626a9d486e53bf10c6ad2d87337c0ca31a6d0a4a30491d67417d4c7f |
Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 |
24 | re-run on v0.10.8 |
reports/bifrost-java-native.json |
280bc95ddf679abc57c89d439f0b74d183a633f4862d6d97fd1651651ad3112e |
Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 — bifrost 0.10.8 built-in policy packs |
12 | re-run on v0.10.8 |
reports/bifrost-javascript-kernel.json |
290ea5c4f2f07d1a98e9b4f12fd0755a13bccfd04fa97f1316cd5c3337aef469 |
Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 |
58 | re-run on v0.10.8 |
reports/bifrost-javascript-modeling.json |
703d20a6b566378ff0a2292fc03a5e69c8bebff21e0490e9e732fb0e3c104167 |
Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 |
24 | re-run on v0.10.8 |
reports/bifrost-javascript-native.json |
152cab4c6e22a73bd65537afb90b542cf6d179c683457d873996ffdcfcf3f3ad |
Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 — bifrost 0.10.8 built-in policy packs |
12 | re-run on v0.10.8 |
reports/bifrost-kotlin-kernel.json |
30670477836bf8764b35bbd786e7623efd89338b26cda027a17aeed8de947d3a |
Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 |
58 | re-run on v0.10.8 |
reports/bifrost-php-kernel.json |
fec821ef21624001d318292625a3a95f5ce16ea1c547a01fe8178b6edf3bd436 |
Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 |
58 | re-run on v0.10.8 |
reports/bifrost-python-kernel.json |
8308b9d380f348aac268a34a0612742759e220acf85a7fbc6fd30074fa3290a9 |
Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 |
58 | re-run on v0.10.8 |
reports/bifrost-python-modeling.json |
d3c95e9fe03f148c92aae60a3ad0dbc974ab8509a799fa75432faff1773c3702 |
Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 |
24 | re-run on v0.10.8 |
reports/bifrost-python-native.json |
90f3d26984ca4757ca3b8aaf1548ec46974c5ad2b0c3b3718f586a905fcac153 |
Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 — bifrost 0.10.8 built-in policy packs |
12 | re-run on v0.10.8 |
reports/bifrost-ruby-kernel.json |
d269c7948b5e865233563b410035c624e86c486940c6660ad28573701f942817 |
Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 |
58 | re-run on v0.10.8 |
reports/bifrost-rust-kernel.json |
286f53ef2d69a9661904156064312bd54d58ec2f18b5a7bef170379515bf1587 |
Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 |
56 | re-run on v0.10.8 |
reports/bifrost-scala-kernel.json |
821860e4937f78dbd3e367e64900561034ab29e7df4f4e4d2bfd632e8e35500c |
Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 |
58 | re-run on v0.10.8 |
reports/bifrost-smoke.json |
65bdb4c1e0c3849feb085f445092e5ffe4103085e7cde0e737dc2bc182a8f82b |
Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 |
118 | re-run on v0.10.8 |
reports/bifrost-typescript-kernel.json |
1613533181608941d60b2c77b0bf7af3f07d1524620f603c03852c72fec04b49 |
Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 |
58 | re-run on v0.10.8 |
reports/codeql-c-kernel.json |
0bbf4766f6a5fe4a60cbc1fdf6667b942a01456df9c0828485db8d43b201fd4d |
CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 |
50 | carried over |
reports/codeql-cpp-kernel.json |
f314c4185eae8ef7f33feeee76b7c124cc4aef8684c923197bacb19e5190a9a8 |
CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 |
56 | carried over |
reports/codeql-csharp-kernel.json |
313b44a93327652b642893d58ad55283d1cababbf5c92e147e1281bf93ce5d66 |
CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 |
58 | carried over |
reports/codeql-go-kernel.json |
99dc5a3c7c17b27471028afd359830f8ee7fb51f1875c8fee1981d95826fa33d |
CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 |
58 | carried over |
reports/codeql-java-kernel.json |
50418965ee291047161e4fe06d5c765f2f0fad492d6288c585be047276677ddc |
CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 |
58 | carried over |
reports/codeql-java-modeling.json |
14c991ee939e1d4aef3e2850551166cfc3d5de606919aa186a577e4938100975 |
CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 |
24 | carried over |
reports/codeql-java-native.json |
5d7d7b152c9366525b8362438cc83a8c0cf6008b519a9c84f200eca711acee31 |
CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 — 2.26.4 shipped suite codeql/java-queries@1.11.9:codeql-suites/java-security-extended.qls |
12 | carried over |
reports/codeql-javascript-kernel.json |
78ad35bbf7886d47461940128a622540ea4de94001406ba2f0431de48c7763c9 |
CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 |
58 | carried over |
reports/codeql-javascript-modeling.json |
3a908bdc80fb84d2be7c47c75edce0950b688a71342137b8f70b98aa0359311f |
CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 |
24 | carried over |
reports/codeql-javascript-native.json |
bd5fe87f32f7fc30ea5deb365de613d2d49b5db3db57dbe724fc8625007d6db6 |
CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 — 2.26.4 shipped suite codeql/javascript-queries@2.4.4:codeql-suites/javascript-security-extended.qls |
12 | carried over |
reports/codeql-kotlin-kernel.json |
ee7720f6d318834d2f01ecbdeab946cd5ae089cb70a1ffb3f39207259d442fa7 |
CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 |
58 | carried over |
reports/codeql-python-kernel.json |
cd304f94b4d9af5050a8228ff96c4b530fadef1af294b7e59a2855c47b6bab6c |
CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 |
58 | carried over |
reports/codeql-python-modeling.json |
60ff9613a8e5deedd2c1b3f787911ce6fdb94430c3caaa34eb724695b82bcd4e |
CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 |
24 | carried over |
reports/codeql-python-native.json |
2958f4e44c4075463079503bd7c222860076fc159475f76532a258f1aa0bf49e |
CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 — 2.26.4 shipped suite codeql/python-queries@1.8.9:codeql-suites/python-security-extended.qls |
12 | carried over |
reports/codeql-ruby-kernel.json |
10fb9cc1a8d2bfdd7405f7828045217cac00be4951d1e22a3c75e35e46eebcab |
CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 |
58 | carried over |
reports/codeql-rust-kernel.json |
b98733c392bcbca66953bb6fa779232676174c4e07c5fdaadaf3bcd94173082f |
CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 |
56 | carried over |
reports/codeql-typescript-kernel.json |
49eaacb9cf7e5bdb6e49a4b8527885c2ca94c40bffe6df7d4c70f8e1187d4017 |
CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 |
58 | carried over |
reports/flowdroid-java-kernel.json |
df7fbd5263d3d27d95ce4da36688c8d5050dd3844a6096ee258d67f4c3f3ba83 |
FlowDroid 2.15.1, build soot-infoflow-cmd-2.15.1-jar-with-dependencies.jar sha256:51dadead47a173c494c2fa4855b1e8bd3b54e702a2c4b5ed58e60153009ae218; android-34 platform android.jar sha256:6cea1df3efb77103ac3e2beb9bf4718964b0e0869ab16d39d29d5cbae1c147ad; dexed by D8 8.5.35 (build 2c176ec131a9edb97721fb8578b7fbb462376632 from go/r8bot (luci-r8-custom-ci-archive-0-gths)); r8 jar sha256:4733945987ee0a840fafc34080b135259e01678412e07212b23f706334290294 |
58 | carried over |
reports/flowdroid-java-modeling.json |
b54c7a9827d2a8b45bd3952e42fd516ca2e7a9011d932aa240232d43d6100b83 |
FlowDroid 2.15.1, build soot-infoflow-cmd-2.15.1-jar-with-dependencies.jar sha256:51dadead47a173c494c2fa4855b1e8bd3b54e702a2c4b5ed58e60153009ae218; android-34 platform android.jar sha256:6cea1df3efb77103ac3e2beb9bf4718964b0e0869ab16d39d29d5cbae1c147ad; dexed by D8 8.5.35 (build 2c176ec131a9edb97721fb8578b7fbb462376632 from go/r8bot (luci-r8-custom-ci-archive-0-gths)); r8 jar sha256:4733945987ee0a840fafc34080b135259e01678412e07212b23f706334290294 |
24 | new since v0.6.0 |
reports/flowdroid-java-native.json |
6671f301cdcf1a28f4b5c125d9088b2ca8a056c1eeb4a4a52ca1f28366192f99 |
FlowDroid 2.15.1, build soot-infoflow-cmd-2.15.1-jar-with-dependencies.jar sha256:51dadead47a173c494c2fa4855b1e8bd3b54e702a2c4b5ed58e60153009ae218; android-34 platform android.jar sha256:6cea1df3efb77103ac3e2beb9bf4718964b0e0869ab16d39d29d5cbae1c147ad — FlowDroid 2.15.1 shipped SourcesAndSinks.txt catalog (extracted verbatim from the pinned soot-infoflow-cmd jar) and default summariesManual taint wrapper |
12 | new since v0.6.0 |
reports/flowdroid-kotlin-kernel.json |
44bb26f4541c5d42b3be8cab06d47a7f29775bf273998f038166639489e66634 |
FlowDroid 2.15.1, build soot-infoflow-cmd-2.15.1-jar-with-dependencies.jar sha256:51dadead47a173c494c2fa4855b1e8bd3b54e702a2c4b5ed58e60153009ae218; android-34 platform android.jar sha256:6cea1df3efb77103ac3e2beb9bf4718964b0e0869ab16d39d29d5cbae1c147ad; dexed by D8 8.5.35 (build 2c176ec131a9edb97721fb8578b7fbb462376632 from go/r8bot (luci-r8-custom-ci-archive-0-gths)); r8 jar sha256:4733945987ee0a840fafc34080b135259e01678412e07212b23f706334290294 |
58 | carried over |
reports/infer-c-kernel.json |
35a5f9de818f815fb4b682643a3f0f512784043ac0962c4c6e30e05abe19110c |
Infer v1.3.0, build infer:v1.3.0 bin-sha256:17ed4818dadda60124e083a1e82124f104092e70c5e6d764551581a375eabf62 |
48 | carried over |
reports/infer-cpp-kernel.json |
fc3b5fd70a89dbe9bd400c3a1f7d8eaf44f461fd02a1f3cf19264ec67cd98199 |
Infer v1.3.0, build infer:v1.3.0 bin-sha256:17ed4818dadda60124e083a1e82124f104092e70c5e6d764551581a375eabf62 |
56 | carried over |
reports/infer-java-kernel.json |
9eb9d7ce745f88bf2e6eed406de14201ccc4db8e592a1c501f7294cca590bdf4 |
Infer v1.3.0, build infer:v1.3.0 bin-sha256:17ed4818dadda60124e083a1e82124f104092e70c5e6d764551581a375eabf62 |
58 | carried over |
reports/infer-java-modeling.json |
8045827d04ddda46dd17d261468099f56e48471fe9ba7cd589d577913c1c4ec7 |
Infer v1.3.0, build infer:v1.3.0 bin-sha256:17ed4818dadda60124e083a1e82124f104092e70c5e6d764551581a375eabf62 |
24 | new since v0.6.0 |
reports/infer-java-native.json |
ad6461b1b1fa5573f127fa1fb169e7ded76c4a0c30cf19aafc297e269a457ce2 |
Infer v1.3.0, build infer:v1.3.0 bin-sha256:17ed4818dadda60124e083a1e82124f104092e70c5e6d764551581a375eabf62 — v1.3.0 shipped Pulse checker, no taint configuration |
12 | new since v0.6.0 |
reports/joern-java-kernel.json |
8f74bb4d958ba21cfc236a9382b4b67a09fc5ebfd16d71b7e8bc3a112f7b722e |
Joern 4.0.614, build joern-cli:4.0.614 |
58 | carried over |
reports/joern-java-modeling.json |
21fb1d444a2db6dd5dbd8c1aba56abd2d728a1aa616f049a417ebc73e3fee7d8 |
Joern 4.0.614, build joern-cli:4.0.614 |
24 | carried over |
reports/joern-java-native.json |
a438c1ecdc09f23db4cdb14dea45fc99ba6658af4d9d887c9d7852e5d2ac2aa8 |
Joern 4.0.614, build joern-cli:4.0.614 — 4.0.614 DefaultSemantics only |
12 | carried over |
reports/joern-javascript-kernel.json |
9f54af854f6b0cdc864b8017c2ccd3ad9f3b2cf952e2376b4c988c60e90e9462 |
Joern 4.0.614, build joern-cli:4.0.614 |
58 | carried over |
reports/joern-javascript-modeling.json |
cd6372a8fc9b462a51a460e23d344103bae384fe92cbe4e37ce641686c265d36 |
Joern 4.0.614, build joern-cli:4.0.614 |
24 | carried over |
reports/joern-javascript-native.json |
b8f493cdb3761d9ee676bfac80ba0b83377750ef970d2d845a06107d4987ee44 |
Joern 4.0.614, build joern-cli:4.0.614 — 4.0.614 DefaultSemantics only |
12 | carried over |
reports/joern-php-kernel.json |
153d0fb50e2cbe7241aaf7eb6d1a5a5b092fb11c39bf9d0bdfc54838608bb4ed |
Joern 4.0.614, build joern-cli:4.0.614 |
58 | carried over |
reports/joern-python-kernel.json |
811b6d11d5f9ecde11d4c1c35bef55efb62799984dce9ecc08a46317fd0ff50a |
Joern 4.0.614, build joern-cli:4.0.614 |
58 | carried over |
reports/joern-python-modeling.json |
3e05499c361b7cf797281ab94cb5cc655d5ce306430a95b396f99c7b0f851e75 |
Joern 4.0.614, build joern-cli:4.0.614 |
24 | carried over |
reports/joern-python-native.json |
d7015cc6c9b14ee41ba7c05f547909c8b67a48df076d76c00758401ae4fb296e |
Joern 4.0.614, build joern-cli:4.0.614 — 4.0.614 DefaultSemantics only |
12 | carried over |
reports/joern-ruby-kernel.json |
9f2b18c4d168a3bf1b1c8c2adf885ac7416e247081a366980f144a683a27ea3b |
Joern 4.0.614, build joern-cli:4.0.614 |
58 | carried over |
reports/joern-rust-kernel.json |
465269d73a072957b318fdac73768d5e4fb538ff9f3e31c007f88f6c96bcf055 |
Joern 4.0.614, build joern-cli:4.0.614 |
54 | carried over |
reports/opentaint-java-kernel.json |
de32158291e6ddb9e10f728aba7b2d2a3a39806fb4fa4870f8c27d9f97fbf7db |
OpenTaint analyzer/2026.08.27.17eb0fe, build opentaint-project-analyzer.jar sha256:811bdb22786e539c9aabdce5bef91f0c6521cc099adbe2720e6a840c09badf54; opentaint-models.tar.gz sha256:c2a8fb0bbc3b6d59ed6db0c62732ff9a6f0f491d515cc2247932f2dd78cbb9f5 |
58 | carried over |
reports/opentaint-java-modeling.json |
c5710db993b1557f8d1e96a1bd459cb6404a0d2ae74554bd83e2a945bd537805 |
OpenTaint analyzer/2026.08.27.17eb0fe, build opentaint-project-analyzer.jar sha256:811bdb22786e539c9aabdce5bef91f0c6521cc099adbe2720e6a840c09badf54; opentaint-models.tar.gz sha256:c2a8fb0bbc3b6d59ed6db0c62732ff9a6f0f491d515cc2247932f2dd78cbb9f5 |
24 | new since v0.6.0 |
reports/opentaint-java-native.json |
70525abc5a69f7dbb7354e393d864d0e0bf388be1888cc506670bf30ed345647 |
OpenTaint analyzer/2026.08.27.17eb0fe, build opentaint-project-analyzer.jar sha256:811bdb22786e539c9aabdce5bef91f0c6521cc099adbe2720e6a840c09badf54; opentaint-models.tar.gz sha256:c2a8fb0bbc3b6d59ed6db0c62732ff9a6f0f491d515cc2247932f2dd78cbb9f5 — analyzer/2026.08.27.17eb0fe shipped models archive only — no rule set |
12 | new since v0.6.0 |
reports/opentaint-kotlin-kernel.json |
1fb872fea820eff6854141f77d883ef1312e1d498b0c4e850cbbe4788ce616ea |
OpenTaint analyzer/2026.08.27.17eb0fe, build opentaint-project-analyzer.jar sha256:811bdb22786e539c9aabdce5bef91f0c6521cc099adbe2720e6a840c09badf54; opentaint-models.tar.gz sha256:c2a8fb0bbc3b6d59ed6db0c62732ff9a6f0f491d515cc2247932f2dd78cbb9f5 |
58 | carried over |
reports/pysa-python-kernel.json |
125faf9d9127b71b9b0d2b0d55229bdd26136c0e151fc2c2f555abcf500d609a |
Pysa 0.10.0, build pyre-check:0.10.0 pyre.bin-sha256:035a206349193dafdac70ec4020a992add5d88e60dee76163cf39ffb0b8fe8a3 pyrefly:1.2.0 pyrefly-sha256:6b460273720d857142be562d2c0c607e8ed8e5e752ab575b5c00ea3f735d8caa |
58 | carried over |
reports/pysa-python-modeling.json |
32155b8d129bc2bd34f5ddb52f72ffdb9a88c23425fca9994d154194f37e2dbb |
Pysa 0.10.0, build pyre-check:0.10.0 pyre.bin-sha256:035a206349193dafdac70ec4020a992add5d88e60dee76163cf39ffb0b8fe8a3 pyrefly:1.2.0 pyrefly-sha256:6b460273720d857142be562d2c0c607e8ed8e5e752ab575b5c00ea3f735d8caa |
24 | new since v0.6.0 |
reports/pysa-python-native.json |
c3ad2ee142ea248c4ecfd111dda9efc98b2c83972f68d4570d889d0946e4fbc2 |
Pysa 0.10.0, build pyre-check:0.10.0 pyre.bin-sha256:035a206349193dafdac70ec4020a992add5d88e60dee76163cf39ffb0b8fe8a3 pyrefly:1.2.0 pyrefly-sha256:6b460273720d857142be562d2c0c607e8ed8e5e752ab575b5c00ea3f735d8caa — Pysa (pyre-check 0.10.0 + Pyrefly 1.2.0) shipped taint model suite lib/pyre_check/taint with --no-verify (suite-sha256:1c2e41c525178d9f332e0b749ecedc5e4293fb570d0a0ab1708c41da7e49594c) |
12 | new since v0.6.0 |
reports/semgrep-c-kernel.json |
5192f0b66650605bdbba4e1ec3e4d0e2da232490bdaca08a14434737dfb9bdc4 |
Semgrep CE 1.175.0, build semgrep-oss:1.175.0 |
48 | carried over |
reports/semgrep-cpp-kernel.json |
40de77a28a692227d8081c113ef6b39a6c237da73aff74c7daee77a3b6f0544b |
Semgrep CE 1.175.0, build semgrep-oss:1.175.0 |
56 | carried over |
reports/semgrep-go-kernel.json |
77d87ca7eee69d7b1384f0d09a32d82c7d5823023875d651c46338275906e961 |
Semgrep CE 1.175.0, build semgrep-oss:1.175.0 |
58 | carried over |
reports/semgrep-java-kernel.json |
05ab32127cb788dd2b6d844015c00852a0c32cb50db6b8d5587a59cfbaa67189 |
Semgrep CE 1.175.0, build semgrep-oss:1.175.0 |
58 | carried over |
reports/semgrep-java-modeling.json |
94a5eda43ab2aab5ab47b44e80907ab18dd4796a2f2a364bbac621d45cd19c63 |
Semgrep CE 1.175.0, build semgrep-oss:1.175.0 |
24 | carried over |
reports/semgrep-java-native.json |
f20ab62be7d8d3e4a6678ac07041d691b36d53ea66d8bb1c44fce4182dbb71d0 |
Semgrep CE 1.175.0, build semgrep-oss:1.175.0 — 1.175.0 over the pinned snapshot vendored from https://github.com/semgrep/semgrep-rules into adapters/semgrep/native/java |
12 | carried over |
reports/semgrep-javascript-kernel.json |
ae4527e7a74c5d8f51d9549db95bd271b12f672a6d39f86adb71d4f9353f21f3 |
Semgrep CE 1.175.0, build semgrep-oss:1.175.0 |
58 | carried over |
reports/semgrep-javascript-modeling.json |
5745951d82b9dacfb339ecc9aeb44af4975bf1162428b3a3d76cfb3e096739a7 |
Semgrep CE 1.175.0, build semgrep-oss:1.175.0 |
24 | carried over |
reports/semgrep-javascript-native.json |
249bd7e020955ab8f181a04ce1b257fb4a72ed93ac7d4eabaec0b572331db0ac |
Semgrep CE 1.175.0, build semgrep-oss:1.175.0 — 1.175.0 over the pinned snapshot vendored from https://github.com/semgrep/semgrep-rules into adapters/semgrep/native/javascript |
12 | carried over |
reports/semgrep-kotlin-kernel.json |
3fd452bdb1b7ad0f2d310952bf04f64a1245e70cfef2e4f49c735d1798fd114e |
Semgrep CE 1.175.0, build semgrep-oss:1.175.0 |
58 | carried over |
reports/semgrep-php-kernel.json |
b04ee7111c66f3cab105ae0bf992495f59e86faf7153f08890a16650f712923e |
Semgrep CE 1.175.0, build semgrep-oss:1.175.0 |
58 | carried over |
reports/semgrep-python-kernel.json |
6341e3f6321e2fa53b352f1a9afe39665ae4284190f2ab7257c709a23e952648 |
Semgrep CE 1.175.0, build semgrep-oss:1.175.0 |
58 | carried over |
reports/semgrep-python-modeling.json |
a269705d853a642979a357b9a03fd698cf2bc3e853c9afff1513e9c4b0001086 |
Semgrep CE 1.175.0, build semgrep-oss:1.175.0 |
24 | carried over |
reports/semgrep-python-native.json |
a0187f8a2fb1212c516ddf3095ee347f47e82eeaeb9c9a98dad1c58e513c8216 |
Semgrep CE 1.175.0, build semgrep-oss:1.175.0 — 1.175.0 over the pinned snapshot vendored from https://github.com/semgrep/semgrep-rules into adapters/semgrep/native/python |
12 | carried over |
reports/semgrep-ruby-kernel.json |
deae3cd4a04bc9dbf9f5fb1d6e2d0c8dbdefd0e2b9c561a9f7544ce130097529 |
Semgrep CE 1.175.0, build semgrep-oss:1.175.0 |
58 | carried over |
reports/semgrep-rust-kernel.json |
7b93011a586b390a0a212af70653b0c52a20dc1c535b5d9c1c78ac3ff14b36e7 |
Semgrep CE 1.175.0, build semgrep-oss:1.175.0 |
54 | carried over |
reports/semgrep-typescript-kernel.json |
691658e531af76e919e418700e60067501e6a494f4057af36520b0d04b6a5ee6 |
Semgrep CE 1.175.0, build semgrep-oss:1.175.0 |
58 | carried over |
Reproduction
git checkout v0.6.1 # frozen benchmark revision (evidence commit)
# then check out the merge commit carrying reports/freeze.json for this release
cargo run -- validate-freeze reports/freeze.json
cargo run -- generate-results --manifest reports/freeze.json --output-directory results --checkRe-executing the Bifrost slices — which produces new evidence, and therefore a
new freeze, not this one:
for kernel in c cpp csharp go java javascript kotlin php python ruby rust scala typescript; do
cargo run -- run-bifrost-$kernel-kernel --bifrost <bifrost-binary>
done
cargo run -- run-bifrost-smoke --bifrost <bifrost-binary>
for language in java javascript python; do
cargo run -- run-bifrost-$language-modeling --bifrost <bifrost-binary>
cargo run -- run-bifrost-$language-native --bifrost <bifrost-binary>
doneThe other seven adapters' re-execution is unchanged from v0.6.0's; see
docs/releases/v0.6.0.md.
Immutability
This snapshot is immutable. Corrected evidence creates a new freeze with a new
release name and digests; the v0.1.0 through v0.6.0 manifests and evidence
remain available at their release commits for audit, including v0.6.0's
account of the java-direct disagreement that this release corrects. This
release has no DOI and no external review claim.