Skip to content

v1.2.0 - Pure-Go Binary PDF Export, .loryignore, MCP Hardening & Complete Issue Resolution

Choose a tag to compare

View all tags
@parrotassassin15 parrotassassin15 released this 05 Nov 01:11
· 5 commits to main since this release
v1.2.0
69f934d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Overview

Lorikeet Lory CLI v1.2.0 is a major milestone release delivering pure-Go binary PDF reporting, .loryignore support, flexible inline suppressions, Model Context Protocol (MCP) server security hardening, CLI argument reordering, and the complete resolution of all 19 initial GitHub issues and technical debt items across 24 pull requests (#20 through #44).

Key Highlights

1. Pure-Go Binary PDF 1.4 Export Engine (lory export --format pdf)

  • Implemented a zero-dependency, pure-Go PDF 1.4 generator in pkg/export/pdf.go.
  • Produces multi-page executive security and compliance audit reports with color-coded severity breakdowns (Critical, High, Medium, Low), detailed vulnerability disclosures, and remediation instructions.
  • Requires no external CLI tools, headless browsers, or CGO bindings.

2. Flexible Suppressions & .loryignore File Support

  • Added native .loryignore file parsing across pkg/analyzer, pkg/reviewer, and cmd/diff.
  • Supports directory, wildcard, and glob patterns (e.g. *.min.js, vendor/, test/fixtures/).
  • Added multi-syntax inline suppression comments across all supported languages:
    • // lory:ignore or /* lory:ignore */
    • # lory:suppress or <!-- lory:suppress -->
    • Multi-line block suppressions (lory:suppress-start ... lory:suppress-end) and whole-file ignore directives (lory:ignore-file).

3. MCP Server Hardening & Contextual Remediation (mcp serve)

  • Added strict URL scheme validation (http/https) returning JSON-RPC error code -32602 for non-HTTP URI targets.
  • Added contextual remediation guidance in lory_explain_finding tailored specifically to CWEs (CWE-89 SQLi, CWE-78 Command Injection, CWE-798 Hardcoded Secrets, CWE-918 SSRF, CWE-79 XSS, and CWE-311 Cleartext Transmission).
  • Thread-safe response writing and token preservation during live web audits.

4. Git Diff & CLI Usability Improvements

  • Added support for --cached and --staged flags in lory diff to review staged index changes.
  • Flexible argument ordering: git revisions can precede flags (e.g., lory diff HEAD --fix, lory scan <target> --format json, lory badge <target> --theme dark).
  • Automatically skips deleted files from diff reviews and avoids null JSON arrays for clean runs ("findings": []).

5. Precision SAST Route & Sink Attribution

  • Replaced synthetic baseline finding injection with clean-pass semantics on secure codebases.
  • Route correlation now precisely anchors sinks to the closest preceding enclosing route in the same source file (r.LineNumber <= wb.LineNumber).
  • Non-route sinks (utility libraries, backend workers) are cleanly isolated as Route: "N/A" / Method: "N/A" with descriptive comment PoCs instead of arbitrary route inheritance.

Pull Request & Issue Resolution Index

Pull Request Scope / Resolved Issue
#20 Remove synthetic baseline finding injection on clean repositories (Fixes #1)
#21 Return error on connection failures and unreachable hosts during retest (Fixes #2)
#22 Dynamically construct replay vectors from finding registry (Fixes #3)
#23 Ignore regex definitions and test files in SAST sink analysis (Fixes #4)
#24 Correlate findings with routes declared in same source file (Fixes #5)
#25 Scan target argument positioning for review flag parsing (Fixes #6)
#26 Review command formatted JSON array output (Fixes #7)
#27 Filter findings by exact status matching (Fixes #8)
#28 Improve web target detection heuristic (Fixes #9)
#29 Retain auth token during MCP lory_scan_target execution (Fixes #10)
#30 Load token from credentials.json in GetToken fallback (Fixes #11)
#31 Support all recognized language extensions in repository analyzer (Fixes #12)
#32 Filter findings by --min-severity threshold (Fixes #13)
#33 Skip deleted files from git diff review list (Fixes #14)
#34 Parse review flags and forward to RunReview in diff (Fixes #15)
#35 Allow target argument to precede flags in lory badge (Fixes #16)
#36 Validate target URL scheme and provide CWE-specific advice in MCP (Fixes #17)
#37 Deduplicate SARIF driver rules and update driver version to 1.1.1 (Fixes #18)
#38 Tech debt rollup: Shorthand scan, binary PDF export, user-agent update (Fixes #19)
#39 Enclosing route attribution & non-route sink isolation
#40 Support --cached/--staged flags and reorder diff arguments
#41 Partition scan arguments, initialize empty findings array, and sync help flags
#42 Native .loryignore file, flexible suppressions, and documentation sync
#43 Unify .loryignore wildcard filtering across review and diff commands
#44 Bump version to 1.2.0 across CLI, packages, tests, and documentation

Installation

One-line Install (Linux & macOS)

curl -fsSL https://lorikeetsecurity.com/install.sh | bash

Direct Downloads

Platform Architecture Binary
Linux x86_64 (amd64) lory-linux-amd64
Linux AArch64 (arm64) lory-linux-arm64
macOS Intel (amd64) lory-darwin-amd64
macOS Apple Silicon (arm64) lory-darwin-arm64
Windows x86_64 (amd64) lory-windows-amd64.exe

Verification Checksums

All binary assets are cryptographically verified in checksums.txt.

Assets 8
Loading