v2025.8.5.12 - Zero False Positives from Dependencies

🎉 Major Release: Zero False Positives from Dependencies

This release fixes a critical issue where users were seeing 2500+ false positives from pip-installed packages in their virtual environments. Now MEDUSA only scans YOUR code, not third-party dependencies.

✨ Highlights

• Zero False Positives - Virtual environments and pip packages are now automatically excluded
• Smart Config Merging - User exclusions merge with mandatory exclusions (instead of replacing)
• Auto-Detect Virtual Environments - Automatically finds venvs via pyvenv.cfg marker
• Updated Security Tools - Latest versions of semgrep, trivy, ruff, and more

🔧 What Changed

Exclusion System Overhaul

• Added 50+ default exclusion patterns for all package managers (npm, pip, cargo, go, etc.)
• Config now merges user paths with mandatory exclusions
• Auto-detects virtual environment directories at scan time
• Improved pattern matching for nested paths like lib/python3.x/site-packages/

Code Quality

• Fixed 11 bare except: clauses with specific exception types
• Improved exception handling in react2shell_scanner.py
• Added YAML document start headers to example files

📦 Updated Dependencies

Tool	Previous	New
semgrep	1.144.0	1.145.0
trivy	0.67.2	0.68.1
ruff	0.14.5	0.14.8
black	25.11.0	25.12.0
mypy	1.18.2	1.19.0
pytest	9.0.1	9.0.2
coverage	7.11.3	7.13.0

📥 Installation

pip install --upgrade medusa-security

🙏 Thank You

Thanks to everyone who reported the false positive issue. This release makes MEDUSA much more practical for real-world use.

---

Full Changelog: v2025.8.5.11...v2025.8.5.12