Skip to content

v2026.2.3 - Performance Overhaul + Launch Ready

Choose a tag to compare

View all tags
@rosschurchill rosschurchill released this 15 Feb 19:21
· 97 commits to main since this release
v2026.2.3
47f79d8

MEDUSA v2026.2.3 - Performance Overhaul + Launch Ready

Two months of work culminating in the launch-ready release.

Performance (52% faster scans)

  • Single-pass file discovery — 57 separate rglob() calls replaced with one os.walk() traversal
  • Scanner pre-mapping cache — first 8KB of each file read once, shared across all scanners
  • Pre-compiled regex patterns — FP filter and OWASP scanner patterns compiled at class level
  • Live progress fix — chunksize capped at 8 for responsive progress on 4,000+ file projects
  • Self-scan: 17.1s → 8.2s (52% faster)
  • Large project (4,124 files, 751K LOC): 13,711s → 11,976s (12.7% faster)

New Scanners & Rules

  • PromptInjectionCodeScanner (PIC001-PIC008) — f-string injection, ChatML tokens, role manipulation
  • DatasetInjectionScanner (DSI001-DSI008) — CSV, JSON, JSONL poisoning detection
  • 91 agent protocol rules — UCP, AP2, ACP vulnerability detection
  • 133 critical CVEs — CVEMiner database (LangChain, PyTorch, MCP, Log4Shell, XZ Utils)
  • React2Shell merged into CriticalCVEScanner

False Positive Filter (93.9% reduction)

  • 430 patterns (up from 255)
  • 5 new patterns from OpenClaw benchmark validation
  • Regex pre-compilation for hot-path methods
  • Real-world tested: 12,261 raw findings → 825 post-filter on 4,124-file codebase

Structural Refactoring

  • Split mcp_config_scanner god method (CC=98 → 7 sub-methods)
  • Split cli.py init() (CC=91 → 4 functions)
  • Extracted 4,684 lines of FP pattern data to fp_patterns_db.py
  • Removed 189 lines dead code from parallel.py
  • Fixed config P0 bug (missing IDE fields for Codex/Copilot)

Install

pip install medusa-security==2026.2.3
medusa scan .

Full Changelog: https://github.com/Pantheon-Security/medusa/blob/main/CHANGELOG.md

Assets 2
Loading