Skip to content

v2026.5.4 — FP Patterns YAML Refactor

Choose a tag to compare

View all tags
@rosschurchill rosschurchill released this 16 Apr 20:58
· 59 commits to main since this release
v2026.5.4
2fa9a38

MEDUSA v2026.5.4 — FP Patterns YAML Refactor

Summary

Pure refactor release. Moves 583 false positive filter patterns from a 6,746-line Python file (medusa/core/fp_patterns_db.py) into 27 per-scanner YAML files under medusa/core/fp_patterns/. Zero behavior change — the regression benchmark produces byte-identical findings.

Why

  • Data/logic separation. FP patterns were data masquerading as Python code. YAML is the right format for data.
  • Editable without a Python diff. Contributors tuning FP rules no longer need to touch Python. A new pattern is one YAML entry.
  • Countable with standard tools. Pattern counts are now trivially derivable (grep, yq) — previously required AST parsing.
  • Attack surface slightly reduced. yaml.safe_load rejects arbitrary Python object construction; the old Python data file was executable code at import time.

What Changed

Added

  • medusa/core/fp_patterns/ — 27 YAML files (26 per-scanner + _universal.yaml for cross-scanner patterns)
  • load_known_fp_patterns() loader in fp_filter.py with strict schema validation
  • FPPatternSchemaError — raised on unknown keys, invalid FPReason enum values, or missing required fields
  • RULE_PROMOTION.md — documented workflow for promoting rules from medusa-rules into production, with smoke testing and benchmark validation

Removed

  • medusa/core/fp_patterns_db.py (6,746 LOC) — data migrated to YAML

Changed

  • README.md — FP pattern count corrected: 514 → 583 (97.7% FP reduction rate)
  • pyproject.toml — package-data now ships core/fp_patterns/*.yaml

Behavior Guarantees

Every one of these was verified before release:

  • KNOWN_FP_PATTERNS loads 583 patterns (matches source file count)
  • FalsePositiveFilter._FP_BY_SCANNER bucket dict is byte-identical to pre-migration
  • Known duplicate pattern names (go_unsafe_package, shellcheck_single_quotes) preserved — not deduped
  • Regression benchmark: 7 issues, 291 FPs filtered, 97.7% reduction — unchanged
  • All 40 smoke tests pass (test_basic, test_fp_filter, test_regression)

Net Impact

  • −2,713 LOC repo-wide
  • −6,746 LOC Python
  • +3,505 LOC YAML
  • +141 LOC loader

Security Notes

No CVEs. Migration is security-neutral with a marginal improvement: YAML data files cannot execute code; the old Python data file could.

Upgrade

pip install --upgrade medusa-security

No config changes required. No breaking API changes.

Assets 4
Loading