PatchFlow CLI v0.1.7

PatchFlow CLI v0.1.7

Capability and benchmark statements are governed by the
dated claim registry.
Historical benchmark results remain available in the
benchmark repository,
including their methodology and limitations.

Changelog

New Features

• 725435c: feat(cross-language): function boundary detection for all 7 languages + CWE-based safe-pattern suppression + regression corpus for all 6 taint frameworks (@malik111110)
• 35bd0b1: feat(doctor+ci): add config round-trip check to doctor and CI release gate (@malik111110)
• e3b1cc4: feat(init): generate a working .patchflow/rules.yaml with framework detection (@malik111110)
• 405f50d: feat(taint): add Go taint engine support + framework taint rules for Echo, Gin, Laravel, Symfony (@malik111110)
• 2224cd5: feat(taint): inline sanitizers, closure capture, expanded sources/sinks, taint-specific smoke test assertions (@malik111110)
• 9758555: feat: add five-minute onboarding launch gate (#21) (@malik111110)

Bug Fixes

• 097adc5: fix(config): resolve --config schema conflict between mode-override and custom-rules loaders (@malik111110)
• 6d6dcca: fix(install): resolve PATH issues and add containerized install test matrix (@malik111110)
• ea2cbe5: fix(pathutil): make output-path validation error actionable (@malik111110)
• 61e19e2: fix(taint): PHP member_call_expression/scoped_call_expression support + Go sanitizers + sinkMatches for -> (@malik111110)
• aecc89d: fix(taint): suppress -IP interprocedural findings with base-rule safe patterns + async def function boundaries (@malik111110)
• fda2aa2: fix(validator): reconcile supported languages and rule ID regex with docs (@malik111110)
• 427232e: fix: enforce machine-readable output contracts (@malik111110)
• dd248ae: fix: keep OCI image paths portable (@malik111110)
• e7ced25: fix: restore CLI release gates (@malik111110)

Other Changes

• 1d64ddf: Merge pull request #10 from Patchflow-security/agent/canonical-public-repository (@malik111110)
• b0cbd6c: Merge pull request #11 from Patchflow-security/agent/community-health-files (@malik111110)
• 6d2745e: Merge pull request #20 from Patchflow-security/agent/public-roadmap (@malik111110)
• 1675c28: Merge remote-tracking branch 'origin/main' into agent/community-health-files (@malik111110)
• 09d12e5: Merge remote-tracking branch 'origin/main' into agent/public-roadmap (@malik111110)
• 358e438: Merge remote-tracking branch 'origin/main' into agent/public-roadmap (@malik111110)
• 3fd6e36: PatchFlow CLI v0.1.2 — local-first security scanner with framework-aware SAST (@malik111110)
• 56d7909: Prepare five-minute onboarding and the reproducible public launch (#23) (@malik111110)
• 113a1ef: test(regression): add Safe-pip-backend regression corpus to release smoke matrix (@malik111110)
• 9286b6e: test(scan): add end-to-end integration tests for scan run --config (@malik111110)

PatchFlow CLI v0.1.6

PatchFlow CLI v0.1.6

Benchmark Results (v1.0)

• 18 intentionally vulnerable repos: 100% recall, 918K LOC, 19 CWE categories
• 5 historical CVE repos: 100% recall, 387K LOC
• 10 clean repos: 0.094 HC/KLOC, 720K LOC

See Benchmark Report v1.0 for details.

Changelog

Other Changes

• c5e304a: release: v0.1.6 — fix silent-wrong-output bugs + output-correctness test suite (@malik111110)

PatchFlow CLI v0.1.5

What's New

LICENSE File Crawling + Text-Based License Detection

When all registry API lookups fail or return uninformative results (NOASSERTION, Other, UNKNOWN), the CLI now fetches the raw LICENSE file directly from the source repository and identifies the license using text-based detection — similar to GitHub's licensee.

How it works

1. Fetch: Downloads the raw LICENSE file from raw.githubusercontent.com — tries multiple file names (LICENSE, LICENSE.md, LICENSE.txt, COPYING, UNLICENSE, NOTICE) and multiple branches (main, master, HEAD, develop, trunk)
2. Normalize: Lowercases the text, strips punctuation, removes copyright lines (which contain project-specific names/dates that reduce matching accuracy)
3. Match: Compares against 35+ known license signatures using bigram n-gram similarity (Dice's coefficient)
4. Result: Returns the SPDX identifier if confidence >= 50%

Supported licenses (text-based detection)

MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, MPL-2.0, GPL-2.0, GPL-3.0, LGPL-2.1, LGPL-3.0, AGPL-3.0, Unlicense, BSL-1.0, CC0-1.0, Zlib, WTFPL, Python-2.0, Ruby, EPL-1.0, EPL-2.0, CDDL-1.0, Artistic-2.0, PostgreSQL, OpenSSL, Vim, PHP-3.01, BUSL-1.1, SSPL-1.0, EUPL-1.2, AFL-3.0, CC-BY-4.0, CC-BY-SA-4.0, Beerware, 0BSD, BlueOak-1.0.0

Additional fallbacks

• PyPI repository URL extraction: When PyPI has no license, extracts GitHub repo URL from project_urls (Homepage, Source, Repository)
• RubyGems repository URL extraction: When RubyGems has no license, extracts GitHub repo URL from source_code_uri, homepage_uri, repository_uri
• GitHub API + LICENSE crawl: When the GitHub API returns NOASSERTION, falls back to fetching the raw LICENSE file

Benchmark Results

Metric	Original	v0.1.4	v0.1.5	Total Improvement
Coverage	78.2%	89.6%	95.6%	+17.4pp
Unknown licenses	733	353	156	78.7% reduction
License findings	736	363	184	75.0% reduction

v0.1.4 -> v0.1.5 alone: unknowns reduced by 55.8% (353 -> 156)

Per-project highlights (v0.1.4 -> v0.1.5)

Project	v0.1.4 Unknown	v0.1.5 Unknown	Resolved
log4j-old (Java)	264	95	169 via LICENSE crawling
lodash (JS)	52	34	18 via LICENSE crawling
rails-v5.2.1 (Ruby)	24	14	10 via RubyGems repo URL + LICENSE crawling

Installation

# Homebrew
brew install patchflow-security/tap/patchflow

# Scoop (Windows)
scoop install patchflow

# Direct download
curl -fsSL https://raw.githubusercontent.com/Patchflow-security/patchflow-cli/main/scripts/install.sh | bash

Verify

patchflow version --json

Full Changelog: v0.1.4...v0.1.5

PatchFlow CLI v0.1.4

What's New

Embedded OCI Image Scanner

• No external Trivy dependency — the image scanner is now embedded directly in the CLI as internal/imagescan/
• Native Go, OCI-first scanner with vulnerability matching (NVD, OSV, Alpine, Debian, Ubuntu)
• New flags: --input, --platform, --no-vulns, --severities, --format, --output
• Image reference validation with security checks

License Detection Overhaul

Comprehensive improvements to license gathering across all ecosystems:

Metric	Before	After	Improvement
Coverage	78.2%	89.6%	+11.4pp
Unknown licenses	733	353	51.8% reduction
License findings	736	363	50.7% reduction

Benchmarked across 10 real-world projects with 3,270+ dependencies.

Go

• golang.org/x/* modules: GitHub mirror mapping + BSD-3-Clause fallback
• gopkg.in/* modules: 40+ repo mappings (yaml.v3, check.v1, ini.v1, etc.)
• google.golang.org/* modules: protobuf, grpc, genproto, api, appengine
• Go module proxy fallback for non-GitHub modules (VCS URL extraction)

Java/Maven

• POM file parsing from Maven Central with <licenses> extraction
• SCM URL extraction from POM to GitHub license lookup
• Version resolution via search API (3 query formats) for "unknown" versions
• 130+ groupId to GitHub repo mappings (Apache, Spring, Hibernate, JBoss, Google, Square, etc.)

npm

• Repository URL extraction from npm registry metadata (string + object formats)
• Full package metadata fallback for repo URL when version-specific response lacks it
• Homepage URL fallback for GitHub repo discovery

Python

• PyPI classifier-based fallback (40+ classifier to SPDX mappings)
• Empty version handling (uses no-version endpoint)
• pyproject.toml extras parsing fixed (test = ["pytest"] no longer creates bogus dependency)
• pyproject.toml inline table license parsing (license = {file = "..."})

Ruby

• Gemfile parser fixed for commas and quotes in package entries
• Version constraint cleanup (~>, >=, etc. stripped before lookup)
• source_code_uri, homepage_uri, repository_uri fallback for GitHub license

SPDX Classification

• Mapping tables expanded from ~25 to 300+ entries
• AFL licenses (1.1, 1.2, 2.0, 2.1, 3.0) added to permissive
• Short GPL forms (GPL-2, GPL-3, GPLV2, GPLV3) added to copyleft
• "Other"/"UNKNOWN"/"NOASSERTION" treated as uninformative, triggers GitHub fallback
• Weak copyleft (LGPL) checked before strong copyleft (GPL) to fix substring misclassification

Installation

# Homebrew
brew install patchflow-security/tap/patchflow

# Scoop (Windows)
scoop install patchflow

# Direct download
curl -fsSL https://raw.githubusercontent.com/Patchflow-security/patchflow-cli/main/scripts/install.sh | bash

Verify

patchflow version --json

Full Changelog: v0.1.3...v0.1.4

PatchFlow CLI v0.1.3

PatchFlow CLI v0.1.3

Benchmark Results (v1.0)

• 18 intentionally vulnerable repos: 100% recall, 918K LOC, 19 CWE categories
• 5 historical CVE repos: 100% recall, 387K LOC
• 10 clean repos: 0.094 HC/KLOC, 720K LOC

See Benchmark Report v1.0 for details.

Changelog

Bug Fixes

• 6d6dcca: fix(install): resolve PATH issues and add containerized install test matrix (Ghertil Abdelmalek ghertilabdelmalek@outlook.fr)

Other Changes

• 3fd6e36: PatchFlow CLI v0.1.2 — local-first security scanner with framework-aware SAST (Ghertil Abdelmalek ghertilabdelmalek@outlook.fr)

PatchFlow CLI v0.1.2

PatchFlow CLI v0.1.2

Benchmark Results (v1.0)

• 18 intentionally vulnerable repos: 100% recall, 918K LOC, 19 CWE categories
• 5 historical CVE repos: 100% recall, 387K LOC
• 10 clean repos: 0.094 HC/KLOC, 720K LOC

See Benchmark Report v1.0 for details.

Changelog

Other Changes

• a071d0a: PatchFlow CLI v0.1.2 — security scanner with update notification (Ghertil Abdelmalek ghertilabdelmalek@outlook.fr)

PatchFlow CLI v0.1.0

PatchFlow CLI v0.1.0

Benchmark Results (v1.0)

• 18 intentionally vulnerable repos: 100% recall, 918K LOC, 19 CWE categories
• 5 historical CVE repos: 100% recall, 387K LOC
• 10 clean repos: 0.094 HC/KLOC, 720K LOC

See Benchmark Report v1.0 for details.

Changelog

Other Changes

• 86624c5: PatchFlow CLI v0.1.0 — local-first security scanner for code, dependencies, and secrets (Ghertil Abdelmalek ghertilabdelmalek@outlook.fr)