Skip to content

v0.1.8

Choose a tag to compare

View all tags
@Rinkia Rinkia released this 08 Sep 07:21
· 3 commits to master since this release
v0.1.8
b6ae1df
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Adds the Java security lens and makes the ranking honest about ties.

Added

  • --version on both modscan and modscan-audit.
  • Tie disclosure. detect and the benchmark now state when a score sits in a tie the alphabetical tiebreak decides, rather than presenting it as a ranking. --json carries tied_with per point.
  • modscan-audit --language java — a Java risk-sink catalog modelled on find-sec-bugs: ScriptEngine/Groovy/SpEL, ObjectInputStream/XMLDecoder/XStream/SnakeYAML, Runtime.exec/ProcessBuilder, Class.forName. Not yet cross-checked against an external authority (find-sec-bugs reads bytecode, MODScan reads source) — treat it as newer than the Python and TypeScript catalogs. Needs pip install modscan[java].

Fixed

  • @overload stubs no longer report a symbol several times. SQLAlchemy dropped 91 phantom candidates; medians improved, recall unchanged.

Full notes: CHANGELOG

Assets 2
Loading