v0.1.9

A single fix to the Java attack-surface lens.

Fixed

• Sinks called on a try-with-resources variable are no longer missed. modscan-audit --language java resolves a call's receiver type from the file's declarations, and a variable declared in a try (ObjectInputStream in = …) header — a distinct AST node — was not read, so in.readObject() went unreported. Found by a new Semgrep cross-check against commons-lang3.

Full notes: CHANGELOG