Fetch targeting
- Discovered URLs are filtered before the network phase
- Only the newest version of a package in a dependency tree is fetched
- Go pseudo-versions are dated from the version string, so the age gate rejects old modules with no round trip.
- Worker mode drops the age gate entirely
Provenance
- Registry metadata travels with the sample, so a hopper-sourced scan reasons over the same facts a live fetch would — no refetch.
- --interpret is organized per package, provenance before traits.
- --hopper works on url/pkg (or SCAN_HOPPER)
Faster
- Registry records skip YARA — nothing targets canonical JSON we serialized ourselves.
- Registry lookups and dependency hops now run concurrently
- Plain JSON scans skip the per-dependency model pass and other surfaces nothing reads.
- Worker startup indexing is threaded and logs progress
Output
- Stored reports keep only member nodes someone will read again: ~77% fewer nodes, ~56% fewer bytes.
- A file that fails to scan emits an error line instead of silently producing no record.
Platforms
- FreeBSD: MALLOC_CONF=background_thread:true permanently breaks libc jemalloc init,
- New targets: DragonFlyBSD, NetBSD, illumos/OmniOS, Solaris 11.4