v1.2.24

v1.2.24

CytoScnPy 1.2.24 improves analyzer correctness, dependency-rule precision, CI failure gates, VS Code diagnostics, MCP compatibility, and long-term maintainability of several high-complexity Rust analysis paths.

Highlights

• Fixed method/function classification for nested Python definitions so local functions inside methods are no longer mistaken for class methods when unused-code analysis builds the function graph.
• Refactored major analyzer hotspots into focused modules for linter traversal, call graph traversal, complexity traversal, LCOM4, clone grouping, whitelist generation, GitHub report output, confidence penalties, entropy recognition, and XML danger analysis.
• Added the --fail-on-any convenience flag for CI/CD workflows and broadened failure-gate handling so strict scans can be enabled from one preset.
• Improved VS Code integration so the extension respects project configuration for scan enablement and thresholds, and surfaces more result categories as editor diagnostics.
• Reworked dependency analysis around CytoScnPy rule IDs CSP-R001 through CSP-R005, including transitive dependencies, stdlib declarations, and dev dependencies used from production code.
• Reduced dependency false positives for dev/test support files such as conftest.py and noxfile.py, while keeping production dependency misuse detectable.
• Upgraded pyo3 to 0.29.0 and refreshed Python package build validation for the optional Python bindings path.
• Updated the VS Code extension lockfile dependency shell-quote from 1.8.3 to 1.8.4.

Analyzer Correctness

• Fixed nested-function handling in the visitor metadata path by checking the current syntactic scope instead of treating every definition under an outer class as a method.
• Added regression coverage proving local functions inside methods are classified and reported based on their actual usage.
• Preserved method detection for real class-body functions while avoiding false unused-code behavior for local helper functions nested inside methods.

Analyzer Maintainability

• Split linter statement and expression traversal out of the large linter visitor implementation.
• Split taint call graph traversal into statement, expression, and pattern traversal modules.
• Split block-complexity traversal, LCOM4 graph/visitor logic, clone grouping, clone suggestions, entropy statement/block traversal, and XML danger analysis into focused files.
• Moved analyzer confidence penalty scoring into a dedicated confidence_penalties module.
• Simplified pyproject dependency parsing and fix-plan statistics handling.
• Updated MCP server metadata construction for the newer rmcp API and bumped workspace/tool metadata for the 1.2.24 line.

CLI And Failure Gates

• Added --fail-on-any for the main analysis command as a CI-friendly preset for supported failure gates.
• Extended gate context handling so fail gates can enable the scan categories they depend on.
• Improved dependency-subcommand failure behavior so root-level --fail-on-any deps ... reaches dependency gates.
• Added regression coverage for fail-gate behavior in main analysis and dependency analysis paths.
• Documented the new gate behavior in the CLI and pre-commit documentation.

VS Code Integration

• Updated the VS Code client to honor .cytoscnpy.toml and pyproject.toml scan enablement and threshold settings.
• Kept explicit VS Code settings as overrides when a user sets extension-level flags.
• Expanded VS Code result parsing so Problems can surface unused/dead code, secrets, danger, quality, taint, clone, parse-error, and dependency findings.
• Fixed dependency diagnostic anchors so findings point at files such as pyproject.toml instead of directory paths that cannot be opened as diagnostics.
• Added TypeScript regression coverage for the expanded result transformation behavior.

Dependency Analysis

• Introduced CytoScnPy dependency rule IDs:
  • CSP-R001 for unused declared dependencies.
  • CSP-R002 for missing declared dependencies.
  • CSP-R003 for transitive dependency imports.
  • CSP-R004 for dev dependencies imported from production code.
  • CSP-R005 for stdlib modules declared as dependencies.
• Changed dev dependencies so they are not reported as unused by default; --include-dev-unused restores stricter dev-unused reporting when desired.
• Added dependency output categories for dev dependencies used in production, stdlib dependency declarations, and transitive dependencies.
• Improved dependency discovery and reporting through the main analysis path, cytoscnpy deps, JSON snapshots, and report-format tests.
• Added documentation pages for the new dependency rule IDs and linked them through MkDocs.

False-Positive And Regression Coverage

• Added dependency regressions for dev dependency imports in conftest.py and noxfile.py.
• Aligned dependency import classification with shared test/dev path handling so dev-support files are not treated as production usage for CSP-R004.
• Added quality and danger regression coverage showing path-aware danger rules suppress expected test/dev-support cases while always-on danger rules and quality rules keep their intended behavior.
• Added mitigation-aware danger-rule examples for unsafe versus validated/sanitized code paths, covering rules such as SSRF, SQL injection, command injection, path traversal, XML parsing, and unsafe deserialization patterns.
• Fixed dependency review feedback so a dependency declared in both production and dev groups does not trigger a production false positive solely because the duplicate dev declaration exists.

Security And Dependency Updates

• Upgraded optional Python-binding dependency pyo3 to 0.29.0.
• Added a narrow Dependency Review license override for pyo3 after Cargo metadata reported MIT OR Apache-2.0 while GitHub dependency review still treated the direct manifest dependency as unknown-license noise.
• Updated shell-quote in the VS Code extension lockfile from 1.8.3 to 1.8.4, including the upstream object-token validation fix.
• Refreshed requirements-dev.txt and uv.lock to address dependency-audit findings and keep the repo hooks aligned with the lockfile.

Merged Changes

• #97 fix(visitor): correctly identify methods using scope stack by @djinn-soul
  • Fixed nested local-function classification inside methods.
  • Added unused-code regression coverage for the corrected scope behavior.
• #98 Fix/crapthing by @djinn-soul
  • Refactored high-complexity analyzer, visitor, linter, clone, taint, metrics, and reporting paths.
  • Updated rmcp integration and bumped version metadata for the 1.2.24 release line.
• #102 feat(cli): add --fail-on-any flag and improve VS Code integration by @djinn-soul
  • Added the CI-friendly --fail-on-any preset and related gate behavior.
  • Improved VS Code config handling and diagnostic parsing.
  • Upgraded pyo3 and expanded validation around failure gates and editor behavior.
• #99 chore(deps-dev): bump shell-quote from 1.8.3 to 1.8.4 by @dependabot[bot]
  • Updated the VS Code extension lockfile dependency.
• #104 Fix/dep messay thing rewrite by @djinn-soul
  • Reworked dependency analysis into explicit CSP-R001 through CSP-R005 categories.
  • Added dependency rule documentation, JSON/report output coverage, false-positive regressions, and dependency-review fixes.

Full Changelog: v1.2.23...v1.2.24