v1.2.25

v1.2.25

CytoScnPy 1.2.25 focuses on reducing false positives, making taint sanitization configurable and auditable, tightening test-file handling across commands, and keeping the VS Code extension dependency chain current.

Highlights

• Added structured sanitizer configuration for taint-aware danger rules, including return-value, guard, and side-effect sanitizers that can be scoped by vulnerability type.
• Improved dependency analysis for namespace packages, exported requirements.txt pins, standard-library imports, and dependency false positives around packages such as Azure namespace distributions.
• Made test-file exclusion behavior more consistent across clone detection, raw metrics, cyclomatic complexity, Halstead, maintainability index, file statistics, and main analysis paths.
• Hardened a code-scanning fixture so it no longer binds an IPv6 socket to all interfaces.
• Updated VS Code extension development dependencies, including esbuild and js-yaml, to pick up upstream security and parser hardening fixes.

Taint Sanitizer Configuration

• Introduced a structured sanitizer model for taint-aware danger analysis.
• Added sanitizer categories for return values, branch guards, and side-effect validators.
• Scoped sanitizer behavior to vulnerability families such as command injection, SQL injection, SSRF, path traversal, XML parsing, and unsafe deserialization.
• Preserved backward-compatible sanitizer configuration paths while making the new configuration more explicit and less error-prone.
• Improved taint propagation so sanitization metadata is retained and evaluated at sinks rather than removing taint too broadly.
• Added regressions for custom sanitizers, side-effect validators, compound guards, and bare function names that should not be trusted as sanitizers without a qualified safe source.

Dependency Analysis

• Added missing-dependency handling for from __future__ import annotations so future imports are treated as standard-library language support.
• Improved namespace-package matching so declarations such as azure-functions and azure-identity satisfy imports under the azure namespace.
• Restricted namespace matching so unrelated plugin packages with the same prefix do not accidentally hide missing direct dependencies.
• Improved exported requirements.txt handling so transitive pins can be ignored when they are reachable from declared runtime dependencies, while extra direct requirements remain reportable.
• Added focused regression tests for namespace package imports, exported requirements pins, and direct requirements entries under fail-on-unused and fail-on-missing gates.
• Updated CLI, usage, roadmap, and security documentation to describe the dependency-analysis behavior more clearly.

Test-File And Clone Analysis Behavior

• Extended consistent test-file exclusion beyond the main analyzer into clone detection and metric subcommands.
• Added support paths so commands can share test filtering behavior instead of drifting independently.
• Improved clone detection behavior for command-line inputs, configured thresholds, in-memory analysis, and filtered output.
• Added regression coverage for clone filtering, command behavior, test-policy consistency, and mitigation-aware danger examples.
• Split subcommand dispatch into a dedicated module so the entry-point code stays smaller and easier to maintain.

Security And Dependency Updates

• Updated the VS Code extension esbuild development dependency from 0.27.0 to 0.28.1, including upstream fixes for the local development server path handling and Deno API integrity checks.
• Updated the VS Code extension js-yaml dependency from 4.1.1 to 4.2.0, including upstream parser safety changes such as merge complexity limits and additional loader protections.
• Adjusted the security corpus fixture for code-scanning alert #46 by binding IPv6 loopback (::1) instead of all interfaces (::).
• Updated the Rust lockfile to use anyhow 1.0.103, clearing the RustSec advisory for anyhow 1.0.100.

Merged Changes

• #103 chore(deps-dev): bump esbuild from 0.27.0 to 0.28.1 by @dependabot[bot]
  • Updated the VS Code extension build dependency and lockfile entries.
  • Brings upstream esbuild security hardening and bundler correctness fixes into the extension tooling environment.
• #105 Potential fix for code scanning alert no. 46: Binding a socket to all network interfaces by @djinn-soul
  • Hardened the security corpus by binding to IPv6 loopback instead of all interfaces.
  • Keeps the fixture useful without modeling an avoidable all-interface listener.
• #106 chore(deps-dev): bump js-yaml from 4.1.1 to 4.2.0 by @dependabot[bot]
  • Updated the VS Code extension lockfile dependency.
  • Pulls in upstream YAML parsing safety improvements and parser fixes.
• #107 Fix/clone est execlusion by @djinn-soul
  • Made test-file exclusion consistent across clone analysis, metrics, stats, raw output, and main analysis routing.
  • Added clone/test-policy regression coverage and kept command dispatch modular.
• #108 feat: Introduce structured sanitizer configuration for enhanced taint analysis by @djinn-soul
  • Added structured sanitizer configuration and vulnerability-scoped taint mitigation behavior.
  • Improved sanitizer propagation, sink filtering, legacy compatibility, and regression coverage for sanitizer edge cases.
• #111 feat: Enhance dependency analysis and add regression tests for namespace and requirements handling by @djinn-soul
  • Fixed namespace and standard-library dependency false positives.
  • Tightened exported requirements handling so transitive pins and direct unused requirements are separated correctly.
  • Updated dependency docs and upgraded anyhow to resolve the RustSec advisory found by the release check.

Full Changelog: v1.2.24...v1.2.25