v1.2.27

Highlights

• Added Python 3.14 to the supported release metadata and publishing matrix.
• Reduced false positives in cross-file dead-code analysis, framework-aware reachability, clone detection, and source metrics.
• Made clone and dependency findings available consistently across terminal, machine-readable, CI, and report outputs.
• Applied project-wide ignore and suppression settings to every relevant analyzer and report path.
• Made configuration failures visible and taught the VS Code extension to refresh diagnostics when project configuration changes.

Why This Release Matters

CytoScnPy v1.2.27 makes analysis results more trustworthy and more portable. The same clone and dependency problems can now be consumed from local terminal output, CI annotations, JSON, SARIF, JUnit, Markdown, GitLab, or HTML without important categories disappearing between formats. At the same time, improved package, framework, metric, and configuration handling removes several sources of misleading findings and silent behavior.

Python 3.14 And Metric Correctness

• Declares Python 3.14 support in package metadata and includes Python 3.14 in the cross-platform publishing matrix.
• Corrects raw metric accounting for docstrings, multiline data strings, inline comments, logical lines, and files that cannot be parsed normally.
• Improves Halstead, cyclomatic-complexity, and Maintainability Index calculations so nested definitions and Python statements are counted at the correct scope.
• Returns Maintainability Index threshold failures through the normal error path, allowing callers and automation to handle failures consistently.
• Makes clone comparison more reliable by reusing parsed subtrees, preserving cache behavior under load, and tightening CFG validation.

Fewer False Positives In Real Python Projects

• Preserves symbols that are re-exported through package __init__.py files, including star imports and explicit or empty __all__ declarations.
• Resolves module names through regular package hierarchies instead of treating each analyzed file as an isolated module.
• Improves framework reachability for Flask blueprints and add_url_rule, FastAPI dependency annotations, Django URL patterns, Django REST Framework views, and configured framework base classes.
• Avoids broad name-based framework assumptions that could incorrectly keep unrelated classes or functions alive.
• Uses an LRU clone subtree cache and avoids repeatedly reading the same source files for clone-pair validation.
• Strengthens GitLab fingerprints so distinct findings are not accidentally deduplicated while paths remain stable across checkout roots.

Clone And Dependency Findings Across Every Output

• Adds clone findings and dependency rules CSP-R001 through CSP-R005 to text, grouped, quiet, JSON, JUnit, GitHub Actions, GitLab Code Quality, Markdown, SARIF, and HTML reporting.
• Preserves the existing raw JSON data while adding normalized findings for consumers that need a common issue model.
• Emits GitHub annotations with valid source columns and promotes High or Critical findings to errors.
• Preserves clone warning severity in SARIF and prevents canonical clone data from being duplicated in shared extended-finding output.
• Keeps clone collection separate from terminal display, so HTML-only and other non-text runs collect the required data without printing an unexpected clone table.

Configuration, Ignores, And VS Code Diagnostics

• Surfaces unreadable or malformed .cytoscnpy.toml and pyproject.toml configuration instead of silently falling back to defaults.
• Applies global ignore patterns to analyzer findings, dependency findings, clone findings, summaries, per-file data, and exported reports.
• Makes secret suppression rule-aware so a suppression for one rule does not hide unrelated findings on the same line.
• Watches both pyproject.toml and .cytoscnpy.toml in VS Code, invalidates the appropriate cache, and refreshes diagnostics when configuration is created, changed, or deleted.
• Refreshes the bundled Windows CLI used by the VS Code extension so editor diagnostics match the v1.2.27 source behavior.

Dependency Security

• Upgrades pymdown-extensions to the patched 11.x line, removing exposure to CVE-2026-61632 from the documentation dependency set.

Merged Changes

• #119 Fix/3.14 version fix by @djinn-soul
  • Added Python 3.14 release coverage and corrected clone, framework, raw metric, complexity, Halstead, Maintainability Index, and GitLab reporting behavior.
• #120 fix: reduce false positives in reachability, framework detection, and raw metrics by @djinn-soul
  • Improved cross-file exports and package resolution, expanded framework-aware reachability, refined raw metrics, optimized clone caching, and stabilized GitLab secret fingerprints.
• #122 fix: report clone and dependency findings across formats by @djinn-soul
  • Unified clone and dependency reporting, enforced ignores and suppressions throughout the pipeline, surfaced configuration errors, refreshed VS Code diagnostics on config changes, and upgraded the vulnerable documentation dependency.

Full Changelog: v1.2.26...v1.2.27