v1.2.7

Release Notes: v1.2.7

New Features

• Taint Analysis Simplification: Taint analysis is now automatically enabled whenever danger scanning is active, removing the need for a separate flag.

Refactoring & Architecture

• Modular Danger Engine: The monolithic danger.rs code has been completely refactored into a structured src/rules/danger/ module. Security rules are now logically grouped into categories:
  • code_execution.rs (Eval, Exec, Subprocess)
  • injection.rs (SQLi, XSS, XML)
  • filesystem.rs (Path Traversal, Tempfiles)
  • crypto.rs (Weak Hashes, Ciphers)
  • deserialization.rs (Pickle, YAML, Models)
  • frameworks.rs (Django/Flask specifics)

Benchmarks & Accuracy

• Modern Python Benchmarks: Expanded the ground truth suite (now 135 items) to include checks for modern Python 3.10+ features:
  • Protocol and Duck Typing
  • TypeAlias / TypeAliasType (PEP 695)
  • Enum usage and member access
  • ABC abstract methods
• Implicit Implementation Logic: Improved heuristics to detect implicit usages of Protocol methods (Duck Typing), increasing accuracy for interface-heavy codebases.

Documentation & Developer Experience

• Updated Contributing Guide: Added comprehensive instructions for setting up, building, and testing the new MCP server.
• Project Settings: Updated .vscode settings and recommendations for a better contributor experience (Rust Analyzer, Coverage Gutters).
• Dependency Management: Updated setup instructions to recommend uv for faster environment management.