v4.6.0

4.6.0 (2026-04-26)

Features

• languages: add js-jsx support and strengthen java-go security c… (#237) (c082fcf)
• languages: add php foundation support (#243) (4a137cc)
• languages: deepen go java and js-ts security checks (#238) (fde84e3)
• languages: deepen js-ts reachability and entry discovery (#240) (6ea96a2)
• languages: harden go archive symlink checks (#241) (4d37f14)
• languages: harden java canonical path guard checks (#242) (d3958bf)
• security: add security contract regression detection (#236) (1b48e52)
• upload: add family-aware cloud uploads and debt reporting (#239) (55b75ea)
• upload: add monorepo routing and sonar import (#244) (dc473d7)

Bug Fixes

• dead-code: improve frozen benchmark precision and recall (#254) (4fd170c)
• java: make security flow analysis structured (#253) (5d3a946)
• python: fix critical logic gaps (#245) (96712b9)
• python: improve security flow precision and recall (#250) (8af25d2)
• quality: detect duplicate branch logic (#255) (8e76e9d)
• security: improve typescript ssrf and go command precision (#251) (1218c9d)

Documentation

• readme: refresh GHCR image release notes (#232) (bea165c)
• readme: streamline landing pages and benchmark scorecard (#256) (f2af8c2)