v0.15.0

zzop v0.15.0 — the generic entity-attribute injection channel, concern-first rule packs.

⚠️ Breaking changes

Rule-pack ids (config rules / disabledRules / suppressions / packs.disabled). An unmatched override is a silent no-op, so update these mechanically:

Old id	New id
java-security/sql-taint	be-security/sql-taint
java-security/weak-crypto	be-security/weak-crypto
java-security/cmd-injection	be-security/cmd-injection
be-security/java-hardcoded-password	be-security/hardcoded-password
be-security/java-weak-random	be-security/weak-random
be-security/java-path-traversal	unchanged (kept — collides with the JS path-traversal rule)

Remove java-security / jsp-security from packs.disabled (the packs no longer exist; jsp-security shipped no rules). Inline // ...-ok suppress markers in source are unchanged.

Envelope contract (Mode A/B adapter authors only — not CLI/config users): trpc_router_fragments → procedure_router_fragments (and the matching schema/type names). The shape is identical and the join kind="trpc" value is unchanged; an adapter still emitting the old field is silently ignored until renamed.

Behavior change to expect

One-time cache rebuild on upgrade — the TypeScript parser fingerprint bumped (+store-binding-removed-v1) and the cache schema is now v21. The first run after upgrading re-analyzes every file from scratch (old cache entries no longer match); subsequent runs are warm again. No findings change as a result of the bump itself.

New

• Generic entity-attribute injection channel. Adapters can inject cross-cutting facts the per-file analysis can't see — router-level middleware auth, model store-bindings, migration churn — through an open-vocab attributes: [{ target, key, value }] channel (target = file | symbol | ioKey | pathScope). First consumers: mutating-route-no-auth (auth-guarded), dead-model (bound-model), schema-churn (model-churn). New examples/auth-overlay-adapter demonstrates Mode-B middleware-auth injection.
• trees: "auto" — opt-in workspace auto-detect for cross-repo join discovery.
• One-line terminal message folding — a headline per finding, --all for the full text.
• Sharper confident-zero severities — unconsumed-mutation-endpoint / unprovided-mutation-call de-escalate to Info when the join is blind on the opposite side (a "zero" the analysis can't actually vouch for).

Removed (over-reach → injection)

App-specific native store-binding and migration-churn recognizers are gone; both are now supplied through the attribute channel (bound-model / model-churn), keeping the native engine to common environments only.