v3.27.0

AST engine: multi-hop SQL-injection taint. Dataflow now catches a user-tainted SQL string built into a variable and passed bare to a query sink (const q = "SELECT ... " + req.body.x; db.query(q)) — the variable-indirection shape the inline patterns miss. Reports only when the variable is user-tainted and provably a SQL string; parameterized queries, non-SQL .query(), and sanitizer-wrapped builds stay silent. 1 real SQLi caught, zero false positives, zero drift. Deterministic. 450 rules / 39 tools.