depblast v0.4.1

v0.4.1 — false-positive reductions

• Auth-aware endpoint detection: module-level auth aliases (current_user = Annotated[..., Depends(get_current_user)]) and router-level auth (APIRouter(dependencies=[Depends(...)])) are now recognized — endpoints relying on them are no longer reported as unauthenticated.
• Test/mock decorator fix: route detection now requires a dotted decorator (@router.patch) and explicitly excludes unittest.mock.patch, eliminating false 'unauthenticated endpoint' findings on mock-decorated test functions.
• Doc-example PEM suppression: embedded-private-key no longer flags inlined doc placeholder blocks (... / .replace(); real committed keys are still reported as CRITICAL.

Full release binaries for 5 platforms are attached (built by CI).

depblast v0.4.0 — cross-file taint analysis & framework-aware engine

v4 is a generational leap: repo-wide cross-file taint analysis over a global symbol table, with framework awareness and SARIF export — Semgrep-class depth, sub-second scans.

Install (no build required)

```bash
curl -fsSL https://raw.githubusercontent.com/jae1231m-blip/depblast/main/install.sh | bash
```

What's new

• Two-pass engine: Pass 1 indexes every file into a concurrent SymbolTable (modules, import aliases, function IR summaries, endpoints); Pass 2 simulates taint across function boundaries up to `--max-call-depth` hops (default 4)
• Cross-file taint with trace paths: `Source (routes.py:15) -> Call (services/fetcher.py:5) -> Sink (utils/http.py:5)`
• YAML rule engine: SSRF, Path Traversal, Command & Code Injection rulesets embedded; extend with `--rules `
• Framework awareness: FastAPI/Flask broken access control (unauthenticated state-changing endpoints), attack surface summary, Query()/Body()/UploadFile params as sources
• FP suppression: `init.py` barrel exemption, restricted `eval({"builtins"})` downgraded to LOW, docs/examples/tutorials isolated as INFO, entropy > 4.2
• SARIF v2.1.0: `--format sarif` for GitHub Code Scanning, with codeFlows

`depblast-x86_64-linux` attached; macOS/Windows/aarch64 binaries build automatically via CI and will appear shortly.

depblast v0.3.0 — AST-based SAST engine

v3 replaces regex heuristics with a real analysis pipeline.

Install (no build required)

curl -fsSL https://raw.githubusercontent.com/jae1231m-blip/depblast/main/install.sh | bash

What's new

• AST analysis (tree-sitter-python): eval(x) flagged, session.exec(x) ignored; from __future__ imports whitelisted
• Intra-procedural taint analysis: request.*/input()/sys.argv/os.environ flowing into eval/exec/subprocess(shell=True)/pickle.loads = CRITICAL (with sanitizer support)
• Shannon-entropy secret verification: no more long-normal-string FPs
• Path context filtering (globset): tests/fixtures/mocks downgraded to INFO, isolated report section
• Inline suppression: # sast-ignore
• rayon + ignore crate: parallel scanning, ~0.1s for typical repos

depblast v0.2.0

First release with prebuilt binaries.

Install (no build required)

curl -fsSL https://raw.githubusercontent.com/jae1231m-blip/depblast/main/install.sh | bash

Highlights

• Dependency CVE scan (npm / PyPI) via OSV.dev with source blast radius
• --slop / --slop-only / --all: AI slop & vibe-coding security audit
• JSON output, --fail-on severity thresholds, local CVE cache

depblast-x86_64-linux is attached now; macOS (Intel/ARM), Windows and
linux-aarch64 binaries are built automatically by CI and will appear here
shortly.