Skip to content

v0.5.2

Marketplace
Marketplace

Choose a tag to compare

View all tags
@kingggg5 kingggg5 released this 17 Aug 12:09
· 54 commits to main since this release
v0.5.2
468b2ce

ShipProof v0.5.2 — Path-Aware Triage, Closed-Loop Agent Protocol & L2 Python Taint

ShipProof v0.5.2 brings path-aware noise reduction, function-local taint analysis for Python, inline GitHub annotations, and a closed-loop remediation protocol for AI coding assistants.

Highlights

  • Path-Aware Triage: Findings in test, example, doc, and benchmark directories are tagged scope: test and downranked by one confidence level. Gates evaluate only app-scoped findings by default; pass --include-tests to evaluate test files in gate thresholds.
  • Python Intraprocedural Taint Tracking (L2): Track local variable assignments within function scopes to detect indirect SQL injection and dynamic code execution with detection: taint and proof_level: L2.
  • Closed-Loop Agent Protocol: Support --format json in --fix-prompt and --explain commands for automated remediation pipelines in Codex, Claude Code, and Cursor.
  • GitHub Workflow Annotations: Direct support for --format github emitting inline ::error and ::warning annotations on PR lines.
  • Automated Policy Initialization: shipproof init writes a documented .shipproof.yml template if missing.
  • Framework Expansion: Extended SP106 deserialization detection to Ruby (Marshal.load, YAML.unsafe_load), and updated multi-language rule mapping tables.

Compatibility

  • Node.js 20 or newer for the CLI.
  • Python 3.10 or newer for scan, policy, budget, capacity, and MCP evidence tools.
  • Config schema version 1 and evidence envelope 1.0.
Assets 2
Loading