Skip to content

v0.5.3 — Baseline & Entropy Detection Fixes

Choose a tag to compare

View all tags
@neil-data neil-data released this 13 Sep 13:44
· 15 commits to main since this release
v0.5.3
5530de0

Highlights

This is a targeted bug-fix release addressing the two issues carried over from v0.5.0's QA pass. No new features — this release exists purely to close out known inconsistencies before v0.6.0 development begins.

Fixed

  • status and doctor disagreeing on baseline validity — status could report a freshly created, valid baseline as INVALID while doctor correctly confirmed it was present and valid. Both commands now share the same baseline-validation logic and report identical results for the same file.
  • generic-high-entropy-secret unreachable as a standalone finding — the entropy detection engine could be silently pre-empted by more specific pattern rules, or fail to fire at all under certain variable names, meaning genuinely high-entropy secrets under unrecognized names could go undetected. Entropy detection now runs independently when no pattern rule matches, without reintroducing the false positives fixed in v0.4.2 (os.environ.get(), re.compile(), method-call results remain correctly excluded).

Verified in this release

  • status and doctor tested side-by-side on multiple projects — consistent results for valid, missing, and corrupted baselines.
  • generic-high-entropy-secret confirmed to independently trigger on a genuine high-entropy string under a generic/unrecognized variable name, reporting the documented MEDIUM severity.
  • Regression suite confirms no reintroduction of the v0.4.0 entropy false-positive bug.
  • Full existing test suite (132 tests from v0.5.0) continues passing, plus new dedicated tests for both fixes.

Not included in this release

This release deliberately does not add CLI commands, flags, or config options. All v0.5.0 functionality (envguard ci, changed-file scanning, SARIF, GitHub Actions integration) is unchanged. Feature work resumes with v0.6.0 (team/multi-repo workflows).

Status after this release: all bugs identified during v0.4.0–v0.5.0 QA are resolved. A full codebase bug-hunting pass is planned before v0.6.0; any findings will ship as v0.5.4.

Assets 2
Loading