v0.7.0 — Across

Across: CodeDiag follows request data through your own helper functions and services, scans whole monorepos as one report, analyzes Hono apps, tracks your score over time, and measures pull requests against the base branch.

npx @sabahattink/codediag@0.7.0 scan . --workspaces --history .codediag/history

Cross-file taint

Request data passed into project helpers and services is followed up to two calls deep:

// src/lib/convert.ts
export function convert(file: string) { exec(`convert ${file}`); }   // ← critical now
// src/routes/upload.ts
router.post("/convert", auth, (req, res) => convert(req.body.file));

• All import styles, class methods, and NestJS this.service.method(dto.x) are followed.
• Pass-through helpers such as getName(req) carry request data back to the caller.
• Findings stay on the sink line with unchanged messages and fingerprints, marked confidence: "medium". The fix text names the calling line.
• On every existing fixture the findings are the same as before, and CodeDiag's own scan got faster.

Monorepos

--workspaces scans every package of an npm, pnpm, or Yarn workspace, a Lerna repository, or an Nx workspace:

• Each package gets its own stack detection and its own config.
• The combined report lists every package and averages each analyzer over the packages it ran in.
• Baselines, --compare, --changed-since, and SARIF work across the whole repository.
• The GitHub Action (workspaces: true) and the VS Code extension support it too.

Hono

The new API Health analyzer reads Hono apps:

• routes, basePath(), and sub-apps mounted with app.route() across files, replayed in Hono's registration order
• jwt(), bearerAuth(), and custom auth middleware
• zValidator body validation
• onError and health endpoints

There are four new rules (80 → 84). Hono servers are also checked for secure headers, rate limiting, and open hono/cors.

Score history

--history <dir> records every scan. The terminal shows a sparkline. The HTML report shows a line chart with grade guides, keyboard-reachable readouts, and a table view.

Base-branch delta in pull requests

Give the Action your base branch's report with compare: codediag-main.json. The comment then reads ▼ −3 vs. the base branch (81) · 1 new · 2 fixed, and new findings are marked.

Also

• Vulnerability findings name the affected packages and their advisories.
• audit: production skips devDependencies.
• --format prompt groups findings by rule and includes the rule documentation.
• VS Code extension 0.5.0 (attached).

Full changelog: https://github.com/sabahattink/codediag/blob/main/CHANGELOG.md