Skip to content

v0.8.0 - Depth

Choose a tag to compare

View all tags
@sabahattink sabahattink released this 30 Oct 12:13
v0.8.0
c1643d0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The "Depth" release: tRPC procedures, request data followed through fields, constructors, callbacks, and injected providers, fastify-cli projects as @fastify/autoload loads them, secrets that Git history still holds, gates that a good average cannot hide, and fixes you apply from the editor.

npx @sabahattink/codediag@0.8.0 scan .

Highlights

  • tRPC: procedures are followed from initTRPC through .use() chains, exported builders such as protectedProcedure, and nested or merged routers across files. New warnings: missing-trpc-auth-middleware, unvalidated-trpc-input, trpc-stack-trace-exposed. The checks run inside whichever server hosts tRPC, so T3 App Router projects get a real API Health score. Procedure input counts as request data for the security rules, even after .input(schema).
  • Deeper taint: request data is followed into fields a class stores it in, through constructors, into map/forEach/reduce/then callbacks and for...of, and to NestJS providers behind an interface or @Inject() token. Findings stay on the sink line with unchanged fingerprints.
  • Fastify autoload: fastify-cli projects get directory prefixes, autoPrefix, and autohooks the way @fastify/autoload applies them, instead of false missing-auth warnings.
  • Secrets in Git history (opt-in): --secret-history reports credentials that a commit added and a later one deleted. Secrets are compared by digest and never printed.
  • Gates: --fail-on critical fails on any active critical finding whatever the score; --package-threshold 70 gates every monorepo package on its own score. Both work in the GitHub Action (fail-on, package-threshold).
  • VS Code 0.6.0: remediation quick fixes for disabled TLS verification, ignored JWT expiration, and the JWT none algorithm.

Fixes

  • NestJS @Param()/@Query()/@Body()/@Headers() parameters now make shell command and SQL findings critical; parameters behind a parsing pipe (ParseIntPipe, ...) are not request data.
  • Action annotation messages no longer show commas and colons as %2C and %3A.
  • The JSON schema accepts combined workspace reports with Hono packages.

See the changelog for details and known limitations.

Assets 3
Loading