Skip to content

v3.19.0

Choose a tag to compare

View all tags
@sinewaveai sinewaveai released this 15 Mar 12:32
v3.19.0
074ed0d

Security Fixes

  • ReDoS vulnerability in prompt scanner — Added windowed regex matching (safeMatch) that splits long inputs into overlapping 2KB chunks, capped base64 quantifiers, and added boundary anchors. 50KB input: 17s → 91ms (190x faster)

New Features

  • Python taint fallback — stdlib ast-based taint analyzer for regex mode (no tree-sitter required), with inter-procedural propagation and with-statement sink detection
  • Cross-file taint API — real import-graph + export-summary pipeline producing cross-file-taint findings with full taint paths

Bug Fixes

  • Windows compatibility — NamedTemporaryFile handle closed before unlink, backslash normalization in history paths
  • Fix templates — downgraded 7 broken auto-fix patterns to safe manual-fix responses
  • Generic rules — technology-scoped rules gated by language relevance to eliminate false positives
  • Semantic analysis — cross-platform Python resolution and real capability check (verifies tree-sitter import)
  • scan-skill — pre-realpath path traversal check, DRY pattern normalization
  • Flutter SDK packages — treated as legitimate dart dependencies

Test Results

  • All 1325 tests pass
  • Python interprocedural tests: 10/10
  • Python AST engine tests: 5/5
  • Prompt scanner + Garak validation: 36/36 (100% detection)

Install

npm install -g agent-security-scanner-mcp@3.19.0

See CHANGES.md for full details.

Assets 2
Loading