v0.0.639

Highlights

• Security: Implemented mandatory release disclaimers for security patch releases.
• Link Path Stability: Resolved an issue where deleting a symlink would cause problems with the link path.
• Dark Mode Readability: Restored the theme-aware logo in the README for better visibility in dark mode.
• Taint Propagation: Enhanced argument taint propagation for improved data flow analysis.
• Runtime Call Tracing: Added runtime call tracing for Go, JVM, Node.js, .NET, PHP, Lua, and Dart.

New Contributors

• @aoright made their first contribution in #1153
• @anujsingh-cse made their first contribution in #1230

Full Changelog: v0.0.589...v0.0.639

What's Changed

• ci: ship security patches out-of-cadence with a mandatory release disclaimer by @vitali87 in #1150
• docs: announce release automation in latest news by @vitali87 in #1151
• fix: key File nodes on the link path so a deleted symlink is prunable (#1154) by @vitali87 in #1155
• chore: remove screenshot accidentally committed via #1155 by @vitali87 in #1157
• docs: add Trendshift #1 trending badge to the README header by @vitali87 in #1159
• fix: restore theme-aware README logo so it is legible on dark mode by @vitali87 in #1160
• fix: scope use declarations in out-of-function expression blocks (#1016) by @vitali87 in #1161
• docs: keep Latest News to product features, never CI/devx/bugs by @vitali87 in #1162
• fix: bind each cfg/impl twin module's functions through their own use (#1017) by @vitali87 in #1163
• fix: decline crate paths through an unrepresentable path redirect (#1082) by @vitali87 in #1165
• fix: give an inline mod under a trait or impl body a consistent qn (#1018) by @vitali87 in #1166
• feat: propagate argument taint into a callee's sinks via parameter-sink summaries (#1142) by @vitali87 in #1167
• feat: propagate argument taint through a callee's return for pass-through helpers (#1168) by @vitali87 in #1170
• chore: remove stray screenshot accidentally committed with the #1168 flow work by @vitali87 in #1171
• docs: state real 10-language FLOWS_TO coverage and add a per-language table (#1172) by @vitali87 in #1192
• docs: correct stale lean flow-walk comments to the current path-sensitive behaviour by @vitali87 in #1194
• fix(realtime): delete files by absolute path by @aoright in #1153
• feat: forward parameter-to-sink taint for the lean-walk languages (#1169) by @vitali87 in #1193
• fix: derive orchestrator prompt tool names from AgenticToolName so the prompt matches the registered tools by @vitali87 in #1200
• feat: FLOWS_TO lean-walk coverage for Lua (#1175) by @vitali87 in #1202
• feat: lean-walk positional parameter-slot extractors for Java, C#, Rust, and C (#1195) by @vitali87 in #1208
• feat: walk TS parameter-decorator headers in the lean flow walks (#1196) by @vitali87 in #1209
• feat: closure-capture taint for the Python flow walk via capture summaries (#1197) by @vitali87 in #1210
• feat: model Go handle-based writes in the lean FLOWS_TO walk (#1204) by @vitali87 in #1212
• feat: model Rust handle-based writes in the lean FLOWS_TO walk (#1204) by @vitali87 in #1214
• feat: model Java/C# new-shaped handle writes in the lean FLOWS_TO walk (#1204) by @vitali87 in #1215
• test: lock in JS/TS handle-write coverage and correct docs (#1204) by @vitali87 in #1217
• feat: model Lua io.open handle writes in the lean FLOWS_TO walk (#1204) by @vitali87 in #1218
• feat: model C/C++ arg-shaped libc FILE* handle writes in the lean FLOWS_TO walk (#1204) by @vitali87 in #1219
• feat: model C++ ofstream type-declaration stream writes in the lean FLOWS_TO walk (#1220) by @vitali87 in #1221
• feat: add FLOWS_TO lean-walk coverage for PHP (#1174) by @vitali87 in #1222
• feat: add FLOWS_TO lean-walk coverage for Dart (#1173) by @vitali87 in #1223
• feat: extract a LanguageFrontend fact-bundle protocol; migrate C# onto it (#1178) by @vitali87 in #1225
• feat: add Go semantic frontend fact provider behind the LanguageFrontend registry by @vitali87 in #1226
• feat: consume Go go/types facts for exact call binding and external-site suppression by @vitali87 in #1228
• feat: Go frontend emits types.Implements facts for IMPLEMENTS edges by @vitali87 in #1234
• feat: consume Go types.Implements facts as IMPLEMENTS edges and sole-impl dispatch by @vitali87 in #1235
• fix: emit C# LINQ query-call edges through the capture-filtering sink by @vitali87 in #1238
• fix: rehydrate C# type locations for incremental partial joins (#1229 phase 1) by @vitali87 in #1239
• fix: stop treating {str: func} dicts as dispatch registries (#1241) by @vitali87 in #1242
• fix: resolve maintainer review feedback for #1207 by @anujsingh-cse in #1230
• feat: add Python runtime call tracing with dynamic CALLS edge provenance by @vitali87 in #1258
• feat: add JVM runtime call tracing agent with dynamic CALLS edge provenance by @vitali87 in #1268
• feat: add Node.js runtime call tracing via V8 cpuprofile conversion by @vitali87 in #1261
• feat: add .NET runtime call tracing via dotnet-trace speedscope conversion by @vitali87 in #1262
• refactor: clear all SonarCloud issues in the trace subsystem by @vitali87 in #1269
• feat: add PHP runtime call tracing via Xdebug trace conversion by @vitali87 in #1263
• feat: add Lua runtime call tracing via a pure-Lua debug hook agent by @vitali87 in #1264
• feat: add Dart runtime call tracing via a VM Service sample collector by @vitali87 in #1265
• feat: add Go runtime call tracing via dependency-free pprof conversion by @vitali87 in #1266

New Contributors

• @aoright made their first contribution in #1153
• @anujsingh-cse made their first contribution in #1230

Full Changelog: v0.0.589...v0.0.639