feat: catch-up sync from the commercial development tree (2026-04-29 → 2026-07-09) - #24
Merged
Merged
Conversation
…→ 2026-07-09) ~2.5 months of engine development in one reviewed sync: - ssaflow: new Go SSA taint engine (def-use chains, cross-function fixpoint summaries, module-local cross-package analysis); on by default, BATOU_SSAFLOW=0 opts out - Cross-file taint: per-language call-graph builders, cross-file edge resolution, and a shared cross-file taint walk for 14 languages (was Go-only), including stored-state taint (instance fields / module globals) and cross-language HTTP service-boundary routes - batou scan <dir>: new repo scanner — parallel walk over a shared in-memory call graph, JSONL or SARIF 2.1.0 output, --fail-on CI gate, --min-confidence - tsflow: walker 1.9k → 9.9k LOC; barrier guards, arg-shape and payload-position sink gating, Shell language config (17 configs total) - Taint catalogs: 3,254 → 10,664 entries across 17 languages - +58 regex rules; new perlast/shellast/zigast analyzers; major C/C++ analyzer expansion (UAF/double-free, TLS/libc hardening) - Adjudicated suppression + gosec annotation support; findings lifecycle reason tracking; parse determinism and timeout hardening - Committed benchmark corpora: 13-language bench suite + 6 offline CVE ground-truth benches with make targets and scorecard aggregation Not mirrored: internal benchmarking harnesses, profiling artifacts, and infra-specific CI configuration. OSS-only files (release workflows, lint config, hook setup) are preserved; the CI test timeout is raised for the larger suite. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Catch-up sync bringing ~2.5 months of engine development to the public repo in one reviewed change: 3,310 files, +474k/−15k lines.
Highlights
BATOU_SSAFLOW=0opts out.batou scan <dir>— new repo scanner: parallel walk over a shared in-memory call graph, JSONL or SARIF 2.1.0 output,--fail-onCI gate,--min-confidence.perlast/shellast/zigastanalyzers; major C/C++ analyzer expansion (use-after-free/double-free, TLS/libc hardening); parse determinism + timeout hardening.--reason against the finding's dataflow) and gosec#nosecannotation support.Verification
go build ./...passes in both modules (CGo).reporter,findings,rules/java,rules/csharp).-racesuite runs in CI on this PR.🤖 Generated with Claude Code