Commit Graph

Select branches

Hide Pull Requests

main

archive/engine-change-scoped-evidence-pass

archive/engine-typescript

archive/fix-mechanisms

archive/trained-classifier

archive/unseen-eval

v0.1.0

v1.0.0

v1.1.0

v1.2.0-alpha.1

v2.0.0

v2.0.1

Mono Color

• 51fabef9ea feat(contributor-scan): retain first-party JavaScript tests in graphs Marius Ciepluch 2026-09-13 11:29:48 +02:00
• d02406e758 docs(pre-push-safety-net): record frontend retention prerequisite Marius Ciepluch 2026-09-13 11:05:44 +02:00
• ebad83009e feat(pre-push-safety-net): connect change context to ranked questions Marius Ciepluch 2026-09-13 10:41:32 +02:00
• 546db24b8e feat(pre-push-safety-net): preserve exact ranker scope and outcomes Marius Ciepluch 2026-09-13 10:16:22 +02:00
• bd53b6dc9d feat(pre-push-safety-net): bound backend execution by one deadline Marius Ciepluch 2026-09-13 10:03:03 +02:00
• 948ee020db feat(pre-push-safety-net): retain bounded change and rename context Marius Ciepluch 2026-09-12 21:12:45 +02:00
• 97fd6336f1 feat(pre-push-safety-net): materialize bounded isolated snapshots Marius Ciepluch 2026-09-12 20:55:09 +02:00
• 05da202d67 feat(pre-push-safety-net): resolve immutable push comparisons Marius Ciepluch 2026-09-12 20:43:51 +02:00
• 14a2a60e52 feat(pre-push-safety-net): establish shared push and engine contracts Marius Ciepluch 2026-09-12 19:21:31 +02:00
• 051f3b0058 feat(pre-push-safety-net): preserve uncertainty in benchmark scoring Marius Ciepluch 2026-09-12 19:04:20 +02:00
• 8acada0d98 feat(pre-push-safety-net): pin labeled evaluation inputs Marius Ciepluch 2026-09-12 18:45:54 +02:00
• 56cfc9da89 feat(pre-push-safety-net): reproduce evaluated Joern runtime Marius Ciepluch 2026-09-12 18:32:18 +02:00
• 7e3b3bbc8b docs(pre-push-safety-net): record approved design and implementation plan Marius Ciepluch 2026-09-12 18:27:14 +02:00
• a8069acb41 bench(ranking): phase 2 with the layout facts -- wpstatistics 173 -> 91, mwwpform 68 -> 54, pmpro 82 Marius CiepluchandClaude Fable 5.1 2026-09-11 14:42:44 +02:00
• 7411f3568a bench(ranking): the phase-2 baseline on Joern 4.0.625 -- pmpro 82, wpstatistics 173, mwwpform 68, vampi 16 Marius CiepluchandClaude Fable 5.1 2026-09-11 14:39:22 +02:00
• ee693eec26 docs(flow-aware-ranking): the three decisions -- 4.0.625 as baseline, vendored out, tests not product Marius CiepluchandClaude Fable 5.1 2026-09-11 14:28:18 +02:00
• b821ac6e4e feat(facts): the [[layout]] fact -- vendored trees are out, test paths are not product Marius CiepluchandClaude Fable 5.1 2026-09-11 14:27:50 +02:00
• 9142cb1fb4 docs(flow-aware-ranking): v6 measured -- identical to v5, and why; the layout fact table proposed Marius CiepluchandClaude Fable 5.1 2026-09-11 14:15:12 +02:00
• 3b3b96be5f fix(cpg): the interpreter precondition probes the frontend's own parser script; 4.0.625 verified Marius CiepluchandClaude Fable 5.1 2026-09-11 13:52:17 +02:00
• 2de873274f feat(model): shipped joins the evidence vector as a within-tier weight; v5 baseline Marius CiepluchandClaude Fable 5.1 2026-09-11 13:45:00 +02:00
• 983eda5886 feat(model): v4 measured; a parameter-fed field becomes strong carried only when the exact flow confirms it Marius CiepluchandClaude Fable 5.1 2026-09-11 13:27:49 +02:00
• 20d53f1c4d perf(cpg): the field and hook memos live at batch scope, keyed by what the answer depends on Marius CiepluchandClaude Fable 5.1 2026-09-11 13:14:21 +02:00
• d1f37abadd feat(model): carried with provenance -- source-fed promotes a tier, parameter-fed only orders Marius CiepluchandClaude Fable 5.1 2026-09-11 13:11:00 +02:00
• ce49bd877c perf(cpg): carried for evidence mode is structural, not a flow Marius CiepluchandClaude Fable 5.1 2026-09-11 12:53:22 +02:00
• c8e2ed21aa bench(ranking): the position benchmark sets its own query ceiling; v2 partials in the brief Marius CiepluchandClaude Fable 5.1 2026-09-11 12:01:55 +02:00
• 35cb578ce2 bench(ranking): a baseline records the head of the evidence order, region by region Marius CiepluchandClaude Fable 5.1 2026-09-11 11:47:41 +02:00
• 1741b6bed6 feat(model): phase 2 measured (weights v1) and carried reported by the evidence branch Marius CiepluchandClaude Fable 5.1 2026-09-11 11:47:06 +02:00
• 9f881b433e fix(cpg): the closure-defect exclusion stops at Joern 4.0.625, where upstream fixed it Marius CiepluchandClaude Fable 5.1 2026-09-11 11:32:00 +02:00
• b6cccd1444 fix(bench,cpg): the position benchmark builds in the recipe's language and reports per repository; a doubly-failed build disposes its scratch Marius CiepluchandClaude Fable 5.1 2026-09-11 11:30:12 +02:00
• c955721f92 fix(cpg): the census overlay list is layer names, not characters Marius CiepluchandClaude Fable 5.1 2026-09-11 10:49:10 +02:00
• 60d13d7b6e feat(model): phase 2 of flow-aware-ranking -- spend the region budget by evidence, weights published Marius CiepluchandClaude Fable 5.1 2026-09-11 10:47:47 +02:00
• 7ce0a30161 docs(cpg): name the upstream issue for joern-parse --overlaysonly (joernio/joern#6283) Marius CiepluchandClaude Fable 5.1 2026-09-11 10:42:35 +02:00
• 5afe6fd8b4 fix(cpg): the instrument reports on itself -- census failure fails the build, overlays and heap are checked Marius CiepluchandClaude Fable 5.1 2026-09-11 10:42:04 +02:00
• 0f35578d5b perf(cpg): one taint row per evidence key, with the path count Marius CiepluchandClaude Fable 5.1 2026-09-11 09:14:25 +02:00
• 5be63bdfea docs(specs): the whole-repository scan completes -- 72 minutes, CVE-2023-23488 found, 250 findings Marius CiepluchandClaude Fable 5.1 2026-09-11 09:10:14 +02:00
• 60963f565c fix(cpg): the real-request cost, attributed and removed -- overlays once, seeds scoped, data tables out Marius CiepluchandClaude Fable 5.1 2026-09-11 01:16:00 +02:00
• 9a8e9f083f feat(ranking): phase 1 -- tier-0 taint requests are no longer asked Marius CiepluchandClaude Fable 5.1 2026-09-10 19:18:20 +02:00
• 88ada8e48c feat(ranking): phase 0 -- the baseline, the evidence instrument, and a 7x taint speedup found on the way Marius CiepluchandClaude Fable 5.1 2026-09-10 18:22:18 +02:00
• bfc3d806ba docs(flow-aware-ranking): cross-assess the plan, define the heuristics language-agnostically Marius CiepluchandClaude Fable 5.1 2026-09-10 16:11:38 +02:00
• 7e397beca6 docs(flow-aware-ranking): brief -- rank pairs by evidence, in phases that each must prove themselves Marius CiepluchandClaude Opus 5 2026-09-10 16:06:55 +02:00
• 62052b9525 docs: where PHP detection stands, and the shortest path to a finishing scan Marius CiepluchandClaude Opus 5 2026-09-10 16:01:21 +02:00
• f496f41be1 fix(cpg): reclaim the scratch tree, and sweep what earlier runs abandoned Marius CiepluchandClaude Opus 5 2026-09-10 15:54:50 +02:00
• 37eca758d4 chore(models): move the default to deepseek-v4.1-flash, Pro is discontinued Marius CiepluchandClaude Opus 5 2026-09-10 15:50:31 +02:00
• 83ab533fc4 docs(contributor-scan): the ranker is 84% one tier, and the loop is closed Marius CiepluchandClaude Opus 5 2026-09-10 15:49:57 +02:00
• 5abc6cd6f6 fix(cpg): a timed-out query must kill the JVM, not just the script Marius CiepluchandClaude Opus 5 2026-09-10 15:16:45 +02:00
• a895bceefc docs(contributor-scan): 5.13 -- a taint request costs 6.6s, and the joins are not why Marius CiepluchandClaude Opus 5 2026-09-10 15:13:33 +02:00
• 7308570ba6 docs(contributor-scan): 5.12 -- the ranker knows one framework, everything else is "unknown" Marius CiepluchandClaude Opus 5 2026-09-10 12:59:24 +02:00
• 4a1e06b75b fix(cpg): exclude the files php2cpg miscompiles, and name them Marius CiepluchandClaude Opus 5 2026-09-10 12:17:48 +02:00
• 128950a586 docs(agents): verify the instrument before believing the measurement Marius CiepluchandClaude Opus 5 2026-09-10 11:38:31 +02:00
• 07df314e12 fix(cpg): prove the frontend can read the source before building, and check the graph always Marius CiepluchandClaude Opus 5 2026-09-10 11:35:35 +02:00
• bffadd5741 docs(zero-with-a-reason): the instrument must prove it can read its input Marius CiepluchandClaude Opus 5 2026-09-10 11:28:56 +02:00
• 4f5053bae1 feat(cpg): let the field half be switched off, so its cost can be attributed Marius CiepluchandClaude Opus 5 2026-09-10 11:17:42 +02:00
• f3f41e2fa9 docs: the 637-file wall is the taint query, not memory and not vendored code Marius CiepluchandClaude Opus 5 2026-09-10 09:06:03 +02:00
• c03944f7dd docs(benchmarks): the whole-plugin envelope, next to the slice results Marius CiepluchandClaude Opus 5 2026-09-10 08:49:07 +02:00
• ebf37a9b3c docs(contributor-scan): the 637-file scan, measured -- it decides nothing Marius CiepluchandClaude Opus 5 2026-09-10 08:48:05 +02:00
• 83adf049be feat(model): say when the region cap hid most of the repository Marius CiepluchandClaude Opus 5 2026-09-10 08:30:38 +02:00
• d63be34451 fix(cpg): ask the graph before splitting it, not the frontend's log Marius CiepluchandClaude Opus 5 2026-09-10 08:28:42 +02:00
• 7f83977add perf(model): stop sending 42MB of the same string, and stop enumerating for nobody Marius CiepluchandClaude Opus 5 2026-09-10 08:18:17 +02:00
• a762860b17 docs(contributor-scan): the 637-file premise was wrong, and it was my own shim Marius CiepluchandClaude Opus 5 2026-09-10 07:49:35 +02:00
• 9cce5a3181 feat(cpg): give the files a frontend refuses a CPG of their own Marius CiepluchandClaude Opus 5 2026-09-10 07:32:20 +02:00
• 1ce7e9db9b fix(cpg): build php through the frontend and retry while it drops files Marius CiepluchandClaude Opus 5 2026-09-09 21:11:12 +02:00
• d6908f18ba feat(cpg): the hook half — CVE-2022-25148 found across an add_filter/apply_filters edge Marius CiepluchandClaude Opus 5 2026-09-09 20:42:35 +02:00
• dcdbe322a1 feat(cpg): taint a field where it is assigned — the field half of 5.11 Marius CiepluchandClaude Opus 5 2026-09-09 19:42:20 +02:00
• e41d6dd7ea docs(contributor-scan): 5.11 -- a detection strategy, not a verdict of impossible Marius CiepluchandClaude Opus 5 2026-09-09 18:45:55 +02:00
• 2ba1aaf649 docs(contributor-scan): scope 5.11 to the hook registry, having checked its neighbours Marius CiepluchandClaude Opus 5 2026-09-09 18:44:26 +02:00
• 4adf5ecff5 docs(zero-with-a-reason): brief -- the same bug seven times Marius CiepluchandClaude Opus 5 2026-09-09 18:39:47 +02:00
• 435c14f3ec docs(contributor-scan): 5.8 -- WordPress class by class, including what it cannot ask Marius CiepluchandClaude Opus 5 2026-09-09 18:36:00 +02:00
• 45cf43e625 fix(cpg): one method with no sources must not cost the whole batch its answers Marius CiepluchandClaude Opus 5 2026-09-09 18:30:41 +02:00
• e0442d146c fix(cpg): a graph the frontend emptied must not read as a clean repository Marius CiepluchandClaude Opus 5 2026-09-09 18:07:28 +02:00
• 37a6594703 fix(mapping): a PHP method with a visibility modifier is a region Marius CiepluchandClaude Opus 5 2026-09-09 17:33:36 +02:00
• f13934c663 docs(overview): record the CVE, and what scoping is actually for Marius CiepluchandClaude Opus 5 2026-09-09 17:25:16 +02:00
• 96e7476c6d feat: the first real CVE, found in production plugin code Marius CiepluchandClaude Opus 5 2026-09-09 17:24:37 +02:00
• 21fdb554aa fix(cpg): a query that could not be asked is not an empty answer Marius CiepluchandClaude Opus 5 2026-09-09 17:15:51 +02:00
• db273dde53 docs(specs): WordPress flaw classes, the corpus insight, and an IR brief Marius CiepluchandClaude Opus 5 2026-09-09 17:04:04 +02:00
• 8579c10e7c docs: the WordPress checkout scans, and does not find its CVE Marius CiepluchandClaude Opus 5 2026-09-09 16:43:10 +02:00
• 9020318a83 fix(mapping): an array callable registers a handler too Marius CiepluchandClaude Opus 5 2026-09-09 16:36:12 +02:00
• 92677136d7 fix(cpg): a batch goes through a file, not the command line Marius CiepluchandClaude Opus 5 2026-09-09 16:27:58 +02:00
• 9c50e17c11 fix(cpg): retry a failed build through the language frontend Marius CiepluchandClaude Opus 5 2026-09-09 16:19:32 +02:00
• 922ed84053 feat(repos): a WordPress plugin with a verified CVE, and the WordPress DB API Marius CiepluchandClaude Opus 5 2026-09-09 16:13:17 +02:00
• 47b00d739b feat(model): one defect is one finding, however many regions reach it Marius CiepluchandClaude Opus 5 2026-09-09 15:56:01 +02:00
• 60d2a1a92c feat(model): an endpoint its contract declares open carries no obligation Marius CiepluchandClaude Opus 5 2026-09-09 15:39:58 +02:00
• 3e1d13e4b6 feat(reports): the model's own suspicion band is a proposal too Marius CiepluchandClaude Opus 5 2026-09-09 15:23:57 +02:00
• af7e33ef3e feat(reports): say what was looked for, and what cannot be decided Marius CiepluchandClaude Opus 5 2026-09-09 15:08:01 +02:00
• f488e625c2 fix(specs): the php2cpg "blocker" was the shim, not the frontend Marius CiepluchandClaude Opus 5 2026-09-09 14:45:36 +02:00
• 0ffa99b5e6 feat(model): one finding per sink site, and WordPress's registration model Marius CiepluchandClaude Opus 5 2026-09-09 14:30:48 +02:00
• 61811512a8 feat(facts): PHP semantic facts, validated against a real PHP CPG Marius CiepluchandClaude Opus 5 2026-09-09 14:18:57 +02:00
• b5d3cd6ab6 docs(roadmap): a v0.1 release definition, ordered toward libpng and WordPress Marius CiepluchandClaude Opus 5 2026-09-09 14:06:11 +02:00
• 9a65c998b4 docs(steering): an overview of what is true, and a roadmap ordered by one test Marius CiepluchandClaude Opus 5 2026-09-09 13:50:46 +02:00
• 290ecff9de docs(finding-feedback-loop): requirements approved, design generated Marius CiepluchandClaude Opus 5 2026-09-09 13:46:10 +02:00
• bccc89be52 docs(specs): approve the group-2 amendments, generate finding-feedback-loop requirements Marius CiepluchandClaude Opus 5 2026-09-09 13:40:45 +02:00
• 72932ed879 docs(specs): group 2 feedback as amendments, and lift out what was never specified Marius CiepluchandClaude Opus 5 2026-09-09 13:36:33 +02:00
• 00e178d69e feat(reports): a report proportionate to what the engine can say Marius CiepluchandClaude Opus 5 2026-09-09 13:29:26 +02:00
• d232f03597 feat(mcp): the findings list carries the rung, and leads with what was decided Marius CiepluchandClaude Opus 5 2026-09-09 13:15:54 +02:00
• 20edd9354b docs(contributor-scan): what the evidence says, and what it changes Marius CiepluchandClaude Opus 5 2026-09-09 13:13:11 +02:00
• 2589c3d47a docs(contributor-scan): what c/memory covers, and what SMT covers instead Marius CiepluchandClaude Opus 5 2026-09-09 13:11:30 +02:00
• c1191b3a6b feat(model): an access-control finding names a line, and what the PDG does not give us Marius CiepluchandClaude Opus 5 2026-09-09 13:09:47 +02:00
• 9221ba8e40 feat(model): a bound on the data lowers the rung, it does not clear it Marius CiepluchandClaude Opus 5 2026-09-09 13:01:30 +02:00
• 6dc25d77e4 feat(model): let the project say what it ships, and rank that first Marius CiepluchandClaude Opus 5 2026-09-09 12:45:21 +02:00
• 67497c4d68 fix(cpg): a sink is matched as a word, not as a substring Marius CiepluchandClaude Opus 5 2026-09-09 11:43:00 +02:00
• 68b4e551f3 feat(model): the envelope checkout, and no to Joern server mode Marius CiepluchandClaude Opus 5 2026-09-09 11:30:02 +02:00