codetruss 0.2.53

[DeliriumPulse]

Points the formula at the v0.2.53 release archive.

url    https://github.com/CodeTruss/codetruss-cli/releases/download/v0.2.53/codetruss-cli-0.2.53.tgz
sha256 5344ab8e32c5ccd0093d17088c520aa685b988423a0890de29cbaac1c96c2aca

That digest was measured off the downloaded release asset, not copied from the release notes, and the URL written above was fetched independently and cmpd against it. The asset is byte-identical to public/downloads/codetruss-cli-0.2.53.tgz in the monorepo, to the bytes codetruss.com serves, to the site's latest pointer, and to the archive rebuilt independently in the mirror from its own lockfile. gh attestation verify codetruss-cli-0.2.53.tgz --repo CodeTruss/codetruss-cli passes — verified with --format json rather than a bare exit code, so the subject it actually verified (codetruss-cli-0.2.53.tgz, digest 5344ab8e…) and the builder (.github/workflows/release.yml@refs/tags/v0.2.53) are on the record. The release carries all three attestations: SLSA provenance v1, CycloneDX, and the in-toto release predicate — the last confirmed through the attestations API, since gh 2.85 cannot verify a predicate signed by GitHub's release identity (dotcom.releases.github.com) under --repo.

The same cmp against 0.2.52 — the version this formula pointed at until now — exits 1, so the comparison is capable of failing. gh attestation verify was likewise checked against a tampered copy of the archive (one appended byte), against the pre-transfer DeliriumPulse/… slug, and against an unrelated repo; all three exit 1, and the attestations API returns 404 for the tampered digest. The exit 0 above is not vacuous.

Nothing else changes. .github/workflows/test.yml derives the expected version from brew info rather than a literal, so it needs no edit; the version assertion in CI is what proves the installed binary matches the formula.

What 0.2.53 carries

Unlike 0.2.52, which was documentation only and moved the compiled bundle by exactly one byte, this release changes analyzer behaviour. dist/cli.cjs goes from 819,902 to 828,029 bytes, 4 changed lines out of 296.

It came out of a cross-tool benchmark against ten repositories chosen by a rule written before either tool ran — a corpus we did not pick — comparing CodeTruss 0.2.51 against Semgrep CE. It found false positives our own eight-repository sweep had not, including a CRITICAL.

A drizzle query was reported CRITICAL for being a SQL injection when it is the documented safe construction. firecrawl's apps/api/src/db/rpc.ts:98 is db.execute(sql`select … ${params.team_id} …`) — a tagged template with bound parameters — and 0.2.51 called it CWE-89 CRITICAL, "untrusted input is concatenated". The rule already had this exemption for Prisma, but expressed it as a method-name list, so it protected one library by name rather than the construction by shape. It now matches the shape, which covers drizzle, postgres.js, slonik and the next library that builds queries the same way. Untagged template literals still fire, and sql.raw() is still a sink, including nested inside a tagged template.

The same rule was silent on a genuinely dynamic query, which Semgrep caught. uptime-kuma's server/monitor-types/postgres.js:63 is client.query(query, …) where query is the function's own parameter — nothing in the file constrains what a caller can run. A bare parameter had never counted as a source, so we missed it. It now reports at HIGH.

Typed credentials in test paths are downgraded on the value, not the path. The test-context downgrade previously reached only the generic-password pattern; it now reaches AWS/GitHub/Stripe/Anthropic/OpenAI/Google/Slack via a value-shape predicate measured at zero hits across 20,000 random base62 bodies. Database URLs and PEM private-key blocks are deliberately excluded — a real connection string or key in a fixture is still a real leak. 25 HIGH findings became LOW.

Receipts move to the local-registry-v5 analysis profile. Every superseded profile keeps a frozen renderer so receipts signed under it still verify byte-for-byte; v1 through v4 pin unchanged SHA-256s, and v4's is character-identical to what 0.2.52 shipped.

Verified against the published archive, not a local build

Installed into a dedicated npm --prefix and invoked by absolute path — this machine also carries a stale global codetruss (0.2.28) that must not be allowed to answer:

• codetruss --version → codetruss 0.2.53
• firecrawl at its pinned commit 6ff68d3b: the CRITICAL at apps/api/src/db/rpc.ts:98 is gone (155 findings → 154; sql-injection 1 → 0).
• uptime-kuma at its pinned commit 77d1a0c5: server/monitor-types/postgres.js:63 is now reported at HIGH (92 findings → 99; sql-injection 0 → 7, also catching the same shape in mssql.js, mysql.js and oracledb.js).
• A freshly signed receipt reads Profile: `local-registry-v5` and codetruss verify latest accepts its signature.

The rule was not simply switched off: it lost one finding on firecrawl and gained seven on uptime-kuma.

One known wart

README.md inside this archive still says receipts identify the "15-pass local-registry-v4 profile". As of 0.2.53 they identify local-registry-v5, and the CHANGELOG.md in the same archive says so. The pass count is right; the profile identifier is stale. It is recorded rather than patched, because these bytes are already tagged, attested and served — a correction belongs in 0.2.54.

🤖 Generated with Claude Code