v1.3.6

[shivasurya]

v1.3.6 - 2026-02-16

🎉 Major Features

Full Go Language Support

Complete implementation of Go static analysis capabilities

• Core Parsing (feat(golang): Go file detection and tree-sitter-go parsing (PR-01) #520-525): File detection, AST parsing, function/method declarations, type definitions, variables, constants, calls, closures, and control flow statements
• Advanced Analysis (feat(golang): Go module registry and import resolution (PR-07) #526-530): Module registry, import resolution, call graph construction, scan/CI pipeline integration, security rules, and MCP server support
• Type Tracking (feat(go): Add type tracking data structures for Phase 2 #536-540): Phase 2 type tracking with return type extraction, variable assignment tracking, and method call resolution via variable types
• Performance (perf(go): Parallelize call graph building and add progress tracking (PR-18) #541-542): Parallel call graph building with progress tracking and background indexing to prevent MCP client timeouts

Docker Analysis Support

New MCP tools for Docker security analysis:

• Basic Docker MCP support (feat(mcp): Add basic Docker MCP support #531)
• Semantic Docker query tools (feat(mcp): Add semantic Docker query tools #534)
• Docker dependency graph mapping (feat(mcp): Add Docker dependency graph mapping #535)

GitHub Actions Security Scanner

• Automated security scanning workflow with PR summary reports
• Inline code comments for security findings
• Integration with SARIF output for GitHub Advanced Security

🚀 Improvements

Python SAST Enhancements

• Populate ReturnType and MethodArgumentsType for Python functions (fix(python/sast): Populate ReturnType and MethodArgumentsType for Python functions #513)
• Add inferred type information to module variables in find_symbol (fix(python/sast): Add inferred type information to module variables in find_symbol #514)
• Expose parameter types as standalone symbols (feat(python/sast): Expose parameter types as standalone symbols in find_symbol #518)
• Populate inferred return types and detect void functions (feat(python/sast): Populate inferred return types and detect void functions in find_symbol (#519) #519)

Performance Optimizations

• Parallel call graph building with progress tracking (perf(go): Parallelize call graph building and add progress tracking (PR-18) #541)
• Background indexing to prevent MCP client timeout (feat(go): Background indexing to prevent MCP client timeout (PR-19) #542)

🐛 Bug Fixes

• Python SAST: Fix module variable reassignment contamination and var: placeholder leaking (fix(python/sast): Fix module variable reassignment contamination and var: placeholder leaking #515)
• SARIF: Fix SARIF upload failing with empty artifact locations (fix(sarif): Fix SARIF upload failing with empty artifact locations #517)
• Rules: Make ZIP creation deterministic to prevent checksum mismatches (fix(rules): Make ZIP creation deterministic to prevent checksum mismatches #532)
• CI: Add Cloudflare cache purging to rules deployment workflow (fix(ci): Add Cloudflare cache purging to rules deployment workflow #533)

📦 Dependencies

• Upgrade Go to 1.26.0 and update dependencies (chore(deps): Upgrade Go to 1.26.0 and update dependencies #516)

📝 Full Changelog

View all 31 pull requests

Contributors: @shivasurya

---

This discussion was created from the release v1.3.6.