This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+12 more
ReleasePort's take
Light signalThe release drops four structural lint rules for test files and refines the secret keyword scanner to evaluate exact tokens, cutting false positives.
Why it matters: Reduces lint false‑positive rates by up to 67 % in React and 58 % in Django; prevents secret placeholder filter from mistakenly discarding real credentials when non‑secret arguments share a line.
Summary
AI summaryFixed lint false positives on test files and improved secret placeholder filtering to avoid dropping real credentials.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | High |
Secret Keyword placeholder filter now evaluates exact token instead of whole line, preventing false positives with co‑located non‑secret arguments. Secret Keyword placeholder filter now evaluates exact token instead of whole line, preventing false positives with co‑located non‑secret arguments. Source: llm_adapter@2026-07-18 Confidence: low |
— |
| Security | High |
Secret Keyword placeholder filter now evaluates the exact flagged token instead of requiring every line value to be a placeholder. Secret Keyword placeholder filter now evaluates the exact flagged token instead of requiring every line value to be a placeholder. Source: granite4.1:30b@2026-07-18-audit Confidence: low |
— |
| Security | High |
Scanner stores only a boolean verdict, never raw values, preserving confidentiality of real credentials. Scanner stores only a boolean verdict, never raw values, preserving confidentiality of real credentials. Source: granite4.1:30b@2026-07-18-audit Confidence: low |
— |
| Performance | Medium |
Reduces false positives by 67% on React tests and 58% on Django tests while leaving other frameworks unchanged. Reduces false positives by 67% on React tests and 58% on Django tests while leaving other frameworks unchanged. Source: granite4.1:30b@2026-07-18-audit Confidence: low |
— |
| Bugfix | Medium |
Diff‑scoped per‑edit lint stops re‑surfacing pre‑existing line‑anchored findings as "introduced" when edits shift line numbers. Diff‑scoped per‑edit lint stops re‑surfacing pre‑existing line‑anchored findings as "introduced" when edits shift line numbers. Source: llm_adapter@2026-07-18 Confidence: high |
— |
| Bugfix | Medium |
Drops four structural lint rules for test files, reducing false positives by up to 67% in React and 58% in Django. Drops four structural lint rules for test files, reducing false positives by up to 67% in React and 58% in Django. Source: llm_adapter@2026-07-18 Confidence: low |
— |
| Bugfix | Low |
Drops four structural lint rules (default export, top-level constructs, named-export count, use-client/server signal) for test files in per-edit lint. Drops four structural lint rules (default export, top-level constructs, named-export count, use-client/server signal) for test files in per-edit lint. Source: granite4.1:30b@2026-07-18-audit Confidence: low |
— |
| Other | Low |
confidence_reason null for all facts as they are directly stated in the changelog. confidence_reason null for all facts as they are directly stated in the changelog. Source: llm_adapter@2026-07-18 Confidence: low |
— |
Full changelog
Fixed
- A test file with no dedicated test directory buckets to its enclosing app or
component directory, so a SOURCE archetype claims it and its production-shape
structural rules (default export, top-level constructs, named-export count,
use-client/server signal) fire on test code they never fit. Those four rules
are now dropped on a test path in the per-edit lint. Measured 67% fewer
per-edit findings on React test files and 58% on Django test files, with zero
change on repos whose tests route correctly (Rails, FastAPI, Flask).
jsx-presence-mismatch (the only block-eligible structural rule) is kept, so the
block partition and Stop arming stay byte-identical. - The Secret Keyword placeholder filter now judges the EXACT flagged token
instead of requiring every value on the line to be a placeholder. A co-located
non-secret argument (login(username="eric", password="test")) no longer keeps
a placeholder hit alive. The scanner carries a boolean verdict computed at scan
time and never stores the raw value. Security-preserving: a real credential is
never a placeholder, the concat-obfuscation defense still runs first, and a real
secret co-located with a placeholder on one line still keeps its hit. The
co-located guard is key-aware: a non-placeholder value under a credential-named
key (token="s3cr3t",db_password="hunter2") keeps the hit even when the value
is short and low-entropy, so a WEAK real secret sharing a folded line with a
placeholder is never dropped, while a co-locatedusername="eric"(a non-secret
key) still drops. The deterministic hard-secret path is untouched. - Diff-scoped per-edit lint no longer re-surfaces a pre-existing line-anchored
finding (e.g. a style violation naming its line number) as "introduced" when an
edit shifts line numbers. The finding key ignores the line-number reference, so
a pre-existing finding matches its shifted counterpart; a genuinely different
finding (different overage, different symbol) still keys distinctly. The
introduced-finding diff is a MULTISET diff (count increase), not set membership,
so a genuinely NEW instance of a line-anchored rule -- a second command-injection
an edit adds to a file that already had one -- still surfaces even though it
shares a normalized key with the pre-existing one, while a single shifted finding
stays deduped. This keeps the security-adjacent dangerous-sink advisories
(command-injection, insecure-deserialization, insecure-random, weak-hash,
sql-string-interpolation) from being masked on the per-edit path.
Security Fixes
- Secret Keyword placeholder filter now judges the exact flagged token, preventing false negatives when non-secret arguments coexist on the same line while preserving real credential hits.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Chameleon
All releases →Beta — feedback welcome: [email protected]