This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+14 more
ReleasePort's take
Light signalThe release introduces a TypeScript‑backed AST/dataflow engine for lazy intra‑file analysis and makes VG406 dataflow‑aware, reducing false positives. It also adds a pure‑JS runtime dependency on typescript with no native bindings.
Why it matters: Enables precise VG406 alerts only when route params truly reach DB sinks; introduces TypeScript compiler as a zero‑dependency runtime requirement for new analysis features.
Summary
AI summaryNew AST/dataflow engine adds real intra-file dataflow and VG406 becomes dataflow‑aware reducing false positives.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Adds a new AST/dataflow engine backed by TypeScript compiler, enabling lazy intra-file dataflow analysis. Adds a new AST/dataflow engine backed by TypeScript compiler, enabling lazy intra-file dataflow analysis. Source: llm_adapter@2026-06-08 Confidence: high |
— |
| Feature | Medium |
VG406 becomes dataflow-aware, firing only when route params actually flow into a DB sink across assignments and query builders. VG406 becomes dataflow-aware, firing only when route params actually flow into a DB sink across assignments and query builders. Source: llm_adapter@2026-06-08 Confidence: low |
— |
| Feature | Medium |
VG406 now performs dataflow-aware checks, triggering only on actual route param flow to DB sinks. VG406 now performs dataflow-aware checks, triggering only on actual route param flow to DB sinks. Source: granite4.1:30b@2026-06-08-audit Confidence: low |
— |
| Dependency | Low |
Adds runtime dependency on typescript (pure‑JS, zero sub‑deps, no native bindings). Adds runtime dependency on typescript (pure‑JS, zero sub‑deps, no native bindings). Source: llm_adapter@2026-06-08 Confidence: high |
— |
Full changelog
- New AST/dataflow engine (TypeScript-compiler-backed, lazy): real intra-file dataflow the regex engine can't do
- VG406 is now dataflow-aware — it fires only when a route param actually flows into a DB sink (multi-hop, through assignments/query-builders), not just co-occurs with one. Validated: 24 to 20 findings, all 4 removed are confirmed false positives, 0 true positives lost
- Adds a runtime dependency (typescript: pure-JS, zero sub-deps, no native bindings); the README claim is updated to 'minimal, fully-audited runtime dependencies'. No rule or tool changes (442 / 37); gate green (PASS/A/0)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About goklab/guardvibe
Security MCP for vibe coding with 330 rules and 29 tools. Purpose-built for AI-generated code — scans Next.js, Supabase, Clerk, Stripe, Prisma, Hono, GraphQL, and 25+ modules. Cross-file taint analysis, host security audit, auto-fix, SARIF export, pre-commit hook, and CVE version detection. Zero config, runs locally.
Related context
Related tools
Beta — feedback welcome: [email protected]