## Dicklesworthstone/ultimate_bug_scanner — v5.4.15…v5.4.16

_303+ commits._

### Features
- **feat(python-taint): checkpoint URL-aware interprocedural SSRF detection** (d897c06)
- **feat(rules): repeatable --rules, UBS_RULES, and project rules in every module (GH #144)** (38925df)
- **feat(rust): checkpoint scoped redirect dataflow and helper summaries** (b61e464)
- **feat(python): retain concrete callback identities in finite function summaries** (195edb3)
- **feat(python): validate finite callback-aware function summaries after lexical closure repair** (b42bf17)
- **feat(python): checkpoint literal call unpacking and returned receiver identity** (e084def)
- **feat(python): activate comprehension heap effects and ordered execution** (4403efa)
- **feat(python): checkpoint comprehension dataflow implementation for native validation** (e843ae5)
- **feat(taint): activate Go request decoding and output-parameter summaries** (b3a3603)
- **feat(javascript): propagate ordered reduce and reduceRight accumulator flows** (a19d6f5)
- **feat(javascript): analyze inline arrays and chained callback results** (b174369)
- **feat(javascript): propagate native array callback values heap effects and exceptions** (34443e3)
- **feat(editor): refresh saved dependencies within incremental buffer workspaces** (8fe9c68)
- **feat(javascript): solve callee prerequisites before replaying mutation callers** (2eedb0d)
- **feat(editor): reuse private buffer workspaces across unsaved edits** (f28a40a)
- **feat(javascript): reuse parametric heap summaries across caller origins** (e74935e)
- **feat(editor): analyze unsaved buffers in isolated workspace snapshots** (300c568)
- **feat(javascript): track native method identity and evaluate spread calls once** (8f95b2e)
- **feat(javascript): preserve optional heap shapes and sparse spread positions** (cea566d)
- **feat(editor): synchronize incremental UTF-16 buffer edits exactly** (0587a73)
- **feat(javascript): activate verified exception and catch-binding analysis** (a27bb85)
- **feat(javascript): activate verified ESM TypeScript and CommonJS cross-file taint** (fbb4f59)
- **feat(editor): preserve cross-file context in grouped document scans** (4a4fbec)
- **feat(javascript): preserve catch bindings, projections and initializer effects** (150bfb3)
- **feat(javascript): model call completion and exception stores through finalizers** (2047530)
- **feat(editor): publish saved-source UBS diagnostics over LSP** (bc0ceb9)
- **feat(javascript): prepare atomic activation of verified cross-file runtime** (97943ee)
- **feat(javascript): analyze selected static CommonJS module interfaces** (597373c)
- **feat(watch): add native filesystem notifications with byte reconciliation** (c7a6410)
- **feat(watch): rescan directories on recursive project changes** (69d5094)
- **feat(watch): invalidate scans on dependency and policy tree changes** (bcc2abb)
- **feat(distribution): install and update checksum-pinned daemon generations** (039b6a1)
- **feat(javascript): resolve deep reexport graphs with finite binding worklists** (ed0fa58)
- **feat(python): activate verified cross-file taint across selected modules** (16e29d0)
- **feat(daemon): add debounced watch feedback with stale-scan cancellation** (91ce5ca)
- **feat(typescript): connect emitted import paths to selected source implementations** (09f9a67)
- **feat(cli): implement checksum-pinned canonical daemon commands** (5a9ffb7)
- **feat(python): implement selected-module cross-file taint and cache-safe analysis** (6dfa2ec)
- **feat(daemon): support project, directory and Git-scoped scans** (f31f63b)
- **feat(javascript): publish selected-module taint and dependency-aware caching** (2fd17f7)
- **feat(engine): activate bounded-memory streaming baseline matching** (ed5ca05)
- **feat(daemon): cancel individual obsolete scans without stopping other agents** (ad7b5ea)
- **feat(daemon): run independent scans in bounded parallel workers** (85dc702)
- **feat(engine): activate verified Python dataflow and fail-closed baseline analysis** (3f5fd58)
- **feat(daemon): keep controls responsive with bounded scan admission** (6baa9f9)
- **feat(javascript): activate verified interprocedural heap taint analysis** (32c91ab)
- **feat(agent): connect save hooks to the local scan service without hiding failures** (509a850)
- **feat(javascript): propagate heap mutations and fresh objects through helper calls** (998e982)
- **feat(python): integrate cleanup and deferred-call taint with process analysis** (94ccd3a)
- **feat(security): import and authenticate portable runtime archives directly** (2164cdc)
- **feat(agent): add authenticated repository-local scan service** (6446f7f)
- **feat(go): implement request decoding through pointer destinations and helper writes** (31c5b1f)
- **feat(javascript): publish heap alias and mutation analysis for verified activation** (d2e625b)
- **feat(go): activate verified package summaries and initializer dataflow** (d2d68b2)
- **feat(python): track saved process vectors and interpreter stdin sources** (df23278)
- **feat(go): resolve package initializer dependencies and grouped declarations** (6d36106)
- **feat(javascript): model native collection mutations and shallow copy semantics** (156655b)
- **feat(distribution): export verified portable runtimes for offline scanning** (0a65b98)
- **feat(python): detect interpreter payloads across process execution APIs** (da0a603)
- **feat(go): implement package-local taint summaries and dependency-aware caching** (3d9264d)
- **feat(javascript): implement field-sensitive object and array alias taint** (22cc3f1)
- **feat(security): verify the complete signed runtime asset graph before execution** (44695c9)

### Fixes
- **fix(python-rules): self-scan false positives in five rules** (eb4de96)
- **fix(docs-claims): no false failures from daemon prose or local tool caches** (fae99b2)
- **fix(python-lifecycle): a called closure releases the enclosing resource** (9df1967)
- **fix(rust): a warm scan keeps tech-debt findings in category order** (c91a6ee)
- **fix(runner): restore workspace paths that modules report resolved** (6af0261)
- **fix(js-taint): numbers, query rows and res.json are not injection vectors** (7ce62aa)
- **fix(harness): fixture pins no longer take a security pair's slot** (e5eb0f2)
- **fix(js-cache): key linked modules by their import component, not the selection** (7050a16)
- **fix(security): post-install checks run the installed ubs, not PATH's (review of 3b2e3ea)** (7f6edae)
- **fix(python-taint): revoke HTTP identity after missing or shadowed imports** (dadc5bf)
- **fix(python): harden resource lifecycle ownership tracking** (0daffd7)
- **fix(rules): shared rule repositories load as one policy (review of 38925df, GH #144)** (fb193d3)
- **perf(python-taint): stop re-solving unchanged work; fix the self-scan index-arithmetic tier** (eaba66a)
- **fix(python): index-arithmetic no longer reads ast.MatchAs on Python 3.9 (review of f21b67a)** (3f9b0cd)
- **fix(python): preserve lexical closure bindings inside comprehensions** (925abb0)
- **fix(python): preserve bound callback receiver state in a verified implementation checkpoint** (9fc6eb9)
- **fix(core): close blocked analyzer producers when report encoding fails** (d4630a6)
- **fix(python): checkpoint reconciled lexical closure bindings for native validation** (db4325b)
- **fix(python): activate precise call unpacking and returned receiver effects** (fc2f42d)
- **perf(core): bound parallel finding streams without losing scope or atomicity** (0d5495f)
- **fix(core): integrate pending worker atomicity with scope-safe scheduling** (7596c5c)
- **fix(javascript): preserve sequence values and ordered accumulator writes** (af4fd47)
- **fix(core): checkpoint complete-result publication beside parallel scope fix** (242d480)
- **fix(javascript): retain executable Python gate evidence during reducer integration** (68322fa)
- **fix(taint): propagate mutable iterable writes across Python loop back edges** (d9e6716)
- **fix(taint): model ordered Python match guards and completion paths** (7b4b4da)
- **fix(taint): propagate Python match captures, identities and heap aliases** (571485a)
- **fix(core): checkpoint scope-preserving parallel analysis for native validation** (3fbc5dd)
- **fix(javascript): verify callback activation with current Python and helper contracts** (0aeebd4)
- **fix(python): keep ubs_core importable on Python 3.9 (review of 1173884)** (f21b67a)
- **fix(checksums): consult git ignores only in ubs's own repository (review of 5200d9e, GH #144)** (00cc304)
- **fix(checksums): skip git-ignored helper files, not just dot-dirs (review of b89cc96, GH #144)** (5200d9e)
- **perf(editor): index grouped diagnostics once with correct source ownership** (ff9ce22)
- **fix(javascript): converge callback mutation loops and preserve real entrypoints** (838ff08)
- **fix(python): inspect complete subprocess invocation inputs** (e4fb7b0)
- **fix(python): preserve command taint across partial sanitization** (cca7686)
- **fix(editor): accept verified zero-finding scanner reports** (58d7a01)
- **fix(javascript): integrate verified heap runtime with current helper integrity** (7041f89)
- **fix(checksums): stop pinning local .ruff_cache files as helper assets (review of d58f0f2, GH #144)** (b89cc96)
- **fix(rust): anchor the tech-debt aggregate at a stable location (GH #150)** (25b5c42)
- **fix(rules): stop dropping nested and .yaml --rules files (GH #144)** (d58f0f2)
- **fix(rust): make partially cached scans report what a cold scan reports (GH #150)** (6475913)
- **fix(analyzers): analyze every selected file whatever its ancestors are named (GH #151)** (c973de6)
- **fix(javascript): keep lockfiles and manifests out of the regex code patterns (GH #149)** (312f279)
- **fix(javascript): report window.fetch() split after its receiver (GH #148)** (53b5585)
- **fix(javascript): preserve exported native mutations across module imports** (0db11c9)
- **fix(javascript): follow signed artifact redirects without API authorization** (2155a21)
- **fix(javascript): preserve CommonJS snapshots across shared export writes** (db052f9)
- **fix(daemon): reject mixed-generation cache snapshots and unsafe reads** (131bcb1)
- **fix(typescript): retain mts and cts through the complete scanner selection path** (b381a9b)
- **fix(javascript): validate module findings across both scanner report contracts** (65bef59)
- **fix(daemon): supervise scan process groups with bounded cancellable output** (1f76ae5)
- **fix(go): preserve selected package order for integrated taint activation** (0caa198)
- **fix(javascript): validate heap runtime on either Linux or macOS capacity** (7eac1c2)
- **fix(javascript): run heap integrity gates with the required Bash toolchain** (f80bcb7)
- **fix(baseline): preserve critical findings and regression identity for validated activation** (7367fa1)
- **fix(security): prevent verified installs from re-executing unsigned main** (3b2e3ea)
- **fix(javascript): preserve argument effects and captures across completion summaries** (7fb436c)

### Tests
- **test(security): restore host PATH in verified-release tests (revert d6c53b7)** (d631b05)
- **test(daemon): leak check uses a marker that cannot occur in a path** (5132d05)
- **test: skip non-UTF-8 filename fixtures where the filesystem refuses them** (d0ca022)
- **test(cli-contract): fake v2 module writes the findings-sink schema** (e6eba16)
- **test(goldens): record intended rule-pack SARIF result counts** (6c67b8b)
- **test(meta-runner): run the --update check on a disposable copy** (9ec5402)
- **test(security): keep a host ubs off PATH in verified-release tests** (d6c53b7)
- **test(checksums): scaffold verifier fixture pins only helpers it ships** (e103c68)
- **test(python-taint): validate the complete SSRF runtime integrity cascade** (7a6e3ad)
- **test(python-taint): pin worklist reuse to a from-scratch re-solve (review of eaba66a)** (fc881c6)
- **test(python): separate reproducible source-object transport from full native validation** (e734b82)
- **test(python): provide the pinned TypeScript oracle required by broad taint validation** (8e8c759)
- **test(python): isolate native closure validation dependencies from shared npm state** (43aa0e0)
- **test(python): cross-validate exact unpacking candidate on x64 and Python 3.9** (8bd3847)
- **test(core): provision compiler oracle and supported Python for full-scope validation** (9f18b25)
- **test(taint): validate live integrity suites and mutable-iterator regression before publication** (b9b1801)
- **test(taint): validate preserved Python match and Go decoding implementations before atomic publication** (07ce305)
- **test(python): validate command invocation on the ARM runner pool** (16c809f)
- **test(python): exercise command-injection fixes through the real scanner** (fd9cad6)
- **test(javascript): pin that property names never carry a local's taint (GH #146)** (5be2de9)
- **test(js): restore bugs a style pass removed from buggy fixtures and pin them (GH #147)** (bb03315)
- **test(install): preserve project-hook scope across verified daemon distribution** (3bddbbd)
- **test(python): run integrated runtime verification on available macOS capacity** (cc91f51)
- **test(python): validate the integrated runtime against current main** (14b7bd4)

### Docs
- **docs(changelog): v5.4.16** (1f68734)

### Chore
- **chore(checksum): refresh lifecycle module and runner checksums** (ce4634c)
- **chore(checksum): finish shared-library checksum propagation** (c347af6)
- **chore(checksum): propagate lifecycle helper hash through shared library** (65395be)
- **chore(beads): close five beads verified already shipped** (822f6fa)
- **chore(checksums): regenerate tables for command_injection.py (e4fb7b0)** (1173884)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/Dicklesworthstone/ultimate_bug_scanner?utm_source=github-action)._