## Dicklesworthstone/ultimate_bug_scanner — v5.4.17…v5.4.18

_26 commits._

### Features
- **feat(csharp): track aliased ref/out effects and emit JSON/SARIF flow evidence (D6)** (e1b34d0)
- **feat(csharp): integrate helper-summary dataflow with verified runtime pins (D6)** (94b3923)
- **feat(csharp): integrate alias-aware output summaries and public flow evidence** (0bd5738)
- **feat(csharp): validate and atomically integrate D6 dataflow with runtime checksums** (d355661)
- **feat(csharp): add function-scoped request-path dataflow and helper summaries (D6)** (409a625)
- **feat(lsp): bound diagnostic delivery and revalidate deferred results** (07d3395)
- **feat(lsp): support versioned diagnostic pulls and cancellable scan subscribers** (a9c6df6)

### Fixes
- **fix(scanner): share connected-module code and retain proved Python index bounds** (26e5770)
- **fix(scanner): bound JavaScript report memory and require Python operator evidence** (eb784e6)
- **fix(checksums): pin the masker and exclusion changes; name the TS probe error** (53790b6)
- **fix(js): preserve executable-code equality filtering and quote/regex context handling [GH-157]** (7e1562f)
- **fix(js-taint): route-params regex backtracked quadratically over blanked call bodies (GH #156)** (012284b)
- **fix(verify): bound tar extended metadata by declared size, not read size (GH #155)** (dc2d8ee)
- **fix(js): loose-equality matches executable code only, not strings or comments (GH #157)** (4ba0ac3)
- **fix(suppression): a marker on one statement no longer leaks onto the next** (87b8088)
- **fix: rule-scoped multiline ctcompare suppressions; Cargo test context in multi-file scans (GH #152, #153, #154)** (08a40ef)

### Backend
- **merge(scanner): retain local memory/precision fixes with remote C# flow evidence** (c1b7fac)

### Tests
- **test(python): exercise notebook float operators through the real scanner CLI** (d05d57a)
- **test(core): run every embedded ubs_core self-test in the gate; fix spec_hooks's; typeof masker apostrophes** (b856358)
- **test(taint): preserve bounded whitespace regression runtime without changing production matching** (5674693)
- **test(js-taint): skip the resolver oracle on TypeScript 7; resolve macOS temp paths** (a908e60)

### Docs
- **docs(beads): record final C6 validation evidence** (58590a3)
- **docs(beads): record C6 memory evidence and bounded honesty audit** (4243e01)
- **docs(beads): retain exact memory-gate findings and remaining full-suite limits** (f0c8338)
- **docs(beads): record investigation of JavaScript operator false positives** (183628a)

### Chore
- **chore(beads): G6 blocked on disabled workflows; file a1oa (JS operator rules over non-code)** (40e9bcf)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/Dicklesworthstone/ultimate_bug_scanner?utm_source=github-action)._