Tags: vyprai/vyql

vyql 0.3.0

One exit-code contract across every command: 0 the command run successfully,
1 vyql could not complete, 2 the invocation cannot mean anything, 3 the check
ran and did not pass. scan gates at 3, so findings and a failed scan no longer
share a status.

stdout carries exactly one document in the requested format; -stats and
-coverage moved to stderr, which stops them corrupting json and sarif output.

-exclude takes glob patterns and is repeatable, and prunes the walk rather
than filtering after it. Applying -baseline gates on any new finding unless
-fail-on names a threshold.

The duplicate commands are retired: query -from/-to and graph -taint are
trace, bindings and validate-binding are under definitions, and every retired
spelling names its replacement when used.

-exit-code is removed. graph-json exports the functions and call edges the
graph actually has.

v0.2.5

Baseline files are keyed on the identity policy now and must be
re-recorded; a v1 file is rejected rather than silently matching
nothing. See the changelog before upgrading.

Adds vyql cache clear/path. Fixes a rebuild replaying the previous
binary's analysis through the incremental delta caches, a can_access
rule compiling into permanent silence, SARIF documents contradicting
themselves on severity, and --max-ram dropping a node's inline
properties.

Interface dispatch no longer routes through every implementation, which
removed three OWASP Benchmark class names hardcoded into the shared
resolver. Measured across 24 corpora: OWASP unchanged (+1.00 Java,
+0.90 Python, 21 of 22 ports at +1.00), and 15 fewer false positives on
the 62-repo RealVuln corpus with recall unchanged.

VyQL v0.2.0

First public release.

A multi-language security scanner that follows tainted data from where it
enters a program to where it does something dangerous, and reports the
neutralizing controls it looked for and did not find.

Scanning across 22 languages, with the security knowledge shipped as data
rather than compiled in. scan exits 1 on HIGH or CRITICAL, so adding it to a
pipeline gates that pipeline. Triage verdicts persist in a baseline keyed on
the finding fingerprint. Files no frontend read are reported, because a clean
result over a tree that was mostly skipped reads like a clean result over one
that was fully read.

Measured on the public OWASP Benchmark suites by Youden index:
BenchmarkJava +1.00, BenchmarkPython +0.90.

See CHANGELOG.md.