Shisho is a lightweight static analyzer for developers.

Flatt Security Inc.

Last update: Dec 25, 2022

Overview

shisho

Shisho is a lightweight static analyzer for developers.

Please see the usage documentation for further information.

Try with Docker

You can try shisho in your machine as follows:

echo "func test(v []string) int { return len(v) + 1; }" | docker run -i ghcr.io/flatt-security/shisho-cli:latest find "len(:[...])" --lang=go

file.go docker run -i -v $(PWD):/workspace ghcr.io/flatt-security/shisho-cli:latest find "len(:[...])" --lang=go /workspace/file.go ">

echo "func test(v []string) int { return len(v) + 1; }" > file.go
docker run -i -v $(PWD):/workspace ghcr.io/flatt-security/shisho-cli:latest find "len(:[...])" --lang=go /workspace/file.go

Install with pre-built binaries

When you'd like to run shisho outside docker containers, please follow the instructions below:

Linux / macOS

Run the following command(s):

# Linux
wget https://github.com/flatt-security/shisho/releases/latest/download/build-x86_64-unknown-linux-gnu.zip -O shisho.zip
unzip shisho.zip
chmod +x ./shisho
mv ./shisho /usr/local/bin/shisho

# macOS
wget https://github.com/flatt-security/shisho/releases/latest/download/build-x86_64-apple-darwin.zip -O shisho.zip
unzip shisho.zip
chmod +x ./shisho
mv ./shisho /usr/local/bin/shisho

Then you'll see a shisho's executable in /usr/local/bin.

Windows

Download the prebuild binary from releases and put it into your %PATH% directory. If you're using Windows Subsystem for Linux, you can install shisho by bash <(curl -sL get.shisho.dev/linux).

We're also building Shisho as a Service to make Security-as-Code more accessible.
If you need direct support, you can contact us at [email protected].

Comments

Allow excluding files from search
Problem

First of all, thank you for this really useful project.

Shisho finds matches in files which are auto-generated or I don't have control over them (vendored). It's not feasible to fix the reported issues in these files.

I.e. consider this policy file for Golang:

version: '1' rules: - id: 'deny-fmt-println' language: go message: | Avoid calling fmt.Println, as it can make log output messy. Use logging instead. pattern: | fmt.Println(:[_]) - id: 'deny-panic' language: go message: | Avoid calling panic() manually. Return the error instead. pattern: | panic(:[_])

Both rules will likely find matches in the vendor folder. Some libraries generate code with panic() calls in it: https://github.com/99designs/gqlgen/blob/1a0b19feff6f02d2af6631c9d847bc243f8ede39/example/chat/generated.go#L2028

Possible Solutions

generated code & vendor folder: I'd like to exclude it from the search, perhaps via CLI flag or extending the rule file with file excludes.

ignoring false positives: Sometimes we want to silence the linter in particular cases. We could use some comments and either match against those comments in constraints (manually) or make shisho aware of a convention: panic("foo") // shisho:ignore deny-panic

Additional Notes

type: feature
opened by ihrwein 6
chore(deps): bump loader-utils from 1.4.0 to 1.4.1 in /docs
Bumps loader-utils from 1.4.0 to 1.4.1.

Release notes

Sourced from loader-utils's releases.

v1.4.1

1.4.1 (2022-11-07)

Bug Fixes

security problem (#220) (4504e34)

Changelog

Sourced from loader-utils's changelog.

1.4.1 (2022-11-07)

Bug Fixes

security problem (#220) (4504e34)

Commits

8f082b3 chore(release): 1.4.1

4504e34 fix: security problem (#220)

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies javascript
opened by dependabot[bot] 3
chore(deps): bump terser from 5.7.1 to 5.14.2 in /docs
Bumps terser from 5.7.1 to 5.14.2.

Changelog

Sourced from terser's changelog.

v5.14.2

Security fix for RegExps that should not be evaluated (regexp DDOS)

Source maps improvements (#1211)

Performance improvements in long property access evaluation (#1213)

v5.14.1

keep_numbers option added to TypeScript defs (#1208)

Fixed parsing of nested template strings (#1204)

v5.14.0

Switched to @jridgewell/source-map for sourcemap generation (#1190, #1181)

Fixed source maps with non-terminated segments (#1106)

Enabled typescript types to be imported from the package (#1194)

Extra DOM props have been added (#1191)

Delete the AST while generating code, as a means to save RAM

v5.13.1

Removed self-assignments (varname=varname) (closes #1081)

Separated inlining code (for inlining things into references, or removing IIFEs)

Allow multiple identifiers with the same name in var destructuring (eg var { a, a } = x) (#1176)

v5.13.0

All calls to eval() were removed (#1171, #1184)

source-map was updated to 0.8.0-beta.0 (#1164)

NavigatorUAData was added to domprops to avoid property mangling (#1166)

v5.12.1

Fixed an issue with function definitions inside blocks (#1155)

Fixed parens of new in some situations (closes #1159)

v5.12.0

TERSER_DEBUG_DIR environment variable

@copyright comments are now preserved with the comments="some" option (#1153)

v5.11.0

Unicode code point escapes (\u{abcde}) are not emitted inside RegExp literals anymore (#1147)

acorn is now a regular dependency

v5.10.0

Massive optimization to max_line_len (#1109)

Basic support for import assertions

Marked ES2022 Object.hasOwn as a pure function

Fix delete optional?.property

New CI/CD pipeline with github actions (#1057)

... (truncated)

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies javascript
opened by dependabot[bot] 3
chore(deps): bump parse-url from 6.0.0 to 6.0.2 in /docs
Bumps parse-url from 6.0.0 to 6.0.2.

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies javascript
opened by dependabot[bot] 3
chore(deps): bump moment from 2.29.1 to 2.29.2 in /docs
Bumps moment from 2.29.1 to 2.29.2.

Changelog

Sourced from moment's changelog.

2.29.2 See full changelog

Release Apr 3 2022

Address https://github.com/advisories/GHSA-8hfj-j24r-96c4

Commits

75e2ac5 Build 2.29.2

5a29877 Bump version to 2.29.2

4fd847b Update changelog for 2.29.2

4211bfc [bugfix] Avoid loading path-looking locales from fs

f2a813a [misc] Fix indentation (according to prettier)

7a10de8 [test] Avoid hours around DST

e968092 [locale] ar-ly: fix locale name (#5828)

53d7ee6 [misc] fix builds (#5836)

52019f1 [misc] Specify length of toArray return type (#5766)

0dcaaa6 [locale] tr: update translation of Monday and Saturday (#5756)

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 3
chore(deps): bump url-parse from 1.5.3 to 1.5.7 in /docs
Bumps url-parse from 1.5.3 to 1.5.7.

Commits

8b3f5f2 1.5.7

ef45a13 [fix] Readd the empty userinfo to url.href (#226)

88df234 [doc] Add soft deprecation notice

78e9f2f [security] Fix nits

e6fa434 [security] Add credits for incorrect handling of userinfo vulnerability

4c9fa23 1.5.6

7b0b8a6 Merge pull request #223 from unshiftio/fix/at-sign-handling-in-userinfo

e4a5807 1.5.5

193b44b [minor] Simplify whitespace regex

319851b [fix] Remove CR, HT, and LF

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 3
chore(deps): bump parse-url from 6.0.0 to 6.0.5 in /docs
Bumps parse-url from 6.0.0 to 6.0.5.

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies javascript
opened by dependabot[bot] 2
chore(deps): bump jpeg-js from 0.4.3 to 0.4.4 in /docs
Bumps jpeg-js from 0.4.3 to 0.4.4.

Release notes

Sourced from jpeg-js's releases.

v0.4.4

v0.4.4 (2022-06-07)

feat: add comment tag encoding (#87) (13e1ffa), closes #87

fix: validate sampling factors (#106) (9ccd35f), closes #106

fix(decoder): rethrow a more helpful error if Buffer is undefined (#93) (b58cc11), closes #93

chore(ci): migrate to github actions (#86) (417e8e2), closes #86

chore(deps): bump y18n from 4.0.0 to 4.0.3 (#98) (2c90858), closes #98

chore(deps): bump ws from 7.2.3 to 7.4.6 (#91) (fd73289), closes #91

chore(deps): bump hosted-git-info from 2.8.8 to 2.8.9 (#90) (9449a8b), closes #90

chore(deps): bump lodash from 4.17.15 to 4.17.21 (#89) (ffdc4a4), closes #89

Commits

9ccd35f fix: validate sampling factors (#106)

b58cc11 fix(decoder): rethrow a more helpful error if Buffer is undefined (#93)

2c90858 chore(deps): bump y18n from 4.0.0 to 4.0.3 (#98)

fd73289 chore(deps): bump ws from 7.2.3 to 7.4.6 (#91)

9449a8b chore(deps): bump hosted-git-info from 2.8.8 to 2.8.9 (#90)

ffdc4a4 chore(deps): bump lodash from 4.17.15 to 4.17.21 (#89)

13e1ffa feat: add comment tag encoding (#87)

417e8e2 chore(ci): migrate to github actions (#86)

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies javascript
opened by dependabot[bot] 2
chore(deps): bump devcert from 1.2.0 to 1.2.1 in /docs
Bumps devcert from 1.2.0 to 1.2.1.

Commits

1ed164f 1.2.1

b076321 switch from vulnerable VALID_DOMAIN regex to is-valid-domain lib (#79)

See full diff in compare view

Maintainer changes

This version was pushed to npm by jzetlen, a new releaser for devcert since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 2
chore(deps): bump url-parse from 1.5.3 to 1.5.10 in /docs
Bumps url-parse from 1.5.3 to 1.5.10.

Commits

8cd4c6c 1.5.10

ce7a01f [fix] Improve handling of empty port

0071490 [doc] Update JSDoc comment

a7044e3 [minor] Use more descriptive variable name

d547792 [security] Add credits for CVE-2022-0691

ad23357 1.5.9

0e3fb54 [fix] Strip all control characters from the beginning of the URL

61864a8 [security] Add credits for CVE-2022-0686

bb0104d 1.5.8

d5c6479 [fix] Handle the case where the port is specified but empty

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 2
chore(deps): bump prismjs from 1.24.1 to 1.27.0 in /docs
Bumps prismjs from 1.24.1 to 1.27.0.

Release notes

Sourced from prismjs's releases.

v1.27.0

Release 1.27.0

v1.26.0

Release 1.26.0

v1.25.0

Release 1.25.0

Changelog

Sourced from prismjs's changelog.

1.27.0 (2022-02-17)

New components

UO Razor Script (#3309) 3f8cc5a0

Updated components

AutoIt

Allow hyphen in directive (#3308) bcb2e2c8

EditorConfig

Change alias of section from keyword to selector (#3305) e46501b9

Ini

Swap out header for section (#3304) deb3a97f

MongoDB

Added v5 support (#3297) 8458c41f

PureBasic

Added missing keyword and fixed constants ending with $ (#3320) d6c53726

Scala

Added support for interpolated strings (#3293) 441a1422

Systemd configuration file

Swap out operator for punctuation (#3306) 2eb89e15

Updated plugins

Command Line

Escape markup in command line output (#3341) e002e78c

Add support for line continuation and improved colors (#3326) 1784b175

Added span around command and output (#3312) 82d0ca15

Other

Core

Added better error message for missing grammars (#3311) 2cc4660b

1.26.0 (2022-01-06)

New components

Atmel AVR Assembly (#2078) b5a70e4c

Go module (#3209) 8476a9ab

Keepalived Configure (#2417) d908e457

Tremor & Trickle & Troy (#3087) ec25ba65

Web IDL (#3107) ef53f021

Updated components

Use \d for [0-9] (#3097) 9fe2f93e

6502 Assembly

Use standard tokens and minor improvements (#3184) 929c33e0

... (truncated)

Commits

703881e 1.27.0

7ac1373 Updated changelog for v1.27.0 (#3342)

e002e78 Command Line: Escape markup in command line output (#3341)

13b56a9 Bump follow-redirects from 1.14.7 to 1.14.8 (#3338)

f094c4a Bump yargs-parser from 5.0.0 to 5.0.1 (#3334)

9fd4c74 Bump ajv from 6.10.0 to 6.12.6 (#3333)

3fcca6b Bump pathval from 1.1.0 to 1.1.1 (#3331)

1784b17 Command Line: Add support for line continuation and improved colors (#3326)

f545843 ESLint: Allow Map and Set in ES5 code (#3328)

d6c5372 PureBasic: Added missing keyword and fixed constants ending with $ (#3320)

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 2
chore(deps): bump terser from 5.7.1 to 5.16.1 in /docs
Bumps terser from 5.7.1 to 5.16.1.

Changelog

Sourced from terser's changelog.

v5.16.1

Properly handle references in destructurings (const { [reference]: val } = ...)

Allow parsing of .#privatefield in nested classes

Do not evaluate operations that return large strings if that would make the output code larger

Make collapse_vars handle block scope correctly

Internal improvements: Typos (#1311), more tests, small-scale refactoring

v5.16.0

Disallow private fields in object bodies (#1011)

Parse #privatefield in object (#1279)

Compress #privatefield in object

v5.15.1

Fixed missing parentheses around optional chains

Avoid bare let or const as the bodies of if statements (#1253)

Small internal fixes (#1271)

Avoid inlining a class twice and creating two equivalent but !== classes.

v5.15.0

Basic support for ES2022 class static initializer blocks.

Add AudioWorkletNode constructor options to domprops list (#1230)

Make identity function inliner not inline id(...expandedArgs)

v5.14.2

Security fix for RegExps that should not be evaluated (regexp DDOS)

Source maps improvements (#1211)

Performance improvements in long property access evaluation (#1213)

v5.14.1

keep_numbers option added to TypeScript defs (#1208)

Fixed parsing of nested template strings (#1204)

v5.14.0

Switched to @jridgewell/source-map for sourcemap generation (#1190, #1181)

Fixed source maps with non-terminated segments (#1106)

Enabled typescript types to be imported from the package (#1194)

Extra DOM props have been added (#1191)

Delete the AST while generating code, as a means to save RAM

v5.13.1

Removed self-assignments (varname=varname) (closes #1081)

Separated inlining code (for inlining things into references, or removing IIFEs)

Allow multiple identifiers with the same name in var destructuring (eg var { a, a } = x) (#1176)

v5.13.0

... (truncated)

Commits

b90215a 5.16.1

319fe31 update changelog

d941a11 mark computed properties in for..of initializers as used. Closes #1238

635400e move AST_Scope#drop_unused into its own file

a192fac some cleanups

dcc3030 add shadowed variable test

4d37f39 traverse exported code while hoisting object properties. Closes #1307

1e99e5d update test

68461d4 properly detect nested classes. Closes #1313

b91e0ce docs: fix simple typo, concatentation -> concatenation (#1311)

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies javascript
opened by dependabot[bot] 1
chore(deps): bump express from 4.17.1 to 4.18.2 in /docs
Bumps express from 4.17.1 to 4.18.2.

Release notes

Sourced from express's releases.

4.18.2

Fix regression routing a large stack in a single route

deps: [email protected]

deps: [email protected]

perf: remove unnecessary object clone

deps: [email protected]

4.18.1

Fix hanging on large stack of sync routes

4.18.0

Add "root" option to res.download

Allow options without filename in res.download

Deprecate string and non-integer arguments to res.status

Fix behavior of null/undefined as maxAge in res.cookie

Fix handling very large stacks of sync middleware

Ignore Object.prototype values in settings through app.set/app.get

Invoke default with same arguments as types in res.format

Support proper 205 responses using res.send

Use http-errors for res.format error

deps: [email protected]

Fix error message for json parse whitespace in strict

Fix internal error when inflated body exceeds limit

Prevent loss of async hooks context

Prevent hanging when request already read

deps: [email protected]

deps: [email protected]

deps: [email protected]

deps: [email protected]

deps: [email protected]

deps: [email protected]

Add priority option

Fix expires option to reject invalid dates

deps: [email protected]

Replace internal eval usage with Function constructor

Use instance methods on process to check for listeners

deps: [email protected]

Remove set content headers that break response

deps: [email protected]

deps: [email protected]

deps: [email protected]

Prevent loss of async hooks context

deps: [email protected]

deps: [email protected]

Fix emitted 416 error missing headers property

Limit the headers removed for 304 response

deps: [email protected]

deps: [email protected]

deps: [email protected]

deps: [email protected]

... (truncated)

Changelog

Sourced from express's changelog.

4.18.2 / 2022-10-08

Fix regression routing a large stack in a single route

deps: [email protected]

deps: [email protected]

perf: remove unnecessary object clone

deps: [email protected]

4.18.1 / 2022-04-29

Fix hanging on large stack of sync routes

4.18.0 / 2022-04-25

Add "root" option to res.download

Allow options without filename in res.download

Deprecate string and non-integer arguments to res.status

Fix behavior of null/undefined as maxAge in res.cookie

Fix handling very large stacks of sync middleware

Ignore Object.prototype values in settings through app.set/app.get

Invoke default with same arguments as types in res.format

Support proper 205 responses using res.send

Use http-errors for res.format error

deps: [email protected]

Fix error message for json parse whitespace in strict

Fix internal error when inflated body exceeds limit

Prevent loss of async hooks context

Prevent hanging when request already read

deps: [email protected]

deps: [email protected]

deps: [email protected]

deps: [email protected]

deps: [email protected]

deps: [email protected]

Add priority option

Fix expires option to reject invalid dates

deps: [email protected]

Replace internal eval usage with Function constructor

Use instance methods on process to check for listeners

deps: [email protected]

Remove set content headers that break response

deps: [email protected]

deps: [email protected]

deps: [email protected]

Prevent loss of async hooks context

deps: [email protected]

deps: [email protected]

... (truncated)

Commits

8368dc1 4.18.2

61f4049 docs: replace Freenode with Libera Chat

bb7907b build: [email protected]

f56ce73 build: [email protected]

24b3dc5 deps: [email protected]

689d175 deps: [email protected]

340be0f build: [email protected]

33e8dc3 docs: use Node.js name style

644f646 build: [email protected]

ecd7572 build: [email protected]

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies javascript
opened by dependabot[bot] 2
chore(deps): bump decode-uri-component from 0.2.0 to 0.2.2 in /docs
Bumps decode-uri-component from 0.2.0 to 0.2.2.

Release notes

Sourced from decode-uri-component's releases.

v0.2.2

Prevent overwriting previously decoded tokens 980e0bf

https://github.com/SamVerschueren/decode-uri-component/compare/v0.2.1...v0.2.2

v0.2.1

Switch to GitHub workflows 76abc93

Fix issue where decode throws - fixes #6 746ca5d

Update license (#1) 486d7e2

Tidelift tasks a650457

Meta tweaks 66e1c28

https://github.com/SamVerschueren/decode-uri-component/compare/v0.2.0...v0.2.1

Commits

a0eea46 0.2.2

980e0bf Prevent overwriting previously decoded tokens

3c8a373 0.2.1

76abc93 Switch to GitHub workflows

746ca5d Fix issue where decode throws - fixes #6

486d7e2 Update license (#1)

a650457 Tidelift tasks

66e1c28 Meta tweaks

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies javascript
opened by dependabot[bot] 1
chore(deps): bump loader-utils from 1.4.0 to 1.4.2 in /docs
Bumps loader-utils from 1.4.0 to 1.4.2.

Release notes

Sourced from loader-utils's releases.

v1.4.2

1.4.2 (2022-11-11)

Bug Fixes

ReDoS problem (#226) (17cbf8f)

v1.4.1

1.4.1 (2022-11-07)

Bug Fixes

security problem (#220) (4504e34)

Changelog

Sourced from loader-utils's changelog.

1.4.2 (2022-11-11)

Bug Fixes

ReDoS problem (#226) (17cbf8f)

1.4.1 (2022-11-07)

Bug Fixes

security problem (#220) (4504e34)

Commits

331ad50 chore(release): 1.4.2

17cbf8f fix: ReDoS problem (#226)

8f082b3 chore(release): 1.4.1

4504e34 fix: security problem (#220)

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies javascript
opened by dependabot[bot] 2
chore(deps): bump axios from 0.21.1 to 0.21.4 in /docs
Bumps axios from 0.21.1 to 0.21.4.

Release notes

Sourced from axios's releases.

v0.21.4

0.21.4 (September 6, 2021)

Fixes and Functionality:

Fixing JSON transform when data is stringified. Providing backward compatibility and complying to the JSON RFC standard (#4020)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

Guillaume Fortaine

Yusuke Kawasaki

Dmitriy Mozgovoy

v0.21.3

0.21.3 (September 4, 2021)

Fixes and Functionality:

Fixing response interceptor not being called when request interceptor is attached (#4013)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

Julian Hollmann

v0.21.2

0.21.2 (September 4, 2021)

Fixes and Functionality:

Updating axios requests to be delayed by pre-emptive promise creation (#2702)

Adding "synchronous" and "runWhen" options to interceptors api (#2702)

Updating of transformResponse (#3377)

Adding ability to omit User-Agent header (#3703)

Adding multiple JSON improvements (#3688, #3763)

Fixing quadratic runtime and extra memory usage when setting a maxContentLength (#3738)

Adding parseInt to config.timeout (#3781)

Adding custom return type support to interceptor (#3783)

Adding security fix for ReDoS vulnerability (#3980)

Internal and Tests:

Updating build dev dependancies (#3401)

Fixing builds running on Travis CI (#3538)

Updating follow rediect version (#3694, #3771)

Updating karma sauce launcher to fix failing sauce tests (#3712, #3717)

Updating content-type header for application/json to not contain charset field, according do RFC 8259 (#2154)

Fixing tests by bumping karma-sauce-launcher version (#3813)

Changing testing process from Travis CI to GitHub Actions (#3938)

Documentation:

Updating documentation around the use of AUTH_TOKEN with multiple domain endpoints (#3539)

... (truncated)

Changelog

Sourced from axios's changelog.

0.21.4 (September 6, 2021)

Fixes and Functionality:

Fixing JSON transform when data is stringified. Providing backward compatibility and complying to the JSON RFC standard (#4020)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

Jay

Guillaume Fortaine

Yusuke Kawasaki

Dmitriy Mozgovoy

0.21.3 (September 4, 2021)

Fixes and Functionality:

Fixing response interceptor not being called when request interceptor is attached (#4013)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

Jay

Julian Hollmann

0.21.2 (September 4, 2021)

Fixes and Functionality:

Updating axios requests to be delayed by pre-emptive promise creation (#2702)

Adding "synchronous" and "runWhen" options to interceptors api (#2702)

Updating of transformResponse (#3377)

Adding ability to omit User-Agent header (#3703)

Adding multiple JSON improvements (#3688, #3763)

Fixing quadratic runtime and extra memory usage when setting a maxContentLength (#3738)

Adding parseInt to config.timeout (#3781)

Adding custom return type support to interceptor (#3783)

Adding security fix for ReDoS vulnerability (#3980)

Internal and Tests:

Updating build dev dependencies (#3401)

Fixing builds running on Travis CI (#3538)

Updating follow redirect version (#3694, #3771)

Updating karma sauce launcher to fix failing sauce tests (#3712, #3717)

Updating content-type header for application/json to not contain charset field, according do RFC 8259 (#2154)

Fixing tests by bumping karma-sauce-launcher version (#3813)

Changing testing process from Travis CI to GitHub Actions (#3938)

Documentation:

Updating documentation around the use of AUTH_TOKEN with multiple domain endpoints (#3539)

Remove duplication of item in changelog (#3523)

... (truncated)

Commits

66c4602 Merge branch 'master' into release/0.21.4

fc15665 [Releasing] v0.21.4

c2714f0 [Updating] incorrect JSON syntax in README.md

0fc7248 fix json transform when data is pre-stringified (#4020)

90205f8 Change headers type to string record (#3021)

92b29d2 Make the default type of response data never (#3002)

4eeb3b1 Improved type-safety for AxiosRequestConfig (#2995)

cd7ff04 Adding HTTP status code to error.toJSON (#2956)

b5a1a67 Adding nodejs http.request option: insecureHTTPParser (#2930)

4f25380 Exposing the Axios constructor in index.d.ts (#2872)

Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by jasonsaayman, a new releaser for axios since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 1
Language support: nix
tree-sitter grammar is here.

I'm a nix user and I really like the look of shisho :heart:

Last I checked the grammar wasn't super fully featured for syntax highlighting but I believe most language features are covered, and there have been some updates since.

I'm packaging shisho for nixpkgs here: https://github.com/NixOS/nixpkgs/pull/165485

It will be built and cached for the following platforms:

aarch64-linux

i686-linux

x86_64-linux

x86_64-darwin

aarch64-darwin

type: feature related: language support
opened by 06kellyjac 2

Releases(v0.5.2)

v0.5.2(Oct 13, 2021)

Source code(tar.gz)
Source code(zip)
build-x86_64-apple-darwin.zip(1.69 MB)
build-x86_64-pc-windows-gnu.zip(3.82 MB)
build-x86_64-unknown-linux-gnu.zip(2.49 MB)
v0.5.1(Oct 13, 2021)
New Features

N/A

Improvements & Bug Fixes

You can now define constraints shared among multiple patterns (https://github.com/flatt-security/shisho/pull/103)

Full Changelog: https://github.com/flatt-security/shisho/compare/v0.5.0...v0.5.1
Source code(tar.gz)
Source code(zip)
build-x86_64-apple-darwin.zip(1.69 MB)
build-x86_64-pc-windows-gnu.zip(3.81 MB)
build-x86_64-unknown-linux-gnu.zip(2.48 MB)
v0.5.0(Oct 12, 2021)
New Features

Allow nested constraints & capturing inside constraints (https://github.com/flatt-security/shisho/pull/100)

Add some new predicates (https://github.com/flatt-security/shisho/pull/101)

Improvements & Bug Fixes

N/A

Full Changelog: https://github.com/flatt-security/shisho/compare/v0.4.0...v0.5.0
Source code(tar.gz)
Source code(zip)
build-x86_64-apple-darwin.zip(1.69 MB)
build-x86_64-pc-windows-gnu.zip(3.81 MB)
build-x86_64-unknown-linux-gnu.zip(2.48 MB)
v0.4.0(Oct 8, 2021)
New Features

Add --exclude flag (https://github.com/flatt-security/shisho/pull/97)

Improvements & Bug Fixes

Fix the behavior of ellipsis meta operators (https://github.com/flatt-security/shisho/commit/700eddfa6331b7251c0777ff91a14abf9822ed58)

Full Changelog: https://github.com/flatt-security/shisho/compare/v0.3.5...v0.4.0
Source code(tar.gz)
Source code(zip)
build-x86_64-apple-darwin.zip(1.66 MB)
build-x86_64-pc-windows-gnu.zip(3.78 MB)
build-x86_64-unknown-linux-gnu.zip(2.45 MB)
v0.3.5(Oct 4, 2021)

Source code(tar.gz)
Source code(zip)
build-x86_64-apple-darwin.zip(1.64 MB)
build-x86_64-pc-windows-gnu.zip(3.74 MB)
build-x86_64-unknown-linux-gnu.zip(2.43 MB)
v0.3.4(Oct 1, 2021)
New features

Add a new syntax for patterns: block of rules (https://github.com/flatt-security/shisho/pull/92)

Improvements & Bug Fixes

Minor bug fixes (https://github.com/flatt-security/shisho/pull/93, https://github.com/flatt-security/shisho/pull/95)

Source code(tar.gz)
Source code(zip)
build-x86_64-apple-darwin.zip(1.64 MB)
build-x86_64-pc-windows-gnu.zip(3.74 MB)
build-x86_64-unknown-linux-gnu.zip(2.42 MB)
v0.3.3(Sep 29, 2021)
New features

404

Improvements & Bug Fixes

Fix a bug of handling trailing ellipsis operator (https://github.com/flatt-security/shisho/pull/91)

Ignore non-YAMLs on rule loading (https://github.com/flatt-security/shisho/pull/89)

Add slight changes on rule format (https://github.com/flatt-security/shisho/pull/88)

Improve engine performance (https://github.com/flatt-security/shisho/pull/87 https://github.com/flatt-security/shisho/pull/84 https://github.com/flatt-security/shisho/pull/83)

Replace tree-sitter-hcl engine (https://github.com/flatt-security/shisho/pull/90)

Source code(tar.gz)
Source code(zip)
build-x86_64-apple-darwin.zip(1.63 MB)
build-x86_64-pc-windows-gnu.zip(3.74 MB)
build-x86_64-unknown-linux-gnu.zip(2.41 MB)
v0.3.2(Sep 24, 2021)
New features

404

Improvements & Bug Fixes

Fix the behaviour of JSONReporter (https://github.com/flatt-security/shisho/commit/180a51694147d275348e26271cb5e47881f3f85a)

Source code(tar.gz)
Source code(zip)
build-x86_64-apple-darwin.zip(1.62 MB)
build-x86_64-pc-windows-gnu.zip(3.73 MB)
build-x86_64-unknown-linux-gnu.zip(2.41 MB)
v0.3.1(Sep 23, 2021)
New features

404

Improvements & Bug Fixes

Improve the behaviour of ruleset-path CLI option to enable users to use multiple rulesets once by specifying a path to a directory with ruleset YAMLs (https://github.com/flatt-security/shisho/pull/78)

Add --exit-zero flag to control exit code of Shisho (https://github.com/flatt-security/shisho/pull/79)

Source code(tar.gz)
Source code(zip)
build-x86_64-apple-darwin.zip(1.61 MB)
build-x86_64-pc-windows-gnu.zip(3.73 MB)
build-x86_64-unknown-linux-gnu.zip(2.41 MB)
v0.3.0(Sep 22, 2021)
New features

Support many-to-many relations between patterns and rewrite patterns in a rule (https://github.com/flatt-security/shisho/pull/75)

Add --encoding option (https://github.com/flatt-security/shisho/pull/72)

Add --format option (https://github.com/flatt-security/shisho/pull/69) with SARIF support (https://github.com/flatt-security/shisho/pull/74) and JSON support (https://github.com/flatt-security/shisho/pull/71)

Improve output formats of shisho check and shisho find (https://github.com/flatt-security/shisho/pull/76)

Improvements & Bug Fixes

Refactor the codebase (https://github.com/flatt-security/shisho/pull/70)

Source code(tar.gz)
Source code(zip)
build-x86_64-apple-darwin.zip(1.61 MB)
build-x86_64-pc-windows-gnu.zip(3.73 MB)
build-x86_64-unknown-linux-gnu.zip(2.41 MB)
v0.2.2(Sep 2, 2021)

Source code(tar.gz)
Source code(zip)
build-x86_64-apple-darwin.zip(1.19 MB)
build-x86_64-pc-windows-gnu.zip(3.02 MB)
build-x86_64-unknown-linux-gnu.zip(1.92 MB)
v0.2.1(Aug 26, 2021)
New Features

404

Improvements & Bug Fixes

Improve handling of string in Dockerfile matching (https://github.com/flatt-security/shisho/pull/52)

Source code(tar.gz)
Source code(zip)
build-x86_64-apple-darwin.zip(1.19 MB)
build-x86_64-pc-windows-gnu.zip(3.02 MB)
build-x86_64-unknown-linux-gnu.zip(1.92 MB)
v0.2.0(Aug 26, 2021)
New features

Add Dockerfile support (https://github.com/flatt-security/shisho/pull/50)

Add pattern matchings inside string literals (https://github.com/flatt-security/shisho/pull/51)

Improvements & Bug Fixes

Refine pattern matching algorithm (https://github.com/flatt-security/shisho/pull/49), fixing the following issues:

Bad behaviour of ellipsis metavariable operator (https://github.com/flatt-security/shisho/issues/46)

Bad behaviour of matching if blocks in Go (https://github.com/flatt-security/shisho/issues/36)

Source code(tar.gz)
Source code(zip)
build-x86_64-apple-darwin.zip(1.19 MB)
build-x86_64-pc-windows-gnu.zip(3.02 MB)
build-x86_64-unknown-linux-gnu.zip(1.92 MB)
v0.1.2-alpha.2(Aug 18, 2021)

Source code(tar.gz)
Source code(zip)
build-x86_64-apple-darwin.zip(1.19 MB)
build-x86_64-pc-windows-gnu.zip(2.99 MB)
build-x86_64-unknown-linux-gnu.zip(1.92 MB)
v0.1.2-alpha.1(Aug 18, 2021)

Source code(tar.gz)
Source code(zip)
build-x86_64-apple-darwin.zip(1.19 MB)
build-x86_64-pc-windows-gnu.zip(2.99 MB)
build-x86_64-unknown-linux-gnu.zip(1.92 MB)
v0.1.1(Aug 18, 2021)

Source code(tar.gz)
Source code(zip)
build-x86_64-apple-darwin.zip(1.17 MB)
build-x86_64-pc-windows-gnu.zip(2.95 MB)
build-x86_64-unknown-linux-gnu.zip(1.89 MB)