This release is about coverage and honesty. Fonts and media files now get dedicated structural analyzers instead of generic byte-level rules, so a payload tucked into a table gap or trailing an MP4 has fewer places to hide. Dependency resolution leans on lockfiles and registry metadata instead of reading manifests and hoping. And when analysis can't finish, the report says so instead of quietly looking clean.
- Scan v2.11.0
- Resolves Go dependencies through module and workspace context, and Cargo and Python manifests against co-located lockfiles and registry metadata, so the version analyzed is the version that would install.
- Fetches in execution order: build dependencies and proc-macros first, dev dependencies last. The code that runs at build time gets looked at first.
- Compact output keeps members whose analysis was incomplete, so a gap can't hide behind a quiet verdict.
- cleave v2.11.0
- New font analyzer (sfnt, WOFF, WOFF2, EOT) and media analyzer (WAV, AIFF, MP3, MP4, ICO, GIF, BMP, WebP) for masquerades and stowaway payloads. SVG is now its own rule type.
- A new
analysis_gapsfield reports incomplete analysis in text and JSON, independently of findings. downgrade:is scoped to the file by default, so a benign archive member can no longer silence a rule firing on a hostile one.- JAR class triage ranks classes by constant-pool salience rather than attacker-controlled archive order.
- Cache entries are keyed on the traits revision, and archive roots are no longer rebuilt from the leaf cache, so neither a stale ruleset nor a cached archive can drop findings.
- filefacts v1.7.0
- ELF anomaly metrics from the Trusting Trust paper: entry-point redirection, section overlap, and sections past EOF.
- x86-64 direct-syscall site extraction with resolved syscall numbers and constant arguments, for binaries that skip libc to dodge hooks.
- stng v1.12.0
- Parses JVM class files via the constant pool instead of mistaking them for
fat Mach-O — they share the
CAFEBABEmagic, and the mistake returned no strings at all. - Go PE string offsets map back to
.rdatafile offsets, sosection:rules match Go binaries on Windows again.
- Parses JVM class files via the constant pool instead of mistaking them for
fat Mach-O — they share the
- fletch v1.3.0
- Go
h1:module-tree hashes are now actually verified, and malformed or over-budget Go archives report as unverified rather than pinned.
- Go
Release notes: scan v2.11.0 · cleave v2.11.0 · stng v1.12.0 · filefacts v1.7.0 · fletch v1.3.0
brew upgrade atomdrift-project/tap/cleave atomdrift-project/tap/scan atomdrift-project/tap/stng