This release is about making sure yesterday's clean verdict still holds up today. Downloaded dependencies get analyzed against current rules unless a local report or matching-analyzer corpus verdict is available. Editing a local rule now invalidates the cached verdict too, even if the rules weren't installed from Git. We also spent time hardening the tools that do the reading and fetching: malformed archives, forged signatures, and package-controlled URLs should get scrutiny from the scanner, not control over it.
- Scan v2.13.0
- Requires current-rule analysis for downloaded dependencies unless a local report or matching-analyzer corpus verdict is available.
- Includes local and untracked rule changes in cache invalidation, so a rule edit can't leave an old verdict standing.
- Adds an experimental
rendercommand for saved reports, with terminal, tiny, and interpretation output. Read the same evidence another way without scanning the file again. update-rulesnow honors--model-dir. The obsolete server--extract-diroption is gone.- Bundles Cleave 3.0.0-beta.2 internally; the latest standalone Cleave release is 3.0.0-beta.1, below.
- cleave v3.0.0-beta.1
- Removes
--extract-dirto close a path traversal flaw. Thanks to ajayk for finding it. - Removes the old server mode as part of the 3.0 beta's move to a CLI-only tool. Scan continues to provide the HTTP API.
- Makes YARA findings propagate consistently through analyzers, archives, and unpacked UPX files, and hardens archive, LZX, and PyInstaller parsing against malformed or oversized inputs.
- Escapes terminal control sequences and Unicode directionality controls in output. Rule validation covers more mistakes and runs faster.
- Removes
- filefacts v2.0.1
- Verifies Chrome extension developer signatures and reports unsigned bytes trailing Authenticode signatures.
- Reads Mach-O signatures from the slots the OS actually uses, and checks PE timestamps and nested signatures more carefully, so decoys have fewer ways to look legitimate.
- Bounds parser work across executables, archives, documents, and images, and fixes quadratic slowdowns on large or hostile files.
- stng v2.1.1
- Escapes control characters in CLI output and puts time and output limits on Rizin, so a hostile string or stuck disassembler can't take over the session.
- Recovers strings appended after Java constant pools and C2 URLs embedded in suspicious paths.
- Reads unusual IPv4 spellings the way browsers do, including hexadecimal, octal, and integer addresses. Fewer places for a URL to hide its host.
- fletch v2.0.1
- Makes GitHub token use opt-in and never sends it to URLs taken from scanned files. OCI registry and CDN requests now pass through the same SSRF checks as other downloads.
- Requires exact Maven and NuGet coordinates and rejects off-registry packages, so a look-alike can't borrow another package's reputation.
- Stops serving stale cache entries for removed packages and improves dependency discovery in scripts, Dockerfiles, and VS Code shell commands.
Source builds of Scan, cleave, filefacts, and stng now require Rust 1.97 or newer. Scan's OpenBSD and NetBSD release builds are paused pending compatible Rust toolchains.
Release notes: scan v2.13.0 · cleave v3.0.0-beta.1 · stng v2.1.1 · filefacts v2.0.1 · fletch v2.0.1
Upgrade the packaged tools with Homebrew below. Cleave's 3.0 beta is currently source-only; Homebrew still ships cleave 2.12.1.
brew upgrade atomdrift-project/tap/cleave atomdrift-project/tap/scan atomdrift-project/tap/stng atomdrift-project/tap/filefacts