v1.3.6 - 2026-02-16

🎉 Major Features

Full Go Language Support

<img src="https://cdn.jsdelivr.net/gh/devicons/devicon@latest/icons/go/go-original-wordmark.svg" height=50 width=50 />

Complete implementation of Go static analysis capabilities

• Core Parsing (#520-525): File detection, AST parsing, function/method declarations, type definitions, variables, constants, calls, closures, and control flow statements
• Advanced Analysis (#526-530): Module registry, import resolution, call graph construction, scan/CI pipeline integration, security rules, and MCP server support
• Type Tracking (#536-540): Phase 2 type tracking with return type extraction, variable assignment tracking, and method call resolution via variable types
• Performance (#541-542): Parallel call graph building with progress tracking and background indexing to prevent MCP client timeouts

Docker Analysis Support

<img src="https://cdn.jsdelivr.net/gh/devicons/devicon@latest/icons/docker/docker-original-wordmark.svg" height=50 width=50 />

New MCP tools for Docker security analysis:

• Basic Docker MCP support (#531)
• Semantic Docker query tools (#534)
• Docker dependency graph mapping (#535)

GitHub Actions Security Scanner

<img src="https://cdn.jsdelivr.net/gh/devicons/devicon@latest/icons/githubactions/githubactions-original.svg" height=50 width=50 />

• Automated security scanning workflow with PR summary reports
• Inline code comments for security findings
• Integration with SARIF output for GitHub Advanced Security

🚀 Improvements

Python SAST Enhancements

<img src="https://cdn.jsdelivr.net/gh/devicons/devicon@latest/icons/python/python-original-wordmark.svg" height=50 width=50 />

• Populate ReturnType and MethodArgumentsType for Python functions (#513)
• Add inferred type information to module variables in find_symbol (#514)
• Expose parameter types as standalone symbols (#518)
• Populate inferred return types and detect void functions (#519)

Performance Optimizations

• Parallel call graph building with progress tracking (#541)
• Background indexing to prevent MCP client timeout (#542)

🐛 Bug Fixes

• Python SAST: Fix module variable reassignment contamination and var: placeholder leaking (#515)
• SARIF: Fix SARIF upload failing with empty artifact locations (#517)
• Rules: Make ZIP creation deterministic to prevent checksum mismatches (#532)
• CI: Add Cloudflare cache purging to rules deployment workflow (#533)

📦 Dependencies

• Upgrade Go to 1.26.0 and update dependencies (#516)

📝 Full Changelog

View all 31 pull requests

Contributors: @shivasurya

What's Changed

• feat(mcp): Add --disable-metrics flag to MCP serve command and remove nsjail by @shivasurya in https://github.com/shivasurya/code-pathfinder/pull/506
• chore(deps-dev): bump webpack from 5.100.2 to 5.105.0 in /extension/secureflow in the npm_and_yarn group across 1 directory by @dependabot[bot] in https://github.com/shivasurya/code-pathfinder/pull/507
• fix(ci): Replace deprecated GitHub Actions in release workflow by @shivasurya in https://github.com/shivasurya/code-pathfinder/pull/508
• feat(ci): Add diff-aware scanning and GitHub PR commenting by @shivasurya in https://github.com/shivasurya/code-pathfinder/pull/509
• feat(ci): Switch GitHub Action to ci command with PR commenting support by @shivasurya in https://github.com/shivasurya/code-pathfinder/pull/510

Full Changelog: https://github.com/shivasurya/code-pathfinder/compare/v1.3.4...v1.3.5

What's Changed

• fix(dsl): Make single-file rule loading consistent with directory behavior by @shivasurya in https://github.com/shivasurya/code-pathfinder/pull/501
• fix(docker): Report all container rule violations, not just first match by @shivasurya in https://github.com/shivasurya/code-pathfinder/pull/502
• chore(deps): Upgrade Go to 1.25.6 and update dependencies by @shivasurya in https://github.com/shivasurya/code-pathfinder/pull/503
• fix(python/sast): Fix FQN construction for inline instantiation patterns by @shivasurya in https://github.com/shivasurya/code-pathfinder/pull/504

Full Changelog: https://github.com/shivasurya/code-pathfinder/compare/v1.3.3...v1.3.4

What's Changed

• fix(python/sast): Support default parameter type inference by @shivasurya in https://github.com/shivasurya/code-pathfinder/pull/498
• feat(python/sast): Support inline instantiation in attribute extraction by @shivasurya in https://github.com/shivasurya/code-pathfinder/pull/499

Full Changelog: https://github.com/shivasurya/code-pathfinder/compare/v1.3.2...v1.3.3

What's Changed

• fix(python/sast): Fix static method call resolution for cross-file calls by @shivasurya in https://github.com/shivasurya/code-pathfinder/pull/494
• fix(python/sast): Enable instance variable method call resolution (P0) by @shivasurya in https://github.com/shivasurya/code-pathfinder/pull/495
• chore: release v1.3.2 by @shivasurya in https://github.com/shivasurya/code-pathfinder/pull/496

Full Changelog: https://github.com/shivasurya/code-pathfinder/compare/v1.3.1...v1.3.2