Release contract-guard 3.0.0 - #11
Merged
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
This PR prepares the ContractGuard Python core + VS Code extension for the 3.0.0 release, adding several end-user workflow improvements (exporting findings, incremental rescans, rule disabling) alongside analyzer/output normalization updates.
Changes:
- VS Code extension: add scan timeout handling, output channel logging, JSON export, quick-fix + commands for disabling rules/copying findings, incremental “merge current file” publishing, and minimum severity filtering.
- Core engine/analyzers: normalize finding text to ASCII-safe output and expand dependency scanning (incl. nested dependency files and npm shrinkwrap/legacy lock formats).
- Version bump to 3.0.0 across Python package + VS Code extension packaging metadata.
Reviewed changes
Copilot reviewed 16 out of 17 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
vscode-src/pythonBridge.ts |
Adds configurable scan timeout + process termination for long-running analyzer runs. |
vscode-src/extension.ts |
Adds new commands, output channel logging, severity filtering, and incremental file-scan merge behavior. |
tests/test_secrets_analyzer.py |
Adds assertion ensuring attack vectors don’t include the → symbol. |
tests/test_scan.py |
Updates analyzer list test expectations (security analyzers). |
tests/test_pii_analyzer.py |
Adjusts PII test to avoid treating regular log timestamps as DOBs. |
tests/test_engine.py |
Adds coverage for ASCII-safe normalization (normalize_output_text). |
tests/test_dependency_analyzer.py |
Expands dependency analyzer coverage (nested scans, node_modules skip, legacy lock). |
src/contractguard/engine.py |
Introduces output normalization and applies it to finding fields. |
src/contractguard/analyzers/secrets_analyzer.py |
Replaces unicode arrows in attack vector with ASCII arrows. |
src/contractguard/analyzers/pii_analyzer.py |
Updates module docstring to reflect supported content types. |
src/contractguard/analyzers/file_filters.py |
Removes .csv from data-extension set. |
src/contractguard/analyzers/dependency_analyzer.py |
Adds broader dependency file discovery + parsing improvements for npm lock formats. |
src/contractguard/__init__.py |
Bumps core package version to 3.0.0. |
README.md |
Documents new extension capabilities and new configuration options. |
pyproject.toml |
Bumps Python project version to 3.0.0. |
package.json |
Bumps extension version to 3.0.0; adds commands/config schema updates and packaging updates. |
package-lock.json |
Updates lockfile metadata version to 3.0.0. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
288
to
292
| if path.is_dir(): | ||
| has_npm_lock = (path / "package-lock.json").exists() | ||
| for name in sorted(dep_names): | ||
| if name == "package.json" and has_npm_lock: | ||
| seen: set[str] = set() | ||
| for candidate in sorted(path.rglob("*")): | ||
| if not candidate.is_file(): | ||
| continue |
Comment on lines
+119
to
+120
| reject(new Error(`ContractGuard scan exceeded ${getScanTimeoutMs()}ms and was stopped.`)); | ||
| }, getScanTimeoutMs()); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.