Big day for the pipeline. cleave and litmus both moved to 2.0.0-rc.3, and for the first time the changes line up on either side of the same seam — the schema that carries a sample's capabilities from cleave into the azoth model. The two ends finally speak the same language, and that is the thing we have been working toward all month.
cleave v2.0.0-rc.3 learns a new trick: Electron .asar archives are now parsed in memory, with their members routed through the same file-type detection as everything else — so a malicious Electron app no longer gets to hide its payload in plain sight. Identification got sharper for Clojure, Python wheels, and Firefox .xpi extensions, and Chrome .crx handling improved. A trait near/scope matching conflict is fixed, and trait location info now propagates through to results. Under the hood it got leaner, too: the obsolete fileid crate (~3,700 lines) is gone in favor of the built-in detector, and the legacy ast compatibility type and the ./traits directory convention were both retired. Release notes.
litmus v2.0.0-rc.3 is the headliner. litmus now computes the full set of fields the latest azoth model expects, so the scanner and the model finally agree on exactly what crosses between them — no more guessing, no more silent gaps. The ML JSON output is cleaner for it: schema v=5 collapses the old class/probability and threshold pair into a single self-consistent object. The json→model plumbing that had quietly broken — filefacts fields weren't being read — is repaired, and scan.rs shed ~350 lines for the same behavior. Operators get some love as well: the WORKERS knob is now honored across every worker script (alpine, bastille, debian, macos, omnios, openbsd), and the no-deadlock scan path logs enough to actually diagnose a hang. Release notes.
stng v1.5.1 kills a class of false positives we have wanted gone for a while: compiler-emitted u16 tables in Windows PE files — unwind info, C++ exception metadata, jump tables — no longer get mistaken for sockaddr_in structures, so the IPs it reports are real IPs. Tests run about 5× faster too, with cargo test dropping from ~95s to ~17s via opt-level = 2 on the test profile, alongside a Rust 2024 cleanup and dependency updates. Release notes.
brew upgrade atomdrift/tap/cleave atomdrift/tap/litmus atomdrift/tap/stng