Fix the cross-frontend defects the JS rebuild exposed, and two gaps the CVE campaign found - #46

Merged

SYM01 merged 17 commits into

mainfrom

claude/rolldown-vs-esbuild-qcao2g

Aug 22, 2026

Commits on Aug 14, 2026

ruby: model hash arguments; guard every collecting frontend for fallbacks
claude
committed
b098d47
python, ruby: collect defs the lowering already walks into
claude
committed
de003ba
rust: mark unmodelled rvalues, and keep rustc's own spans out of findings
claude
committed
c057b10
positions: one-base Ruby columns, and pin every language's positions
claude
committed
608ea30
rust: a format template the decoder cannot finish keeps what it read
claude
committed
62f9ec0
Merge origin/main into claude/rolldown-vs-esbuild-qcao2g
claude
committed
b46784a
corpus: add the Java position golden
claude
committed
301e0fd

Commits on Aug 15, 2026

js: parse TypeScript parameter decorators, as a rung rather than a default
claude
committed
c570aaa

Commits on Aug 17, 2026

Commits on Aug 18, 2026

rust: resolve crate-relative MIR spans, so a finding names a real file
claude
committed
b9e06f1

Commits on Aug 20, 2026

analysis: make a scan's findings deterministic
claude
committed
07e0ceb

Commits on Aug 21, 2026

js: source a React component's props and context
claude
committed
aacf0dd
ruby: carry taint through keyword arguments
claude
committed
f1ea2c6

Commits on Aug 22, 2026

cleanup: dedupe the kwarg marker, derive the component predicate
claude
committed
4cecfe5