baco-scanner/Cargo.toml at master · CodeAtCode/baco-scanner · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
[package]
name = "baco"
version = "1.1.0"
edition = "2024"
homepage = "https://github.com/CodeAtCode/baco-scanner"
documentation = "https://github.com/CodeAtCode/baco-scanner/tree/master/docs"
description = "LLM-augmented SAST scanner: 23-phase pipeline combining semgrep, CWE-aware MoE routing, and research-backed LLM verification"
authors = ["MTE90"]
repository = "https://github.com/CodeAtCode/baco-scanner"
license = "GPL-3.0"
keywords = ["security", "vulnerability", "scanner", "sast", "llm"]
categories = ["command-line-utilities", "development-tools"]
rust-version = "1.85"


exclude = [
  "baco-output/**",
  "core*",
  "*.profraw",
  "lcov.info",
  ".cortexkit/**",
]

[dependencies]
# Async trait support
async-trait = "0.1"

# CLI
clap = { version = "4", features = ["derive"] }

# Colored output
colored = "3.1"

# Progress
indicatif = "0.17"

# Async runtime
tokio = { version = "1", features = ["full"] }
futures = "0.3"

# Serialization
serde = { version = "1", features = ["derive"] }
serde_json = "1"
serde_yaml = "0.9"
toml = "0.8"

# Logging
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }

# HTML escaping
html-escape = "0.2"
pulldown-cmark = "0.9"

# Template engine
minijinja = { version = "2", default-features = false, features = ["builtins", "serde"] }

# HTTP clients
reqwest = { version = "0.12", features = ["json"] }
urlencoding = "2"

# File system
walkdir = "2"

# Glob pattern matching
globset = "0.4"

# Git
git2 = "0.19"

# Time
chrono = { version = "0.4", features = ["serde"] }

# Hashing
sha2 = "0.10"
hex = "0.4"
which = "6"
dirs = "5"

thiserror = "1.0"
tempfile = "3"
regex = "1"
libc = "0.2"

# Tree-sitter for AST parsing
tree-sitter = "0.26"
tree-sitter-c = "0.23"
tree-sitter-rust = "0.23"
tree-sitter-python = "0.23"
tree-sitter-javascript = "0.23"
tree-sitter-php = "0.23"
tree-sitter-go = "0.23"
tree-sitter-java = "0.23"
tree-sitter-ruby = "0.23"
tree-sitter-c-sharp = "0.23"

# Static analysis support

[dev-dependencies]
mockall = "0.13"
serial_test = "3"
futures = "0.3"
mockito = "1.2"
visibility = "0.1"
tempfile = "3"

[[test]]
name = "unit_tests"
path = "tests/unit/mod.rs"

[[test]]
name = "semgrep_ruleset_cpe_tests"
path = "tests/unit/semgrep_ruleset_cpe_tests.rs"

[[test]]
name = "integration_tests"
path = "tests/integration/mod.rs"

[profile.release]
opt-level = 3
lto = true
codegen-units = 1
strip = true
panic = "abort"

# Keeps filename and line in panic backtraces while dropping the bulk of the debug
# info. The test binary was 242M with full debug info, which matters because a
# mutation-testing run copies the target directory once per parallel job and this
# repository's target is 9.7G against a 7.7G tmpfs /tmp.
[profile.test]
debug = "line-tables-only"