v3.2.0 - Parallel Analysis & Sandbox Hardening

[xkilldash9x]

What's New

Performance

• Parallel file processing - Analysis now utilizes all available CPU cores via errgroup, significantly improving throughput on multi-file scans
• Optimized I/O - 32KB buffered copies for database operations, reducing syscall overhead

Security Hardening

• Symlink attack prevention - All sandbox mount paths now resolve through filepath.EvalSymlinks() to prevent escape attacks
• Root mount protection - Explicit checks prevent accidentally mounting / into the sandbox
• Secure temp directories - Uses os.MkdirTemp() to avoid collisions and symlink attacks in shared environments
• Symlink filtering - Database copy operations skip symlinks to prevent destination escape

Robustness

• Panic recovery - SSA generation and analysis goroutines now recover from panics, preventing single-file failures from crashing entire runs
• PebbleDB sandbox compatibility - New PrepareSandboxDB() helper automatically copies databases to writable temp storage when running inside gVisor
• Module-aware dependency filtering - Internal packages are no longer incorrectly flagged as external dependencies

Workflow & Action Improvements

• Restored *_generated.go exclusion filter for diff/audit modes
• Added stderr capture (2>&1) for better error diagnostics
• New/Deleted file status now properly reported in analysis summaries
• Added runsc --version verification after gVisor installation

Bug Fixes

• Fixed ssautil.AllPackages return type handling (returns (*Program, []*Package), not error)
• Fixed collectDependencies signature to support root module filtering

---

Full Changelog: v3.1.6...v3.2.0

---

This discussion was created from the release v3.2.0 - Parallel Analysis & Sandbox Hardening.