InfoQ Homepage Static Analysis Content on InfoQ
-
Google Adopts Pyrefly for Faster, More Accurate Python Type Checking
Google has replaced its long-standing Python type checker, Pytype, with Pyrefly, an open-source tool originally developed by Meta. The decision was driven by Pyrefly's advantages, including faster and more accurate type checking, and lower infrastructure costs.
-
Reverse Engineer Anything Project Brings AI Agents to Binary Analysis
Reverse Engineer Anything (REA) is an open-source project with over 200K GitHub stars that connects coding agents such as Claude Code and Codex to reverse-engineering tools like Ghidra, Hopper, and IDA. The project lets developers inspect compiled binaries, trace function calls, and investigate how applications implement specific features.
-
Alibaba Open Sources OpenCodeReview for AI-Assisted Code Review
Alibaba recently open-sourced OpenCodeReview, an AI-powered code review CLI that combines deterministic pipelines for file selection, bundling, and rule matching with an LLM agent for dynamic code analysis. It supports built-in checks for issues such as null-pointer exceptions, thread safety, XSS, and SQL injection.
-
DoorDash Uses Multi Agent LLMs to Clean up 60,000 Feature Flags
DoorDash built a multi-agent LLM system to automate stale feature flag cleanup across more than 60,000 flags and 623 repositories. The workflow combines live experimentation data through MCP, engineer approval, isolated Git worktrees, parallel agents, and automated validation. In an evaluation of 50 flags, 45 produced usable pull requests at an average of 13.8 minutes and $4.79 per cleanup.
-
How to Make Testing More Sustainable
By using a sustainable testing strategy, you can skip unnecessary tests, ensure failing fast and early, and only run tests affected by code changes. Tracking energy use per test and using static code analysis can help spot inefficiencies and guide optimization efforts.
-
Arm Open-Sources Metis, an AI Security Framework Outperforming Traditional SAST Tools
Arm has open-sourced Metis, an agentic AI security framework designed to autonomously uncover complex software vulnerabilities. Unlike traditional pattern-based tools, Metis applies semantic reasoning to analyze cross-component dependencies and provides clear, natural language explanations for its findings.
-
LinkedIn Leverages GitHub Actions, CodeQL, and Semgrep for Code Scanning
LinkedIn has rebuilt its static application security testing (SAST) pipeline using GitHub Actions and custom workflows, enabling consistent, enforceable code scanning across thousands of repositories. The redesign improves security coverage, developer workflow, and observability while supporting the company’s shift-left strategy.
-
Static Analyser PHPStan Releases Version 2.0
PHPStan, a static analysis tool for PHP recently released its version 2.0. This release launches new features and improvements related to enhancing code analysis, performance, and user experience.
-
GitHub Announces Code Scanning and Security Advisory Support for Swift
GitHub has launched code scanning support for Swift in beta and announced it will include Swift security advisories in its Advisory Database to extend the capabilities of its Dependabot vulnerability monitor.
-
JetBrains Adds Taint Analysis for PHP to Qodana Code Quality Platform
Qodana, JetBrains' code quality platform, now provides support for PHP taint analysis in early preview. The feature aims to allow developers to detect taints in their programs, i.e. spots that are vulnerable to malicious inputs.
-
Software Security Report Finds JavaScript Applications Have Fewer Flaws Than Java and .NET
Veracode's State of Software Security report for 2023 found that there is a 27% chance within a given month that security flaws will be introduced into an application. The report also found that JavaScript applications on average have fewer flaws and faster flaw resolution than Java and .NET applications.
-
Heuristic Static Analysis Tool GuardDog Used to Detect Several Malicious PyPi Packages
GuardDog is new open source tool aimed at identifying malicious Python Packages using Sempreg and package metadata analysis. Thanks to a set of source code heuristics, GuardDog can detect malicious packages never seen before and has been used to identify several malicious PyPi packages in the wild.
-
Infer New Deadlock Detector for Android Aims to Be Efficient for Large Codebases
In a joint research, London University College and Facebook researchers created a new deadlock detector for Android Java code now available as part of open-source Infer static analysis tool. The new analyzer is able to process large codebases efficiently thanks to its incremental approach specifically designed for integration in a CI pipeline.
-
Static Analyzer Rudra Found over 200 Memory Safety Issues in Rust Crates
Developed at the Georgia Institute of Technology, Rudra is a static analyzer able to report potential memory safety bugs in Rust programs. Rudra has been used to scan the entire Rust package registry and identified 264 new memory safety bugs.
-
JetBrains Debuts New Kotlin Compiler K2, Kotlin for WebAssembly, and More
At its recent Kotlin 2021 Premier event, JetBrains made a number of major announcements, including K2, the new, faster Kotlin compiler, support for WebAssembly, the Kotlin Symbol Processor, a new code coverage plugin, and improved static analysis.