From 19ed14bd9f0de1b2b1af03b9fbda3c4a358cf2df Mon Sep 17 00:00:00 2001
From: pratheep-bit <pratheeps2024@gmail.com>
Date: Sat, 12 Sep 2026 22:41:41 +0530
Subject: [PATCH 1/8] docs: remove competitor brand references to ensure
 vendor-neutral documentation

---
 README.md              | 2 +-
 scanner/suppression.py | 2 +-
 site/index.html        | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index 9c80a3c..4362135 100644
--- a/README.md
+++ b/README.md
@@ -90,7 +90,7 @@ frapAST includes live integration testing against local and staging Frappe bench
 
 ## Architectural Comparison
 
-| Capability | Generic SAST (Bandit / SonarQube) | Cloud Static Scanners | frapAST |
+| Capability | Generic SAST Tools | Cloud Static Scanners | frapAST |
 |---|:---:|:---:|:---:|
 | Frappe Framework Modeling | None (generic Python only) | Partial regex matching | Full (DocType JSONs, `hooks.py`, ORM, DocEvents, Reports) |
 | Active Proof Verification | None (static alerts only) | None (static alerts only) | Two-Tier Active Proof (synthesizes live HTTP reproducers) |
diff --git a/scanner/suppression.py b/scanner/suppression.py
index dc5315b..69c3a1e 100644
--- a/scanner/suppression.py
+++ b/scanner/suppression.py
@@ -71,7 +71,7 @@ def is_suppressed(
     """Return True if the candidate has an inline ``# frapast: ignore`` suppression.
 
     Checks the same line as the finding and the immediately preceding line, which is
-    the standard convention from Bandit/ESLint/ruff.
+    the standard convention from popular linters and static analyzers.
 
     Parameters
     ----------
diff --git a/site/index.html b/site/index.html
index ed535a4..e448edb 100644
--- a/site/index.html
+++ b/site/index.html
@@ -123,7 +123,7 @@ <h1>Most scanners guess.<br><span class="fade">frapAST proves it.</span></h1>
         <section class="bordered" id="why">
             <div class="wrap">
                 <div class="section-head">
-                    <h2>Why not just use Bandit or SonarQube?</h2>
+                    <h2>Why not generic SAST scanners?</h2>
                     <p>Generic Python SAST tools analyze Frappe apps as generic scripts. Frappe applications are
                         metadata-driven: DocType JSON schemas, hooks.py event registrations, and whitelist decorators
                         cannot be understood by plain AST linters without producing heavy false-positive noise.</p>
@@ -373,7 +373,7 @@ <h2>Frequently Asked Questions</h2>
                     </div>
                     <div class="faq-item">
                         <button class="faq-question" type="button" aria-expanded="false">
-                            <span>How is frapAST different from Bandit or SonarQube?</span>
+                            <span>How is frapAST different from generic Python SAST tools?</span>
                             <span class="icon"><svg class="icon" viewBox="0 0 24 24" aria-hidden="true">
                                     <line x1="12" y1="5" x2="12" y2="19"></line>
                                     <line x1="5" y1="12" x2="19" y2="12"></line>

From bcba0645480a74d15ff615c6c79369ce3d2c26be Mon Sep 17 00:00:00 2001
From: pratheep-bit <pratheeps2024@gmail.com>
Date: Sat, 12 Sep 2026 22:41:54 +0530
Subject: [PATCH 2/8] docs: reconcile active detector count badge with rule
 engine registry

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 4362135..03dd05a 100644
--- a/README.md
+++ b/README.md
@@ -11,7 +11,7 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 [![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
 [![Tests](https://img.shields.io/badge/tests-306%20passed-green.svg)](#test-suite-and-quality-assurance)
-[![Rules](https://img.shields.io/badge/detectors-33%20active-blue.svg)](#rule-taxonomy)
+[![Rules](https://img.shields.io/badge/detectors-28%20active-blue.svg)](#rule-taxonomy)
 [![Benchmark Speed](https://img.shields.io/badge/speed-16%2C700%2B%20files%2Fsec-green.svg)](#industry-benchmarks-and-performance)
 [![Privacy](https://img.shields.io/badge/privacy-100%25%20Local%20and%20Airgapped-blue.svg)](#data-privacy-and-air-gapped-execution)
 

From e592e668648f0a8f8f2f5dc7e7b5d537971ff26e Mon Sep 17 00:00:00 2001
From: pratheep-bit <pratheeps2024@gmail.com>
Date: Sat, 12 Sep 2026 22:42:12 +0530
Subject: [PATCH 3/8] fix(ci): update upload-sarif action from v3 to v4 across
 workflows and action.yml

---
 .github/workflows/scanner-ci.yml | 2 +-
 action.yml                       | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/scanner-ci.yml b/.github/workflows/scanner-ci.yml
index cf0112a..158cea6 100644
--- a/.github/workflows/scanner-ci.yml
+++ b/.github/workflows/scanner-ci.yml
@@ -114,7 +114,7 @@ jobs:
           "
 
       - name: Upload SARIF to GitHub Code Scanning
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         if: always()
         with:
           sarif_file: frapast-self.sarif
diff --git a/action.yml b/action.yml
index c5413b8..5f57b31 100644
--- a/action.yml
+++ b/action.yml
@@ -119,7 +119,7 @@ runs:
 
     - name: Upload SARIF to GitHub Code Scanning
       if: ${{ inputs.upload-sarif == 'true' && always() }}
-      uses: github/codeql-action/upload-sarif@v3
+      uses: github/codeql-action/upload-sarif@v4
       with:
         sarif_file: ${{ inputs.sarif-file }}
         category: frapast

From c6449f892007d5f7184cf5014ed936573811da63 Mon Sep 17 00:00:00 2001
From: pratheep-bit <pratheeps2024@gmail.com>
Date: Sat, 12 Sep 2026 22:42:38 +0530
Subject: [PATCH 4/8] ci: add workflow concurrency group to cancel redundant
 pipeline runs

---
 .github/workflows/frapast-scan.yml | 4 ++++
 .github/workflows/scanner-ci.yml   | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/.github/workflows/frapast-scan.yml b/.github/workflows/frapast-scan.yml
index 7165890..02e3b84 100644
--- a/.github/workflows/frapast-scan.yml
+++ b/.github/workflows/frapast-scan.yml
@@ -6,6 +6,10 @@ on:
   pull_request:
     branches: [ main, develop ]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   action-test:
     name: Test Composite Action (action.yml)
diff --git a/.github/workflows/scanner-ci.yml b/.github/workflows/scanner-ci.yml
index 158cea6..19e75d4 100644
--- a/.github/workflows/scanner-ci.yml
+++ b/.github/workflows/scanner-ci.yml
@@ -10,6 +10,10 @@ permissions:
   contents: read
   security-events: write   # required for SARIF upload to Code Scanning
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   test:
     name: Tests (Python ${{ matrix.python-version }})

From bce0c30bf73928866e96f9b5d1c9823423f42f5b Mon Sep 17 00:00:00 2001
From: pratheep-bit <pratheeps2024@gmail.com>
Date: Sat, 12 Sep 2026 22:43:09 +0530
Subject: [PATCH 5/8] perf(schema): optimize directory traversal during DocType
 JSON schema discovery

---
 scanner/schema/engine.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/scanner/schema/engine.py b/scanner/schema/engine.py
index 2c14f0b..771686a 100644
--- a/scanner/schema/engine.py
+++ b/scanner/schema/engine.py
@@ -27,12 +27,15 @@ def discover_doctype_json(app_roots: str | Path | list[str | Path] | tuple[str |
 				d for d in dirs
 				if d not in SKIP_DIRS and not (d.startswith(".") and d != ".")
 			]
-			parent_name = Path(dirpath).name
+			parent_name = os.path.basename(dirpath)
+			dir_path_obj: Path | None = None
 			for fname in sorted(filenames):
 				if fname.endswith(".json"):
 					stem = fname[:-5]
 					if parent_name == stem:
-						files.append(SourceFile(path=Path(dirpath) / fname, root=root))
+						if dir_path_obj is None:
+							dir_path_obj = Path(dirpath)
+						files.append(SourceFile(path=dir_path_obj / fname, root=root))
 	return files
 
 

From 48d61a9058db8f417fe1abd0cb68b4cf0a77ad7b Mon Sep 17 00:00:00 2001
From: pratheep-bit <pratheeps2024@gmail.com>
Date: Sat, 12 Sep 2026 22:43:23 +0530
Subject: [PATCH 6/8] test: enforce exact active rule count parity in
 test_all_rules

---
 tests/test_all_rules.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/test_all_rules.py b/tests/test_all_rules.py
index 36864be..15068c2 100644
--- a/tests/test_all_rules.py
+++ b/tests/test_all_rules.py
@@ -19,7 +19,7 @@ def setUp(self):
 
 	def test_rules_registry_integrity(self):
 		from scanner.rules.engine import ALL_RULES, RENAMED_TAXONOMY
-		self.assertGreaterEqual(len(ALL_RULES), 20)
+		self.assertEqual(len(ALL_RULES), 28)
 		for rule in ALL_RULES:
 			self.assertTrue(callable(rule))
 		# Taxonomy consistency assertion passes at import time

From 1e906de9b3c534c2896c3682850bbfb922928293 Mon Sep 17 00:00:00 2001
From: pratheep-bit <pratheeps2024@gmail.com>
Date: Sat, 12 Sep 2026 22:43:43 +0530
Subject: [PATCH 7/8] feat(cli): document standard CLI exit codes in help
 documentation

---
 scanner/cli.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/scanner/cli.py b/scanner/cli.py
index 3ca4f50..3c55248 100644
--- a/scanner/cli.py
+++ b/scanner/cli.py
@@ -503,6 +503,10 @@ def _build_parser() -> argparse.ArgumentParser:
   frapast scan /path/to/erpnext
   frapast scan /path/to/frappe-app --severity --format json
   frapast scan --config scan_config.yaml
+
+Exit Codes:
+  0  Success (clean scan, findings below failure threshold, or command succeeded)
+  1  Execution error, invalid configuration, or unhandled exception
 """,
 	)
 	parser.add_argument("--version", action="version", version=_get_version_string())

From 015d3cc9adba3396f6edde48f9868614a3ee3f83 Mon Sep 17 00:00:00 2001
From: pratheep-bit <pratheeps2024@gmail.com>
Date: Sat, 12 Sep 2026 22:43:59 +0530
Subject: [PATCH 8/8] chore(packaging): declare Python 3.14 classifier in
 pyproject.toml

---
 pyproject.toml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pyproject.toml b/pyproject.toml
index 9712988..4263424 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -22,6 +22,7 @@ classifiers = [
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
     "Operating System :: OS Independent",
 ]
 requires-python = ">=3.10"