From 37176862b86c03ecc0ed971e08da0a87b067ea4d Mon Sep 17 00:00:00 2001
From: Hugo <hugo.payet@epitech.eu>
Date: Fri, 23 Oct 2026 22:23:52 +0200
Subject: [PATCH 1/4] docs(changelog): describe the analysis fixes since 0.23.0

The summary fixpoints that never settled (#261), with the removal of
MAX_PROJECT_ITERATIONS and the source order of external calls, and the annotations that
stopped the analysis of a directory (#262).
---
 CHANGELOG.md | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index aa16f6a..32fa96e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -33,6 +33,27 @@
   `RuleDescription`, optional, so that third-party plugins describe their own rules;
   `Finding.related` lists `RelatedLocation`s (a span and a message). `Report.rules` carries the
   descriptions to the reporters.
+- Plugin API: `coretrace_python.interprocedural.starting_summaries` gives the summaries an
+  import cycle's members start from, and `coretrace_python.engine.MAX_PROJECT_ITERATIONS`
+  is removed, since the project's summaries are iterated until they settle (#261).
+- A summary lists its external calls in source order (#261): a finding naming the first
+  call of a callee's summary may name another of that callee, at the same line, as 4 of
+  saleor's 228 `orm-n-plus-one` findings do.
+
+### Analysis
+
+- `--check` ends on projects whose summaries never settled (#261). Around a call cycle of
+  three functions or more, a caller copied its callee's external calls in an order that
+  rotated forever, so ansible, fastapi, sentry and home-assistant never ended: those calls
+  are now kept in source order. Around an import cycle of three modules or more, the
+  project's iteration shifted by one module each time and stopped at its bound, which
+  could miss a sink reached through the cycle: its members now start from the summaries a
+  module starts from, and the iteration goes on until the project's summaries settle.
+- A lambda or comprehension in the annotation of a parameter or a variable no longer
+  stops the analysis of a directory with a `KeyError` (#262). An assignment expression in
+  an annotation binds its name as Python 3.11 to 3.13 do: in a function, the name is a
+  local whether the annotation is evaluated or not; at module level, it exists only once
+  the annotation is evaluated.
 
 ### Performance
 

From 5201dd78cb9977b6037563a12b8af887874c19a5 Mon Sep 17 00:00:00 2001
From: Hugo <hugo.payet@epitech.eu>
Date: Fri, 23 Oct 2026 22:23:52 +0200
Subject: [PATCH 2/4] docs(changelog): describe how templates are read since
 0.23.0

Start tags read as the HTML tokenizer reads them (#263), what a template leaves open and
how comments end (#272), and every continuation of a comment holding template tags
(#278), with the templates no longer established that these readings refuse.
---
 CHANGELOG.md | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 32fa96e..90d4a00 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,6 +20,10 @@
   instead of repeating its id (#270), and each result carries its confidence as the
   `confidence` property (#271). A flow reaching its sink inside a project function points at
   that sink as a related location, which the result's message links to (#271).
+- Django templates are read as a browser reads them (#263, #272, #278): a template that
+  leaves a tag, a `<script>` or `<style>` block or an end tag open, or includes one that
+  ends inside such a construct, is no longer established as escaping, so `xss` may be
+  reported where it was not.
 - Django templates are also read as each page is put together (#273): a variable a
   child's `{% block %}` prints inside its parent's `<script>`, an `{% include %}` that ends
   the attribute value it stands in, or one of a name several files have outside HTML data,
@@ -55,6 +59,26 @@
   local whether the annotation is evaluated or not; at module level, it exists only once
   the annotation is evaluated.
 
+### Templates
+
+- Start tags and their attributes are read as the HTML tokenizer reads them, in time
+  linear in the size of the template (#263): a few dozen characters under a `templates`
+  directory, a PNG or `<a ` followed by 40 letters, stopped the analysis. A tag a template
+  leaves open is read to its end and its attributes are checked; a quoted value left open
+  stays quoted to the end of the template.
+- A `<script>` or `<style>` block or an end tag a template leaves open runs to the end of
+  the template, and a variable inside it is refused, even where the page ends there
+  (#272). A template that ends inside such a construct or a tag is not established where
+  it is included, since the markup after the include continues it, and a template
+  extending another ends where that one ends.
+- A comment ends where a browser ends it (`-->`, `--!>`, at once for `<!-->` and
+  `<!--->`), and one left open hides the rest of the template (#272). A comment holding
+  template tags may end at any of them, since an include there may close it and a
+  condition around its `<!--` may leave it out, or run to its close when they render
+  nothing: it is read on from its first tag, and that reading must be in HTML data right
+  after each later tag and right after the close (#278). Such a comment left open does
+  not end in HTML data.
+
 ### Performance
 
 - Collecting the filters a template's render reaches walks each template once for each set

From 194590c5027b7dcaf7b64043d723ab5359b2b859 Mon Sep 17 00:00:00 2001
From: Hugo <hugo.payet@epitech.eu>
Date: Fri, 23 Oct 2026 22:23:52 +0200
Subject: [PATCH 3/4] docs(changelog): list the documentation changes since
 0.23.0

---
 CHANGELOG.md | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 90d4a00..e18c96f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -87,6 +87,13 @@
   A template in a cycle of includes is still walked again wherever the cycle cuts its
   walk short.
 
+### Documentation
+
+- `docs/usage.md` documents how templates are read and each page is put together, the
+  modules of a directory without `__init__.py`, assignment expressions in annotations,
+  and the rule descriptions and related locations of the SARIF report; `docs/plugins.md`
+  documents `Plugin.rules` and `Finding.related`.
+
 ## 0.23.0 (2026-10-16)
 
 ### Compatibility and migration

From b7e5b2ea1dd6b744c5f64ea45e0c3ebe5e12d1f5 Mon Sep 17 00:00:00 2001
From: Hugo <hugo.payet@epitech.eu>
Date: Fri, 23 Oct 2026 22:23:52 +0200
Subject: [PATCH 4/4] chore: release 0.24.0

---
 CHANGELOG.md                     | 2 +-
 docs/usage.md                    | 6 +++---
 pyproject.toml                   | 2 +-
 src/coretrace_python/__init__.py | 2 +-
 tests/test_release.py            | 2 +-
 5 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e18c96f..2d2d792 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,6 @@
 # Changelog
 
-## Unreleased
+## 0.24.0 (2026-10-23)
 
 ### Compatibility and migration
 
diff --git a/docs/usage.md b/docs/usage.md
index 8281423..00ab31e 100644
--- a/docs/usage.md
+++ b/docs/usage.md
@@ -374,7 +374,7 @@ the directory of the checked file; a path outside it is printed as it is.
 ```json
 {
   "schema_version": 1,
-  "tool": {"name": "coretrace-python-analyzer", "version": "0.23.0"},
+  "tool": {"name": "coretrace-python-analyzer", "version": "0.24.0"},
   "root": "/home/me/project",
   "findings": [
     {
@@ -438,7 +438,7 @@ bytes. A single-file check lists no components.
 
 ```json
 "tool": {
-  "name": "coretrace-python-analyzer", "version": "0.23.0",
+  "name": "coretrace-python-analyzer", "version": "0.24.0",
   "components": [
     {"kind": "plugin", "name": "curated-advisories", "version": "2026.09.25", "digest": "sha256:…"},
     {"kind": "advisories", "name": "advisories.json", "digest": "sha256:…"}
@@ -815,7 +815,7 @@ project's behalf would go unseen. Without a lock file, a package is never
 `not_affected`. The document's `@id` derives from its statements, so two runs with the
 same result share it; its `author` is `Unknown Author`, as OpenVEX tools write when they
 cannot know it. Its `tooling` names the analyzer and each component with its digest
-(`coretrace-python-analyzer 0.23.0; curated-advisories 2026.09.25 (sha256:…)`), so the
+(`coretrace-python-analyzer 0.24.0; curated-advisories 2026.09.25 (sha256:…)`), so the
 `@id` changes with the advisory data a statement was decided with.
 
 ## Large projects
diff --git a/pyproject.toml b/pyproject.toml
index aa7d864..4ed18b7 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "coretrace-python-analyzer"
-version = "0.23.0"
+version = "0.24.0"
 description = "Static security analysis infrastructure for Python code"
 readme = "README.md"
 requires-python = ">=3.11"
diff --git a/src/coretrace_python/__init__.py b/src/coretrace_python/__init__.py
index e2a2efc..9dfe729 100644
--- a/src/coretrace_python/__init__.py
+++ b/src/coretrace_python/__init__.py
@@ -1,4 +1,4 @@
 """CoreTrace's Python static analysis frontend."""
 
-__version__ = "0.23.0"
+__version__ = "0.24.0"
 
diff --git a/tests/test_release.py b/tests/test_release.py
index efe42a2..a7fc5f3 100644
--- a/tests/test_release.py
+++ b/tests/test_release.py
@@ -30,7 +30,7 @@ def require_changelog() -> None:
 def test_the_version_is_declared_once_and_mirrored() -> None:
     project = tomllib.loads((REPO / "pyproject.toml").read_text(encoding="utf-8"))["project"]
 
-    assert project["version"] == coretrace_python.__version__ == "0.23.0"
+    assert project["version"] == coretrace_python.__version__ == "0.24.0"
 
 
 def test_the_changelog_starts_with_the_current_version() -> None: