The Frameworks You Actually Use Are Coming to Standalone
The current release covers 21 framework targets. The next standalone release widens that to the frozen surface's full set of lanes: more web frameworks per language, GraphQL and serverless lanes, command-line lanes, and C host and kernel cases.
The public corpus today covers 21 framework targets across 11 languages, 2,938,418 labeled cases. That is a real foundation, but the framework list was narrow: a couple of web frameworks per language and little beyond them. A scanner that only meets Flask and Spring on a benchmark has not been asked about most of what it will actually see.
The next standalone release widens the surface to the full frozen set: sixty-four code-framework lanes across the eleven languages plus a Solidity emitter.
More than one real framework per language
Each web language now brings several genuine frameworks, not a token pair. Python adds aiohttp alongside Flask, Django, and FastAPI. JavaScript adds Fastify next to Express and Koa. TypeScript grows to a full front and back set: NestJS, Hono, the Express and Fastify TypeScript lanes, and the server-rendered and browser lanes Next, SvelteKit, Angular, React, Vue, and Svelte. Go picks up Chi, Echo, Fiber, Gorilla, and net/http. Rust adds Rocket next to Actix and Axum. A scanner meets each framework’s real request accessors and idioms, not a stand-in.
Lane types that did not exist in the public corpus
Beyond more web frameworks, whole new shapes arrive:
- GraphQL resolver lanes across the web languages, where taint enters through a schema field rather than an HTTP handler.
- Serverless and worker lanes, the shapes that drain a queue or answer a cloud event instead of serving a request.
- Command-line lanes: argparse, click, and typer; cobra; picocli; clap; the Symfony console.
Host and kernel come to the benchmark
TheAuditor gained host and kernel scanning for real systems. Weeks later the benchmark can generate that surface: C host and kernel cases now exist, so a scanner that claims host or kernel coverage can be measured on it rather than taken at its word.
All of it sits on the same frozen, composable surface: request a lane on its own, pin the exact library it uses, or compose several into one system. The current public corpus remains 2026.07.22 until the new release passes its gates. When it does, it will have cleared the same bar every case clears today. See TheAuditor and Code Reality Labs.