Snapshot v0.6.0

The sixth immutable DataFlowBench snapshot, and the widest one so far. It is three things at once: the freeze in which the benchmark doubles its analyzer count from four to eight — OpenTaint, Infer v1.3.0, FlowDroid 2.15.1, and Pysa join Bifrost, CodeQL, Joern, and Semgrep CE — the first pin-currency review, and the first publication of the latency-characterization tier.

The eight analyzers

Every one is bound at one fixture revision, with the identity of the binary actually invoked witnessed and digest-recorded in the manifest.

Analyzer	Version	Since
`bifrost`	`bifrost 0.10.7`	earlier
`codeql`	`2.26.4`	earlier
`flowdroid`	`2.15.1`	v0.6.0
`infer`	`v1.3.0`	v0.6.0
`joern`	`4.0.614`	earlier
`opentaint`	`analyzer/2026.08.27.17eb0fe`	v0.6.0
`pysa`	`0.10.0`	v0.6.0
`semgrep`	`1.175.0`	earlier

The four new adapters each enter whole expanded cores, with no partition fenced off: their pinned distributions declare interprocedural taint analysis and document no capability this benchmark exercises as out of scope, so every incapacity they show is a measured mismatch rather than a declared decline. Read them that way. A row of nine mismatches on a 58-assertion core is nine measurements, and the per-template detail is on the semantic templates page.

Two of the four also change what a language can be read as. Infer joins Bifrost, CodeQL, and Semgrep CE on the c and cpp kernel cores — the third analyzer there to enter the whole core rather than a declared intraprocedural partition, and the first that is neither this project’s own engine nor CodeQL. Pysa makes python a five-analyzer kernel. Java goes from four analyzers to seven.

Model profiles and tiers

This snapshot carries two model profiles, as v0.5.0 did. The benchmark-controlled profile covers the thirteen language kernels and the twelve-template modeling matrix; the tool-native profile covers the six-template probe set, where each tool decides with nothing but what it ships. The two profiles are never pooled, never compared number-to-number, and never share a denominator.

Coverage differs by analyzer as well as by language and by tier. A kernel with no report for an analyzer means no extractor, no frontend, or no adapter — that is coverage, not a score. inconclusive and unsupported are capability coverage and are never converted into clean negatives.

Claim

Scope: release
Tracks: taint
Score tiers: calibration core language-extension modeling
Model profiles: benchmark-controlled tool-native
Exclusions: none

Bound evidence

Freeze ID (manifest SHA-256): 3228af686d09f8666989368483bef375bb28b94025b55e31eaa7a0bdd29506ee

Freeze manifest: reports/freeze.json — every case, fixture, normalized report, and raw-evidence file is digest-bound; cargo run -- validate-freeze reports/freeze.json re-verifies all of it. 74 scorecards are bound, one per frozen report.

The full release note — with the pin-currency review’s zero-drift result, the four new analyzers’ misses published as-is, and the OpenTaint amendment whose superseded row is restated rather than removed — is docs/releases/v0.6.0.md.

Continue to analyzers, languages, semantic templates, case evidence, or latency.