Release v0.3.0 (#17)

* docs: update binary detection wording

* chore: release v0.3.0

Author: jcouture

CHANGELOG.md

@@ -4,6 +4,40 @@ All notable changes to ghostscan are documented here.
 
 ---
 
+## v0.3.0 - 2026-04-12
+
+### New Features
+
+- **JSON output** — added `--format json` for structured reports containing tool metadata, scan timing, summary counts, findings, skipped files, and recoverable errors. Fatal execution errors in JSON mode are emitted as structured reports and still exit with code `2`.
+- **Configurable excludes** — added repeatable `--exclude` globs and `--no-default-excludes`. Exclude matching uses normalized relative paths with `/` separators, supports `**` across path segments, and reports matched excludes in verbose human output.
+- **Emoji-aware Unicode handling** — valid emoji variation selectors, keycap sequences, regional indicator flags, skin-tone modifiers, and ZWJ emoji sequences are recognized to reduce false positives while preserving detection for fake or suspicious emoji-like content.
+- **Binary magic detection** — discovery now skips files with recognized binary signatures in addition to files containing NUL bytes.
+
+### Changes
+
+- **Decoder findings are internal by default** — decoder and dynamic-execution markers now act as correlation context instead of standalone findings; hidden payloads near those markers are reported as correlated findings.
+- **Font asset noise reduced** — private-use-only findings are suppressed in conservative font-like SVG and icon font contexts.
+- **Human reporting streamlined** — non-verbose output now stays summary-focused, verbose output retains detailed finding blocks, and runtime summaries include pruned excluded directories.
+- **Finding ordering stabilized** — sorting now prioritizes higher-signal Unicode rules before lower-signal rule IDs when location fields are equal.
+- **Payload density detection optimized** — payload window analysis now uses sliding state and fixed class aggregation to reduce allocations while preserving deterministic messages.
+- **Scan path simplified** — files that pass discovery are scanned through a trusted text path so binary checks are not repeated.
+
+### Documentation
+
+- README updated for JSON output, exclude flags, current CLI help text, decoder correlation behavior, font asset noise reduction, and Go `1.26.2` source-build requirements.
+
+### Tests and Benchmarks
+
+- Added coverage across CLI, app, detector, filesystem, finding, report, scan, and Unicode helper behavior.
+- Added benchmarks for CLI execution, discovery, payload detection, and file scanning paths.
+- Added fixtures for font private-use SVG content, benign emoji sequences, fake emoji content, and binary PDF detection.
+
+### Maintenance
+
+- Bumped Go from `1.26.1` to `1.26.2`.
+- Bumped `actions/setup-go` from `6.3.0` to `6.4.0`.
+- Updated runtime dependencies for binary type detection and existing transitive dependency versions.
+
 ## v0.2.0 - 2026-03-24
 
 ### New Features

README.md

@@ -47,7 +47,7 @@ Fingerprint: /Users/johnsmith/ghostscan/testdata/invisible/single.txt:unicode/in
 - **Focused Unicode threat coverage**: Detects invisible characters, private-use Unicode, bidi controls, directional marks, mixed-script tokens, and combining marks.
 - **Payload-aware heuristics**: Flags long hidden sequences, dense suspicious regions, and explicit payload-plus-decoder correlations while keeping standalone decoder noise out of default results.
 - **Noise reduction for asset contexts**: Suppresses obvious private-use glyph mappings in font-like SVG assets so icon fonts do not dominate the report.
-- **Safe repository traversal**: Skips symlinks, NUL-containing files, oversize files, and common dependency or build directories.
+- **Safe repository traversal**: Skips symlinks, binary files, oversize files, and common dependency or build directories.
 - **CI-friendly behavior**: Uses deterministic ordering, human or JSON output, and exit codes `0`, `1`, and `2`.
 
 ## Installation
@@ -166,7 +166,7 @@ The current scanner behavior is intentionally narrow and real:
 - Recursively scans a file or directory path.
 - Parses flags only before the optional file or directory path.
 - Does not follow symlinks.
-- Treats files containing a NUL byte as binary and skips them.
+- Treats files containing a NUL byte or recognized binary magic signature as binary and skips them.
 - Uses a default max file size of `5 MiB`.
 - Matches excludes against the full normalized relative path with `/` separators.
 - Supports repeatable `--exclude` globs with `**` matching zero or more path segments and `filepath.Match` semantics for other segments.