docs(cobol): promote COBOL to General Availability - #1486

These lines are not in the diff either, so no inline comments. All pre-existing.

Line 11 — Issue: "(s)" is not used for plurals, the colon sits inside the bold here but outside it on lines 10, 12, and 13, and "that are covered by this rule" is passive.

Proposed:

* **CWEs**: The [CWE numbers](https://cwe.mitre.org/) the rule covers.

Line 12 — Issue: "the category to which the rule belongs to" has a doubled preposition. The link text [OWASP Top 10 ] has a trailing space inside it, which renders a gap before "(2021 edition)". "if it is included in" is passive.

Proposed:

* **Security Categories**: The [OWASP Top 10](https://owasp.org/Top10/) (2021 edition) category the rule belongs to, if any, and whether SANS Top 25 includes it.

Line 13 — Issue: "only for the supported programming languages" does not tell the reader which languages.

Proposed:

* **Autofixable**: Whether Snyk Agent Fix can fix the rule automatically. Snyk includes this column only for languages Snyk Agent Fix supports.

Line 15 — Issue: table header uses "CWE(s)".

Proposed: CWEs

Lines 12, 15, 18, 23 — Issue: the same standard is written three ways — "SANS 25" in the line 12 link text, "Sans Top 25" in the No Dynamic SQL Clauses row, "SANS Top 25" in the Injection on Accept row.

Proposed: use "SANS Top 25" in all four places.

Applied, with two corrections.

Your line-12 rewrite drops the SANS hyperlink, so I kept [SANS Top 25](https://www.sans.org/top25-software-errors/) linked. And the SANS spelling sits on lines 12, 19 and 24 — three places, not four: line 15 is the table header, and 18 and 23 are OWASP-only rows.

The boilerplate you flagged here is duplicated verbatim across 19 rules pages, so I applied it to all of them rather than leave COBOL reading differently from its siblings. Apex and XML are on the 2025 OWASP edition and keep that year.

Update: the SANS normalisation turns out to be moot, and not through any fault of the review.

#1518 merged the OWASP Top 10 2025 / CWE Top 25 mapping on 23 July, which retires SANS on these pages and replaces those cells with CWE Top 25. A GitBook sync commit (491d5a7e2, "Automated Target Authentication Configuration") silently reverted all 20 rules pages the next morning, so the content you reviewed was three weeks stale without anything indicating it.

This branch now restores #1518 byte-for-byte and applies your wording on top. The CWEs heading, the Autofixable sentence and the title casing all still stand; the SANS spelling no longer exists to fix.

All three checked against the engine rather than the docs. Answers, with the sources:

1. Agent Fix languages — XML was the real error, and the list was stale. The engine allowlist is pantscode/autofix/ml_serving/agent_rule_config.yaml on deepcode@develop, gated in autofix_provider.cpp and deployed_models_lib.py. It names 17 languages. Dart, Groovy, Kotlin, Rust, Scala and Visual Basic are supported, so the 13-name list was out of date, left over from the fine-tuned-model era. XML is genuinely absent, so its Autofixable column is gone. The language list now matches the engine, and I dropped the "all languages supported by Snyk Code" phrasing, which was false in exactly the XML case.

Also worth noting: the column was on all 19 pages with Yes on all 564 rows, so the boilerplate was self-refuting rather than wrong on 8 pages.

2. COBOL interfile — no, and the COBOL page was right. analysis/analysis_settings/analysis_settings.json sets supports_interfile: false under language: cobol, enforced in bundle_analyzer.cpp and reports.cpp. So the omission on cobol.md is correct and the blanket claim on the matrix page was the bug. That sentence now names COBOL as the exception.

3. CWE-190 — None is correct, please leave it. CWE-190 is not in the 2025 CWE Top 25, which is the edition these pages link to. Your 157/156 count is right, but 34 rows lost the designation and 33 gained it, all consistent with the 2025 list. Changing this one to CWE Top 25 would introduce an error. It also predates the restore — it came from #1518 in July.

One thing left open deliberately: objective-c-rules.md keeps its Autofixable column. The engine fixes Objective-C under cpp but has never advertised it separately, so I have not added it to the language list. Happy to go either way on that one.

Done, and it resolves the XML case too.

The Autofixable column is gone from all 19 rules pages, along with its bullet. Every one of the 556 rows read Yes, so the column carried no information — I checked the distinct values before removing it rather than assuming.

The Agent Fix page now states the coverage once: Agent Fix supports every language that Snyk Code supports, with a link to the supported-languages list rather than a hardcoded enumeration. That is what went stale in the first place — the old 13-name list had been left behind by the engine, and a fresh 19-name list would have gone the same way.

This also removes the need for the XML judgement call from my last reply. XML is not a supported language in its own right, it is scanned as NuGet XML files, so with no per-page column there is nothing inconsistent left to reconcile. Same for Objective-C, which I had flagged as open.