[liquidsec]

Closes #3445.

A FINDING (or any ClosestHostEvent) with no host of its own inherits host, url, path and port from its closest parent. The port never stuck: it was assigned just before self.data = self.data, and the data setter resets _port. So a FINDING whose parent is OPEN_TCP_PORT("8.8.8.8:53") ended up with port=None.

• ClosestHostEvent: set _port after the hash refresh instead of before.
• event_from_json(): restore the top-level port that json() already writes. Without this, the inherited port was lost again when an event was rebuilt from JSON. Port isn't part of the event's data or id, so this doesn't change any event ids, and event types that compute their port from their data come back with the same value as before.

Findings that differ only by port still dedupe into one event, as they always have, since the port isn't part of the id.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91%. Comparing base (1471146) to head (7ac7ed7).
⚠️ Report is 6 commits behind head on dev.

Additional details and impacted files

@@          Coverage Diff          @@
##             dev   #3462   +/-   ##
=====================================
- Coverage     91%     91%   -0%     
=====================================
  Files        460     460           
  Lines      48998   49014   +16     
=====================================
+ Hits       44132   44142   +10     
- Misses      4866    4872    +6     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

📊 Performance Benchmark Report

Comparing dev (baseline) vs closest-host-port (current)

📈 Detailed Results (All Benchmarks)

📋 Complete results for all benchmarks - includes both significant and insignificant changes

🧪 Test Name	📏 Base	📏 Current	📈 Change	🎯 Status
Bloom Filter Dns Mutation Tracking Performance	3.79ms	3.88ms	+2.5% ⚪	✅
Bloom Filter Large Scale Dns Brute Force	15.50ms	15.81ms	+2.0% ⚪	✅
Large Closest Match Lookup	358.02ms	375.47ms	+4.9% ⚪	✅
Realistic Closest Match Workload	197.53ms	196.34ms	-0.6% ⚪	✅
Event Memory Medium Scan	1402 B/event	1402 B/event	+0.0% ⚪	✅
Event Memory Large Scan	1527 B/event	1527 B/event	+0.0% ⚪	✅
Event Validation Full Scan Startup Small Batch	423.21ms	424.55ms	+0.3% ⚪	✅
Event Validation Full Scan Startup Large Batch	567.92ms	569.83ms	+0.3% ⚪	✅
Make Event Autodetection Small	27.55ms	26.70ms	-3.1% ⚪	✅
Make Event Autodetection Large	276.18ms	268.15ms	-2.9% ⚪	✅
Make Event Explicit Types	11.99ms	11.71ms	-2.3% ⚪	✅
Excavate Single Thread Small	4.307s	4.266s	-1.0% ⚪	✅
Excavate Single Thread Large	10.316s	10.182s	-1.3% ⚪	✅
Excavate Parallel Tasks Small	4.456s	4.371s	-1.9% ⚪	✅
Excavate Parallel Tasks Large	6.505s	6.434s	-1.1% ⚪	✅
Intercept Throughput Small	906.52ms	905.86ms	-0.1% ⚪	✅
Intercept Throughput Medium	892.75ms	900.15ms	+0.8% ⚪	✅
Dns Throughput Quiet	2.948s	2.812s	-4.6% ⚪	✅
Dns Throughput Loaded	1.921s	1.858s	-3.3% ⚪	✅
Dns Throughput Inherited	2.692s	2.518s	-6.4% ⚪	✅
Is Ip Performance	2.29ms	2.35ms	+2.7% ⚪	✅
Make Ip Type Performance	228.99µs	236.05µs	+3.1% ⚪	✅
Mixed Ip Operations	2.36ms	2.45ms	+3.8% ⚪	✅
Memory Use Web Crawl	1.2 MB	1.2 MB	+0.0% ⚪	✅
Memory Use Subdomain Enum	28.3 MB	28.3 MB	+0.0% ⚪	✅
Memory Use Deep Chain	5.0 MB	5.0 MB	+0.0% ⚪	✅
Memory Use Parallel Chains	11.6 MB	11.2 MB	-4.0% ⚪	✅
Scan Throughput 100	2.937s	3.050s	+3.9% ⚪	✅
Scan Throughput 1000	22.324s	21.416s	-4.1% ⚪	✅
Typical Queue Shuffle	5.52µs	5.40µs	-2.1% ⚪	✅
Priority Queue Shuffle	26.62µs	26.06µs	-2.1% ⚪	✅

🎯 Performance Summary

✅ No significant performance changes detected (all changes <10%)

---

🐍 Python Version 3.11.16