Code-Graph-RAG Files

🔒 Security

Fixes a path traversal / arbitrary file read (High, CVSS 7.5) in the MCP read_file tool's paginated branch — advisory GHSA-vvr2-h2jp-838m. An absolute or ../ file_path combined with offset/limit could escape the project root. Upgrade if you run cgr mcp-server.

First PyPI release since v0.0.246; this consolidates all changes below.

What's Changed

• fix(ci): build darwin-amd64 binary on macos-15-intel runner by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/644
• ci: bump astral-sh/setup-uv from v4 to v8.3.1 to drop deprecated Node 20 by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/643
• fix(parsers): key query cache by Language object to prevent id reuse collisions by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/645
• feat(graph): structural integrity audit validating graphs against documented schema by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/648
• test(integration): pin Memgraph integration tests to one xdist worker via loadgroup by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/649
• fix(js): reference new-expression constructor callbacks and nested arrow-const caller qns by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/651
• fix(js): nest class-method closures and reference callbacks inside unowned arrows by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/653
• docs: document dead-code detection (README, PyPI, guide) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/654
• fix(cpp): eliminate all 289 souffle orphan nodes via deferred registry-verified containment by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/655
• fix(go): resolve inline field-hop calls and build-variant package siblings by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/656
• fix(java): link new-expression to constructor and class instantiation by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/658
• fix(cpp): resolve includes against real files and unify name resolution across passes by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/657
• fix(java): root serialization hooks so reflectively-invoked methods are reachable by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/659
• fix(java): resolve nested-class type names referenced by simple name within a file by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/660
• fix(cpp): eliminate remaining dangling edges via pass-2 location reuse and deferred INHERITS resolution by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/663
• fix(java): anonymous-class override dispatch (OVERRIDES edges + lexical-scope calls) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/662
• fix(java): cast-expression receivers and anonymous-class own-method calls by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/664
• fix(audit): enforce zero dangling relationships across all language fixtures by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/665
• fix(java): externalize implicit java.lang bases onto ExternalModule nodes by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/666
• fix(js-ts): reference functions consumed via casts, currying, member assignment, call args, param defaults, and shorthand methods by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/667
• fix(evals): restore all eight language oracles to 1.0 on thrift after the dangling-edge campaign by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/669
• fix(py,ts): click and zustand dead-code residuals plus same-line and overload-variant caller attribution by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/668
• fix(js): express dead-code residuals via named fn-expr references, member-call precision, twin fan-out, var-require imports, and test dir exclusion by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/670
• feat(cpp-frontend): emit IMPORTS edges for within-repo includes by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/671
• feat: register C/C++ and Rust macro definitions as Function nodes with resolvable invocations by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/672
• test(cpp): address codecov and sonar reports from [#672] (macro guard coverage, complexity) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/673
• feat(go): promote Go to fully supported by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/674
• fix(resolver): keep the static interface-method edge on sole-impl dispatch by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/676
• fix(js): unify duplicate function nodes via span claims and deferred anonymous registration by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/675
• fix(deps): patched grammar forks for comment-in-define declaration drop by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/678
• fix: emit OVERRIDES edges for interface and trait implementations by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/677
• refactor(constants): split constants.py into themed submodules by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/680
• fix(rust): type dyn and impl Trait receivers to their trait for call resolution by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/679
• fix(rust): type free-function factory results from recorded return types by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/681
• feat(cpp): hybrid frontend layering libclang macros and includes onto tree-sitter by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/682
• fix(deadcode): compute reachability client-side to remove per-root BFS query timeout by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/683
• fix(parsers): link returned closures to every duplicate-QN twin by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/684
• fix(parsers): reference first-party functions passed to unnamed callees by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/685
• fix(parsers): reference ternary-assigned and returned method values in python by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/686
• fix(parsers): resolve this-calls in js prototype methods to sibling methods by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/687
• fix(parsers): resolve package-attribute bases through star re-exports by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/688
• feat(cli): flag and settings to skip the semantic embedding pass by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/691
• fix(embedder): drain mps command buffers after each embedding batch by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/692
• fix(deadcode): treat methods of factory-built classes as dispatch roots by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/693
• fix(parsers): treat top-level browser-script symbols as page-global roots by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/694
• fix(parsers): link sibling-mixin shadow methods with OVERRIDES edges by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/695
• fix(parsers): reference first-class function values inside containers and class bodies by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/696
• fix(deadcode): treat python enum protocol hooks as reachability roots by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/697
• feat(sync): warn when incremental sync runs against a graph built by a different parser by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/698
• fix(deadcode): root property-family accessors invoked by attribute syntax by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/699
• fix(parsers): prefix absolute imports when the top-level package shares the repo name by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/700
• fix(parsers): unwrap bind, call, and apply to reference the underlying function by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/701
• fix(deadcode): strip the duplicate-qn marker before name-scoped root rules by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/703
• test(cpp): pin module attribution for macros used only in evaluated directives by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/704
• fix(cpp): recover whole-file parse collapse from unbalanced preprocessor branches by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/702
• feat(parsers): extract access modifiers and decorators via highlights.scm by @ChetanyaRathi in https://github.com/vitali87/code-graph-rag/pull/566
• feat: selective relationship capture with READS_FROM/WRITES_TO I/O edges by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/638
• fix(cpp): reject reserved-keyword definition names and bind operators by operand type by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/709
• feat(flow): add opt-in FLOWS_TO data-flow edges for intra-procedural taint by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/707
• fix(python): factory-return chain inference and AST cache reload on eviction by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/706
• feat(cpp): hybrid type aliases, post-expansion CALLS, and HYBRID as default frontend by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/708
• feat: add MiniMax provider by @octo-patch in https://github.com/vitali87/code-graph-rag/pull/626
• fix(io): scope-correct I/O attribution and direct-return FLOWS_TO edges by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/710
• test(parsers): spike tags.scm definition cross-validation (#524) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/717
• feat(csharp): tree-sitter C# support for definitions, imports, and calls (Phase 1 of [#102]) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/716
• fix(parsers): load community tags.scm as the cross-validation oracle (#524) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/718
• feat(io): improve I/O and data-flow edge recall by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/715
• feat(csharp): INHERITS, IMPLEMENTS and OVERRIDES (Phase 2 of 4, [#102]) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/719
• feat(parsers): cross-validate reference.call sites against cgr (#524) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/721
• feat(csharp): typed call resolution (Phase 3 of 4, [#102]) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/720
• fix: preserve parallel FLOWS_TO provenance edges under MERGE (#722) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/724
• feat(csharp): dead-code, exports, stdlib -> Fully Supported (Phase 4 of 4, [#102]) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/726
• fix(resolver): scope registry rehydrate to the indexed project (#711) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/727
• chore(parsers): remove unused tags.scm cross-validation code by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/729
• feat(io): recognize httpx/aiohttp and pathlib.Path I/O in the registry (#723) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/730
• feat: add Dart/Flutter language support (#140) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/733
• feat(csharp): bind extension-method calls to their static definition by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/731
• feat(csharp): register operators, conversion operators, and finalizers as member nodes by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/728
• feat(flow): path-sensitive MAY taint analysis for FLOWS_TO (#713) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/734
• feat(flow): resolve forward/cross-file return-taint via a fixpoint over summaries (#712) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/735
• feat(csharp): unify partial-class parts for member and base resolution by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/732
• feat(io): READS_FROM/WRITES_TO for JavaScript/TypeScript I/O sinks (#714) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/736
• feat(io): process.env.X environment reads for JavaScript/TypeScript (#714) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/739
• feat(evals): C# L1 structure oracle (Roslyn syntax) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/737
• feat(flow): straight-line FLOWS_TO taint for JavaScript/TypeScript (#714) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/740
• feat(io): recognize destructured and node:-scheme builtin imports for JS/TS (#714) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/741
• fix(csharp): start line skips leading #if-wrapped attribute directive by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/742
• fix(csharp): drop reserved-keyword parse-recovery artifacts as function nodes by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/745
• feat(io): READS_FROM/WRITES_TO for Go I/O sinks (#714) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/744
• fix(evals): parse all #if branches in C# oracle to match cgr's no-preprocessor view by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/746
• feat(io): FLOWS_TO taint edges for Go (#714) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/747
• feat(io): path-sensitive FLOWS_TO taint for JS/TS (#714) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/749
• fix(csharp): recover #if-truncated class members as methods, not module functions by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/748
• feat(io): direct READS_FROM/WRITES_TO sinks for Java (#714) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/750
• fix(evals): build rust oracle binary once and exec directly to end cargo-run link race by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/751
• feat(io): direct READS_FROM/WRITES_TO sinks for Rust (#714) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/752
• feat(io): direct READS_FROM/WRITES_TO sinks for C++ (#714) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/753
• test(flow): cover Java FLOWS_TO edges (#714) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/754
• build(deps): bump transformers from 5.3.0 to 5.5.0 in the uv group across 1 directory by @dependabot[bot] in https://github.com/vitali87/code-graph-rag/pull/743
• feat(flow): path-sensitive if-branch taint for Go and Java (#714) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/755

New Contributors

• @octo-patch made their first contribution in https://github.com/vitali87/code-graph-rag/pull/626

Full Changelog: https://github.com/vitali87/code-graph-rag/compare/v0.0.246...v0.0.345