Code-Graph-RAG Files

Highlights

• Java Taint Improvements: Enhanced taint tracking in Java, including handling JDK shims, chained call receivers, literal arguments, and type-test patterns.
• C# Taint Propagation: Improved taint propagation in C# with refinements to argument binding, tuple deconstruction, and await plumbing methods.
• Semantic Frontend Enhancements: Added in-process Jedi semantic frontend for Python and re-run semantic frontends on the watch path for more accurate analysis.
• Protocol Buffer Indexing: Introduced a canonical protobuf index with provenance manifest and a verify command for improved data integrity.
• Structural Analysis: Added structural snapshot diffs between protobuf indexes and structural ast-grep support for seven additional languages.

What's Changed

• fix(evals): probe javac/java -version so a broken JDK shim reports unavailable by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1308
• chore(ruff): add PLR0917 to ignore list alongside PLR0913 by @aoright in https://github.com/vitali87/code-graph-rag/pull/1312
• fix: ship libclang as the cpp extra and make frontend degradation actionable by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1313
• fix: sweep legacy target-resolved File identities with positive ownership attribution by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1314
• feat: model Dart Process.run and Socket.connect flows via a PROCESS ResourceKind by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1315
• feat: taint Dart handle-read bindings and listen callback parameters by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1317
• feat: persist start and name columns and rehydrate the col-keyed location indexes by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1318
• feat: re-run semantic frontends and their joins on the watch path by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1319
• feat: re-parse dependent callers of re-indexed files instead of restoring stale edges by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1320
• feat: reclaim crashed frontend build locks and load nested Go modules per module root by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1321
• feat: Scala io_access sink coverage closing the last READS_FROM/WRITES_TO language gap by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1322
• feat: hand-labelled FLOWS_TO ground-truth corpus with per-metric eval scope reporting by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1323
• feat: canonical protobuf index with provenance manifest and verify command by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1326
• feat: structural snapshot diff between canonical protobuf indexes by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1327
• feat: in-process Jedi semantic frontend for Python behind PYTHON_FRONTEND by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1328
• feat: index annotation-processor generated sources with import binding and provenance by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1329
• feat: call-relative closure-capture cell semantics in the Python flow walk by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1330
• feat: delombok overlay parses Lombok-expanded sources keyed by the original path by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1336
• feat(dead-code): report symbols in structural-tier languages as unanalyzed by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1337
• feat: Roslyn argument and binding flow facts sharpen C# taint propagation by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1338
• fix: return deterministic directory listings by @Whxuan0701 in https://github.com/vitali87/code-graph-rag/pull/1309
• fix: skip distributions whose metadata cannot be read when fingerprinting parsers by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1340
• fix: reject invalid source location ranges by @Whxuan0701 in https://github.com/vitali87/code-graph-rag/pull/1310
• fix: reject invalid code snippet spans by @Whxuan0701 in https://github.com/vitali87/code-graph-rag/pull/1311
• feat: bundled javac fact provider attributes Java call sites by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1341
• fix: type Java chained call receivers by the inner call's return type by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1343
• feat: bind Java calls through the javac facts and suppress proven-external edges by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1345
• fix: type Java literal arguments so overloads bind by argument type by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1346
• fix: type a nested Java call argument from its selected overload by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1349
• feat: emit Roslyn out and ref write-back facts so the written local carries the call's taint by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1351
• test: cover the local-function ref write-back path by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1354
• feat: prove ref writes for callee bodies in referenced projects by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1355
• feat: grade Java inheritance in the eval harness against the javac oracle by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1357
• chore: remove stale suspension note and disabled badges by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1358
• fix: treat C# await plumbing methods as taint transparent by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1360
• fix: make C++ semantic frontend setup actionable by @alloutflo in https://github.com/vitali87/code-graph-rag/pull/1198
• fix: bind C# tuple deconstruction so each name takes its own element's taint by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1361
• fix: carry taint through C# type-test patterns that bind a name by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1362
• feat: add structural ast-grep support for 7 more languages (#1352) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1359
• fix: lean-walk pass-through helpers keep their argument's taint (#1363) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1364
• fix: lock the Java oracle build so parallel test workers cannot race (#1366) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1369
• feat: Lua and Scala parameter slots complete the lean taint composition (#1365) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1375
• test: skip instead of aborting collection when an optional grammar is absent (#1371) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1376
• feat: lean-walk transitive pass-through chaining (closes [#1363]) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1377
• test: cover the expression-bodied and read-only local-function ref shapes (#1353) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1378
• docs: security guide describes the loopback bind that shipped with [#1012] (#1372) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1379
• fix(flow): emit ENV source for python os.environ subscript reads by @rekcilyssup in https://github.com/vitali87/code-graph-rag/pull/1325
• docs: explain why the newest tag runs ahead of the newest release (#1373) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1381
• test: make the Rust scan perf guard immune to runner load (#1382) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1385
• feat: make query_graph description demand verification of candidates by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1387

New Contributors

• @Whxuan0701 made their first contribution in https://github.com/vitali87/code-graph-rag/pull/1309
• @alloutflo made their first contribution in https://github.com/vitali87/code-graph-rag/pull/1198
• @rekcilyssup made their first contribution in https://github.com/vitali87/code-graph-rag/pull/1325

Full Changelog: https://github.com/vitali87/code-graph-rag/compare/v0.0.670...v0.0.720