Code-Graph-RAG Files

🔒 Security

This release contains a security fix; see advisory GHSA-6q48-6c7w-9gw2.

Upgrading is strongly recommended.

Highlights

• CodeQL: Improved handling of interface implementers and Python calls for more accurate analysis.
• Checks: Enhanced error reporting for invalid function calls and missing parameters.
• Python: Added support for inferring instance attributes from annotations.
• Tracing: Now reads gzip-compressed Xdebug traces.
• CI/Release: Updated to scan pull requests from forks and manage release labels.
• Rust: Improved handling of macro calls and workspace listings.
• General: Various fixes for import resolution, naming conflicts, and project syncing.

What's Changed

• fix(incremental): keep interface implementers of unchanged files by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3299
• fix(check): stop false too_many on unbound Python calls and *rest after a default by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/2946
• fix(check): fail on a keyword the callee rejects or a required parameter left unfilled by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/2947
• fix: infer Python instance attributes from annotations by @mvanhorn in https://github.com/vitali87/code-graph-rag/pull/3345
• build(deps): bump github/codeql-action/upload-sarif from 4.38.3 to 4.39.0 by @dependabot[bot] in https://github.com/vitali87/code-graph-rag/pull/3395
• ci(release): release a breaking change at once instead of waiting for the cadence by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3408
• fix(trace): read gzip-compressed Xdebug traces by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3409
• build(deps-dev): bump pre-commit from 4.6.2 to 4.7.0 by @dependabot[bot] in https://github.com/vitali87/code-graph-rag/pull/3405
• build(deps-dev): bump semgrep from 1.178.0 to 1.181.0 by @dependabot[bot] in https://github.com/vitali87/code-graph-rag/pull/3403
• build(deps): bump python from 51dafde to a2b82f3 by @dependabot[bot] in https://github.com/vitali87/code-graph-rag/pull/3401
• build(deps): bump astral-sh/uv from cdc6093 to 4a1f366 by @dependabot[bot] in https://github.com/vitali87/code-graph-rag/pull/3400
• build(deps): bump astral-sh/setup-uv from 10.2.0 to 10.3.0 by @dependabot[bot] in https://github.com/vitali87/code-graph-rag/pull/3399
• build(deps): bump anthropics/claude-code-action from 1.0.240 to 1.0.252 by @dependabot[bot] in https://github.com/vitali87/code-graph-rag/pull/3398
• build(deps): bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml from 2.6.0 to 2.7.0 by @dependabot[bot] in https://github.com/vitali87/code-graph-rag/pull/3397
• build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.2 by @dependabot[bot] in https://github.com/vitali87/code-graph-rag/pull/3396
• fix(agent): settle tool approvals in cgr start -a and MCP ask_agent by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/2727
• fix(rust): a turbofish call inside a macro gets its CALLS edge by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3238
• fix(incremental): re-parse the files that attach members to a re-indexed module by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3280
• fix(incremental): keep the declared namespaces of unchanged PHP files by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3297
• fix(js-ts): a default-imported class types its instances by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3233
• fix(cli): sweep the project's glosses on cgr delete-project by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3322
• fix(gloss): repair only the syncing project's unattached notes by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3319
• fix(check): skip the files a sync would not index by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3289
• fix(endpoints): a mount in a package's init.py keeps its prefix by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3263
• fix(parse): UTF-16 and UTF-32 sources with a BOM are parsed as their text by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3222
• fix(js): keep a whole-module import's IMPORTS edge on that module by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3287
• fix(calls): resolve a function used as a collection value in its enclosing scope by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3273
• fix(parsers): walk deep Rust/Go/C++ bodies iteratively and contain call-pass failures per caller by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3269
• fix(rust): a workspace listing its root package as "." indexes on Python 3.12 by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3268
• fix(io): a same-origin URL is a resource of the project that requests it by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3262
• fix(traceback): analyse every ExceptionGroup member, beside the group's stack by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3321
• fix(mcp): answer out-of-range input and unknown symbols in the tools' own words by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3315
• fix(check): a caller that dropped its call with the callee is not dangling by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3314
• fix(rename): refuse a Go method that satisfies an in-project interface by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3305
• fix(dart): resolve imports of the project's own package to its modules by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3291
• fix(check): report importers of a deleted or moved module by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3285
• fix(endpoints): gorilla/mux routes take their verb from the .Methods chain by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3265
• fix(sync): start every reingest from empty Python inference caches by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/2977
• fix(check): --isolated refuses only over IO links the checked project anchors by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3258
• fix(mcp): endpoint_callers resolves its target and refuses one naming no endpoint by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3255
• ci: switch CodeQL to advanced setup so pull requests from forks are scanned by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3394
• build(deps): bump certifi from 2026.7.22 to 2026.10.19 in the uv group across 1 directory by @dependabot[bot] in https://github.com/vitali87/code-graph-rag/pull/3416
• ci(release): maintainer-only "release now" label, and cancel superseded bump runs by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3417
• fix(ci): turn off gRPC fork handlers in tests and patch virtualenv by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3421

New Contributors

• @mvanhorn made their first contribution in https://github.com/vitali87/code-graph-rag/pull/3345

Full Changelog: https://github.com/vitali87/code-graph-rag/compare/v0.2.10...v0.2.16