Code-Graph-RAG Files

🔒 Security

Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early (high severity, CVSS 7.5), dependency advisory GHSA-6fqq-452j-qhrp / CVE-2026-107286.

Upgrading is strongly recommended.

Highlights

• Type Handling: Improved handling of type context managers, walrus operators, and match binding targets in both Python and TypeScript.
• Rename Refinement: Prevented Go renames from unexporting names used by other packages.
• Profile Naming: Corrected the naming of pprof profiles to avoid "malformed" errors when no samples are present.
• Output Budget: Increased the Anthropic output budget to improve the default thinking experience.
• Module Resolution: Resolved issues with module resolution in various scenarios, including ES module default imports and bare name bindings.
• Dead Code Elimination: Removed dead code roots associated with IPython rich-display methods.
• Incremental Refresh: Improved incremental refresh to ensure callers are updated when dispatch targets change.

What's Changed

• fix(py): type contextmanager, walrus and match binding targets by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3585
• fix(py): type contextmanager, walrus and match binding targets by @AdityaxDeore in https://github.com/vitali87/code-graph-rag/pull/3528
• fix(java): calls on an enum constant or a new expression resolve by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3125
• fix(trace): name a pprof profile with no samples instead of calling it malformed by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3040
• fix(rename): refuse a Go rename that unexports a name another package uses by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3093
• fix(dead-code): a pub trait's methods are exported by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/2950
• docs(trace): pass the JVM agent to Maven tests through Surefire's argLine by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3057
• fix(incremental): refresh callers when dispatch targets change by @AdityaxDeore in https://github.com/vitali87/code-graph-rag/pull/3527
• fix(schema): Resource declares the project its ENDPOINT kind carries by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3120
• fix(findings): str.format() queries and os.system f-strings are injection by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3077
• fix(providers): raise the Anthropic output budget so default thinking fits by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/2980
• fix(python): bind a bare name to no function its module cannot see by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/2968
• fix(ts): bind a method called on a free function's result by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/2962
• fix(csharp): a call on an as-cast receiver binds the cast's type by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/2960
• fix(dead-code): IPython rich-display methods are dead-code roots by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/2956
• fix(dart): locate call sites at the callee so rename can rewrite them by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/2782
• fix(js-ts): resolve a call through an ES-module default import to the default export by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/2743
• build(deps-dev): bump pytest from 9.1.1 to 9.2.0 by @dependabot[bot] in https://github.com/vitali87/code-graph-rag/pull/3549
• build(deps): bump pyo3 in /rust/cgr_graph_rs by @dependabot[bot] in https://github.com/vitali87/code-graph-rag/pull/3554
• chore(deps): bump the codeql-action group with 3 updates by @dependabot[bot] in https://github.com/vitali87/code-graph-rag/pull/3586
• feat(move): graph-aware move of a module-level definition (#1534) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/2907
• chore(deps-dev): bump ruff from 0.17.3 to 0.17.4 by @dependabot[bot] in https://github.com/vitali87/code-graph-rag/pull/3595
• chore(deps): bump jsonschema from 4.25.1 to 4.26.0 by @dependabot[bot] in https://github.com/vitali87/code-graph-rag/pull/3594
• chore(deps): bump astral-sh/uv from 0.13.6 to 0.13.7 by @dependabot[bot] in https://github.com/vitali87/code-graph-rag/pull/3591
• chore(deps): bump docker/login-action from 4.7.0 to 4.8.0 by @dependabot[bot] in https://github.com/vitali87/code-graph-rag/pull/3587
• fix(calls): type a field hop where the field is declared by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3292
• fix(incremental): keep Go result types and package clauses of unchanged files by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3281
• fix(ts): read tsconfig as JSONC without eating "@/*" and "/ts" by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3229
• fix(incremental): requeued annotations keep the types they already resolved to by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3218
• fix(rust): type a local from a helper reached through an inline module or module path by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3010
• fix(python): follow a star re-export to type a receiver by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/2989

Full Changelog: https://github.com/vitali87/code-graph-rag/compare/v0.6.0...v0.6.30