v0.3.4 (VS Code extension) + py-1.0.10 (Python CLI) — 3-round audit
Combined release. Same parser fixes ship in both the VS Code extension and the Python CLI.
Product of three consecutive audit rounds:
- Round 1 — security-reviewer + python-reviewer + silent-failure-hunter
- Round 2 — typescript-reviewer + performance-optimizer
- Round 3 — type-design-analyzer + django-reviewer
Added
on_delete=models.SET(default_value)callable form is now recognised — previously the CASCADE-style regex silently dropped it; parser now returns "SET" so consumers know the field has a dynamic on_delete rather than treating it as absent.
Security
- ReDoS clamp on class-indent detection: crafted models.py with absurd leading whitespace could previously build patterns like \s{20000,} and trigger catastrophic backtracking. Indent width now clamped to 32 and tabs expanded to width 4. Also fixes the latent bug where tab-indented codebases silently failed to parse Meta blocks.
Fixed
- Workspace scan no longer aborts on a single broken models.py — Python and TypeScript now catch parse errors separately from read errors and continue scanning; parse errors log a per-file warning to stderr / dev-tools console.
- Multi-line class header parser no longer near-loops on malformed signatures — returns (None, end_index) so caller advances past the section instead of re-evaluating every continuation line.
- _read_balanced_args guards against missing "(" — prevents ValueError from propagating up and aborting the whole scan.
- Message handler disposable leak in the ER-diagram webview — handler now scoped to panel.onDidDispose instead of context.subscriptions, so close/reopen cycles no longer accumulate dead listeners.
- Watcher listener leak on autoRefresh config change — three onDidChange/Create/Delete listeners no longer persist forever in context.subscriptions. Same pass adds a second watcher for **/models/*.py so split-module Django apps auto-refresh on save.
- Model-name collision in filtered tree — two models sharing a name in different apps now resolve to distinct children (identity extended from label+kind to label+kind+filePath).
Full details in CHANGELOG.md.
Full Changelog: v0.3.3...v0.3.4