v0.11.2

cgg 0.11.2

v0.11.1

cgg 0.11.1 — cross-language correctness: wrong high edges, missing ed…

v0.11.0

cgg 0.11.0 — cross-language resolution, calibrated confidence with th…

v0.10.2

cgg 0.10.2 — Rust resolution and dead-code accuracy (bugfix)

v0.10.1

cgg 0.10.1 — --locations (#10), mermaid/GraphML label escaping

v0.10.0

cgg 0.10.0 — overload and clause binding, C/C++/ObjC cross-language, …

v0.9.1

cgg 0.9.1 — audit keeps records for chained calls

v0.9.0

cgg 0.9.0 — Kivy KV, typed C++ resolution, Python inheritance fan-out

v0.8.5

v0.8.5 — security fixes and the npm loader repair

Two findings from a security review done for a downstream third-party
import, both confirmed on the released 0.8.4 binary before anything was
changed, plus a broken npm release found on the way.

- Unbounded recursive descent. Every language plugin walked its syntax
  tree recursively with nothing bounding the depth, and the rayon worker
  stack was the 2 MiB default. Input as ordinary as a 3,000-term
  `a + b + c` expression, a fluent call chain, an if/else-if ladder or a
  deep literal overflowed it. A stack overflow is not a panic, so the
  catch_unwind in the C ABI and the Python and Node modules could not
  turn it into an error — the process died, and took any embedding host
  with it. Reproduced in 18 languages plus the JSON/YAML descriptors.
  analyze now runs on a 128 MiB host thread with matching pool workers,
  extraction is gated on the iterative cgg_lang::exceeds_depth against
  MAX_TREE_DEPTH (4,000 levels; deeper is skipped as `too-deep` and
  counted), and the -n 0 path DFS caps at 100,000. Affected every
  release through 0.8.4.

- `--since` executed code from the analyzed repository. It shells out to
  git inside the tree being analyzed, and git runs what that tree's
  config names: a core.fsmonitor command and a diff.<driver>.command
  routed by .gitattributes both executed on a plain `git diff`, verified
  on 0.8.4. The revspec was also passed bare, so `--since=--output=PATH`
  made git write that file. Git is now invoked with
  `-c core.fsmonitor=false --no-ext-diff --no-textconv` and
  `--end-of-options` before the revspec. Affected every release with
  --since.

- The 0.8.4 npm root package could not be loaded. index.js is generated
  by napi build and hardcodes the platform-package version it accepts;
  it was last regenerated at 0.8.3, so the published 0.8.4 tarball
  demanded 0.8.3 bindings in 27 places while its platform packages
  shipped 0.8.4. index.js and index.d.ts are regenerated here, and
  docs-check check 13 now fails any commit where the embedded version
  and package.json disagree. npm only; the CLI, crates, wheel and C ABI
  were unaffected.

Default graph unchanged. Memory safety verified clean under ASAN
(44 grammars, 315 malformed inputs, 145 corpus repos) and Valgrind.

v0.8.4

cgg 0.8.4

Resolver precision: no bare-name fan-out at bound, private or external
sites (PR #4). Graph document schema cgg.graph.v2 — v1 still readable.
--skip-minified (opt-in). Auto --jobs cap widens to 32 on hosts with
32+ physical cores. Dead-code baseline and git-environment fixes.

Full notes: CHANGELOG.md