v1.4.0

[1.4.0] — 2026-10-22

• Update rustls-webpki to 0.103.16 and webpki-roots to 1.0.10 to reject
  distrusted certificate paths (RUSTSEC-2026-0382 and RUSTSEC-2026-0381).
• Keep typed receiver bindings scoped to their function or block; parse annotated
  locals correctly and resolve exact TypeScript path aliases.
• Refresh graphs across complete merge/fast-forward ranges and all changed graph inputs.
• Report ambiguous explicit seeds with candidate IDs and locations through CLI/MCP,
  retaining complete structured candidates while bounding rendered context.
• Redact credential-shaped source text before retention and semantic requests;
  exclude credential literals from reference identities.
• Discover extensionless scripts from bounded shebang reads, including versioned
  interpreters, with shared parser and cache selection.
• Extract Kotlin aliases, C# delegates, Dart typedefs, and Swift macros; resolve
  uniquely supported type references and macro calls without speculative stubs.
• Infer instance fields from unambiguous assignments, rejecting conflicting,
  computed-unknown, deleted, static, or shadowed bindings. Preserve punctuation-sensitive
  symbol identity and exact member spelling.
• Preserve multiple relationship labels in the viewer's neighbor panel.
• Record semantic processed/total chunk coverage and incomplete reasons in diagnose;
  incomplete enrichment still fails without publishing or caching partial results.

What's Changed

• release: 1.4.0 - graph correctness, coverage, and diagnostics by @erictong0602 in #157

Full Changelog: v1.3.0...v1.4.0