Release v3.18.4 · cdeust/Cortex

fix(graph): use _node_order length for bounded-discard cursor
fix(setup): per-user DATABASE_URL config + three-way DB diagnostics (#58)
fix(sec): resolve CodeQL CWE-22 path-injection (#90,#86) and weak-hash (#84) (#57)
chore(deps): bump the uv group across 1 directory with 2 updates (#56)
refactor(ingestion): prune vendored dirs in source walk (no rglob descent) (#55)
feat(marketplace): list zetetic-team-subagents alongside cortex (#54)
fix(ci+sec): idempotent relationship upsert, I2 line drift, inline CWE-22 sanitisers (#53)
Release 3.18.4
fix(ingest): stop writing symbol memory rows — entities only, cap at 50k symbols
fix(ci): catch LocalEntryNotFoundError for HF cache miss on newer huggingface_hub
fix(ci): ruff format the repo green + exclude transient agent worktrees
release(3.18.4): progressive graph build, any-file git diff/AST, self-healing AP bridge
fix(ap): self-healing MCP bridge — kill the handshake flakiness root causes
fix(viz+sec): legend counts rendered graph; CodeQL path-injection sanitisers; drop dead lod.js
fix(ingest): prune precedent code-graphs on re-index ("update a version → remove the precedent")
fix(viz): legend counts the RENDERED graph, not server meta (fixes 0-discussions + mismatch)
fix(viz): AP impact diagram — normalize absolute paths to AP's repo-relative File.id
fix(viz): progressive graph build — bounded memory, keyset streaming, no migration storm

What's Changed

fix(ci+sec): idempotent relationship upsert, I2 line drift, inline CWE-22 sanitisers by @cdeust in #53
feat(marketplace): list zetetic-team-subagents alongside cortex by @cdeust in #54
refactor(ingestion): prune vendored dirs in source walk (no rglob descent) by @cdeust in #55
chore(deps): bump the uv group across 1 directory with 2 updates by @dependabot[bot] in #56
fix(sec): resolve CodeQL CWE-22 path-injection (#90,#86) and weak-hash (#84) by @cdeust in #57
fix(setup): per-user DATABASE_URL config + three-way DB diagnostics by @cdeust in #58

Full Changelog: v3.18.3...v3.18.4