v3.17.0

A wide correctness sweep across virtual-dispatch resolution, Dart support, and incremental builds. CHA/virtual-dispatch resolution gets over a dozen fixes closing collision and missed-edge cases around super(), receiver-typed dispatch, and cross-file same-named classes/functions; codegraph info now nudges you toward --no-incremental when an interface gains its first instantiated implementor after an incremental build. Dart gains full dataflow tracking (local variables, arrow-body implicit returns, grouped parameters) alongside extraction fixes for bare calls and bodyless members. Complexity/Halstead metrics now cover Julia, Solidity, R, Groovy, Zig, Objective-C, and CUDA, closing out the per-language rollout started in 3.16.0. Incremental/watch-mode builds gain several correctness fixes (barrel renames, tsconfig/jsconfig aliases, points-to confidence, return-type and invoked-property evidence) that previously required a full rebuild to pick up, and the roles/exports classifiers get sharper about Python entrypoints, declarative-only languages, and top-level-call consumers. Also included: .codegraphrc.json/--db config resolution no longer gets pinned to the invoking directory across a long tail of remaining call sites, several transitive dependency vulnerabilities are patched, and a batch of hooks/CI/skills reliability fixes for the project's own Claude Code tooling.

Bug Fixes

• cha: stop CHA/virtual-dispatch resolution from matching a coincidentally same-named local function or an unrelated same-named class across super() calls, scope the implementor map per file while walking ancestors for inherited methods, exclude super-dispatch edges from sibling expansion, include the receiver's own instantiated type and RTA evidence from new expressions, make native typed-receiver dispatch additive instead of a last-resort fallback, revisit sibling-implementor callers during the incremental CHA post-pass, seed object-rest-param type annotations for dispatch, scope same-named locals/params by their enclosing function so dispatch collisions can't cross function boundaries, tag super-dispatch edges distinctly in the WASM/JS inline path, and confirm concrete-receiver bare-name matches via type-aware dispatch; codegraph info nudges codegraph build --no-incremental when an interface gains its first instantiated implementor since the last full build (#2404, #2403, #2400, #2399, #2494, #2493, #2349, #2314, #2317, #2398, #2208, #2236, #2227, #2473)
• resolver: seed the typeMap from as-casts and a missing factory-method heuristic, resolve JSX elements and call-argument identifiers as references, stop .bind()/.call()/.apply() on an inline function from embedding its source as the receiver, remap .mjs/.cjs specifiers to .mts/.cts sources, resolve workspace exports-field targets without bypassing a node_modules symlink, give computed dispatch-table access and this-bound EventEmitter callback registrations real invocation evidence, resolve logical-or/ternary function fallbacks to a real calls edge, resolve Python module imports to files and aliased module calls, prevent resolveThisDispatch from matching an unrelated same-named class in another file, respect this-binding scope boundaries and distinguish static from instance accessors in same-file call attribution, and qualify object literals returned from factory functions (#2534, #2533, #2529, #2479, #2465, #2457, #2445, #2444, #2432, #2410, #2291, #2323, #2322, #2263)
• native/rust: port package.json exports-field resolution to the native engine, resolve crate::/self::/super:: module paths (including via a Cargo.toml target-path override), resolve if-let-bound method calls to cross-file Option/Result return types, remove a dead same-file suffix-scan fallback from resolveByGlobal, stop dropping dotfile-named source files and fix an undercounted build summary, and propagate a file_hashes read failure instead of silently reporting no prior state (#2289, #2215, #2376, #2371, #2209, #2532, #2541)
• extractors: recognize array-pattern CJS require() destructures and extract their rest bindings on the WASM/TS engine, extract rest/default bindings from destructured const declarations, mark destructured const export bindings as exported, preserve the barrel-renamed declared name for CJS require() imports, strip quotes from plain quoted method/property keys, match the export line to the declaration instead of the export keyword, recognize cross-file ES6 getter/setter accessor reads, resolve a same-line decorator upgrade gap in call dedup, and fix var-shadowing at a function boundary so loop heads no longer kill the fallback value (#2268, #2269, #2277, #2294, #2296, #2183, #2460, #2252, #2248, #2440)
• dart: port Dart's dataflow rules to the native Rust engine, track local variable declarations and calls, record an implicit return for arrow-body functions, give every name in a grouped-parameter wrapper the same paramIndex, populate the typeMap for field/parameter types, extract bare calls, fix endLine truncation and bodyless-member handling, and keep function scope active through Dart's sibling body (#2503, #2499, #2498, #2502, #2477, #2320, #2360)
• complexity: add cognitive/cyclomatic/Halstead rules for Julia, Solidity, R, Groovy, Zig, Objective-C, and CUDA; correct switch/case complexity shadowing and comment-prefix undercounting, skip complexity/CFG for bodyless WASM functions and bodyless Rust trait methods, track complexity for anonymous Lua function-expression assignments, and show max cyclomatic complexity in the text summary (#2472, #2313, #2281, #2233, #2202, #2286, #2284, #2282, #2264, #2523)
• ast-analysis: stop misattributing complexity/CFG across same-line anonymous functions, track block-comment state in LOC comment detection, and stop requiring a multi-line span for hasFuncBody (#2446, #2456, #2452)
• roles: recognize pyproject.toml console-script and Python __main__ entrypoints, persist Python entrypoint evidence so attribution survives rebuilds, stop emitting dead-* verdicts for declarative-only languages, apply the reachability downgrade to incremental classification, stop double-counting dead symbols in the roles map, detect transitively-unreachable dead code instead of just fanIn===0, and distinguish zero role matches from an unbuilt graph in roles --role (#2535, #2411, #2434, #2525, #2423, #2522, #2258, #2531)
• exports: stop top-level-call consumer entries from masquerading as a named caller, correct the consumer discriminator's misclassification of top-level calls, discriminate file-level from symbol-level consumers, add id-based join fields to file-level exportJSON edges, honor --functions for the json and graphson export formats, and clear stale deleted-export advisories on full builds, not just incremental (#2506, #2364, #2188, #2342, #2141, #2278)
• incremental/watch: refresh package.json exports/workspace caches in watch mode, don't purge a file from the graph when its rebuild fails, thread real tsconfig/jsconfig aliases and the known-files list into watch-mode resolution, treat an empty file_hashes table as a from-scratch build, persist barrel rename pairs, per-file return-type evidence, and invoked-property-name evidence across builds, upgrade points-to edges to direct confidence and thread the configured pointsToMaxIterations through the watch-mode points-to map, populate qualified_name/scope/visibility/content_hash/exported on watch-mode rebuilds, thread renamed barrel exports through to the native FFI, give reverse-dependency edge reconnection a content-hash identity signal, align CHA/pts technique labels across engines, and mirror Kotlin-reflection/reflection-keyExpr call fallbacks (#2458, #2443, #2402, #2372, #2414, #2241, #2340, #2325, #2316, #2308, #2380, #2401, #2221, #2246, #2206, #2405, #2538, #2207)
• db/config: derive rootDir correctly for a non-conventional --db file path, resolve display config from customDbPath instead of process.cwd(), derive config from the target dir/--db instead of a cwd-pinned singleton across the remaining call sites, apply the configured busy_timeout to remaining raw new Database() call sites, stop pragma() from crashing on a non-TEXT PRAGMA result, add a missing index on dataflow.call_edge_id, back edges' INSERT OR IGNORE with a real content-uniqueness index, and mirror the JS edges.dynamic_kind migration in Rust's init_schema (#2394, #2393, #2338, #2223, #2226, #2225, #2203, #2298, #2210)
• deps: pin typescript below 7.x with a loud warning on an incompatible version, override transitive adm-zip/sharp to patched versions, resolve transitive fast-uri/hono/ip-address vulnerabilities, and bump remaining transitive deps to resolve a high-severity npm audit failure (#2332, #2513, #2267, #2156)
• hooks: fix guard-git.sh's branch validation to use the real push target instead of the hook's own cwd, stop its checkout -- block from false-positiving on flags, stop its clean guard from blocking dry-run and matching raw substrings, surface build failures in update-graph.sh instead of silently no-oping (including its template and fallback path), scope its rebuilds to the edited file's own project, and point post-git-ops.sh's fallback at dist/cli.js instead of src/cli.js (#2527, #2450, #2329, #2303, #2466, #2337, #2192)
• ci: verify the comment author before updating/deleting the impact comment, fail open when detect-changes is cancelled instead of only on failure, pin GitHub Actions to commit SHAs instead of mutable version tags, add a non-blocking reminder for non-closing issue references in PRs, and anchor native-change detection to package.json's version instead of the latest tag (#2496, #2307, #2350, #2351, #2128)
• skills: harden /fixer, /sweep, and /housekeep — a moved queue head in step 2g, a blocked label auto-create, state.json/queue.json write ordering, crash-resume post-merge CI reconciliation, semantic verification on the reviewer-feedback gate, a self-gated outcome, dynamic repo-slug/SSH-remote detection replacing hardcoded values, macOS-safe mktemp templates, zsh-safe loops, Greptile reaction/convergence recognition and a raised re-trigger cap, squash-merge-aware branch pruning, and rate-limit handling for subagent notifications (#2486, #2504, #2467, #2480, #2416, #2395, #2345, #2343, #2362, #2361, #2185, #2195, #2180, #2171, #2169, #2311, #2231, #2253, #2490, #2469)
• rust: recover from a poisoned glob_cache mutex instead of a silent no-op, dedupe leiden bounds-check reads via fgetOrZero/igetOrZero, and resolve clippy warnings ahead of gating clippy in CI (#2328, #2211, #2484)
• tracer: exclude anonymous-class/closure bodies from the JVM tracer's traceCall() injection, exclude control-flow keywords from the same injection, fix C/C++ tracer source-file attribution via sed injection, and use a POSIX [[:space:]] regex in the Go tracer's BSD-sed-compatible main() matcher (#2449, #2273, #2276, #2274)
• misc: sort each Tarjan SCC's node array for deterministic cycle order, skip interface methods in PHP's native handle_method_decl, widen CommandContext.outputResult's data param from any to object, sort query-path definitions by line to match walk/native order, set endLine on Python module-level constant definitions, recognize .mts/.cts as TypeScript in both engines, tag literal-key bracket-index Lua calls as computed-literal, recurse .codegraph/* gitignore rules into nested test-fixture directories, recognize test/fixture directories and per-language conventions in -T, ignore the Rust target/ build directory during file collection, and distinguish "file not found" from "file has zero functions" in codegraph audit (#2292, #2283, #2275, #2239, #2247, #2300, #2271, #2427, #2424, #2511, #2142)

Performance

• builder: dedupe import edges within a file before batch insert, and cache prepared statements in change-detection (fixing a WASM detectMs regression) and in the technique-backfill chunk loop (#2463, #2234, #2204)

Refactors

• builder: consolidate barrel-trace-with-fallback duplicates onto a single traceBarrelTarget (#2462)

Chores

• skills: add the /fixer skill for end-to-end issue resolution, run housekeep after each batch, stop concurrent agents from colliding over git branches, and remove dead maxCyclomatic/maxBlastRadius fields from CheckCliOpts (#2158, #2228, #2230, #2205)
• rust: adopt cargo fmt as a CI gate (#2327)
• ci: auto-bump recall floors after stable releases, and apply the KNOWN_REGRESSIONS baseline fallback to the release publish gate, not just dev (#2168, #2129)
• bench: only set CODEGRAPH_ENGINE for actual engine-comparison forks, and prune stale 3.15.0 KNOWN_REGRESSIONS entries (#2341, #2318)
• scripts: consolidate duplicated .js/.ts resolve-loader implementations (#2219)
• deps: bump actions/checkout (6.1.0→7.0.1→7), actions/setup-python/actions/setup-node/actions/setup-go to 7, actions/download-artifact/actions/upload-artifact to 8.0.1/7.0.1, anthropics/claude-code-action (1.0.171→1.0.191 across several bumps), @biomejs/biome (2.5.3→2.5.8 across several bumps), better-sqlite3 (12.11.1→13.0.3 across several bumps), @types/better-sqlite3 to 9.6.0, tree-sitter-cli/web-tree-sitter (0.26.10→0.26.12), commit-and-tag-version (12.7.3→13.1.2), tree-sitter-gleam, smol-toml to 1.8.0, and js-yaml to 4.3.1 (#2516, #2514, #2520, #2519, #2518, #2517, #2515, #2429, #2355, #2354, #2353, #2335, #2334, #2333, #2197, #2200, #2199, #2198, #2196, #2155, #2154, #2153, #2152, #2151, #2122, #2123, #2124, #2126, #2120, #2125, #2121, #2119)