v0.0.345

Highlights

• Security: Addresses a critical path traversal vulnerability in the MCP read_file tool. Upgrade is recommended for users of cgr mcp-server.
• C++ Frontend: Introduces hybrid frontend layering, combining libclang macros and includes with tree-sitter.
• Rust Support: Provides full support for the Rust language, including type dyn and impl Trait receivers.
• C# Support: Adds initial support for the C# language, covering definitions, imports, and calls.
• Dart/Flutter Support: Adds support for the Dart and Flutter languages.
• Flow Analysis: Enhances flow analysis with path-sensitive taint tracking for JavaScript/TypeScript and Go, and introduces MAY taint analysis.
• IO Enhancements: Improves the recognition and handling of various I/O mechanisms in JavaScript/TypeScript, Go, and Java.

🔒 Security

Fixes a path traversal / arbitrary file read (High, CVSS 7.5) in the MCP read_file tool's paginated branch — advisory GHSA-vvr2-h2jp-838m. An absolute or ../ file_path combined with offset/limit could escape the project root. Upgrade if you run cgr mcp-server.

First PyPI release since v0.0.246; this consolidates all changes below.

What's Changed

• fix(ci): build darwin-amd64 binary on macos-15-intel runner by @vitali87 in #644
• ci: bump astral-sh/setup-uv from v4 to v8.3.1 to drop deprecated Node 20 by @vitali87 in #643
• fix(parsers): key query cache by Language object to prevent id reuse collisions by @vitali87 in #645
• feat(graph): structural integrity audit validating graphs against documented schema by @vitali87 in #648
• test(integration): pin Memgraph integration tests to one xdist worker via loadgroup by @vitali87 in #649
• fix(js): reference new-expression constructor callbacks and nested arrow-const caller qns by @vitali87 in #651
• fix(js): nest class-method closures and reference callbacks inside unowned arrows by @vitali87 in #653
• docs: document dead-code detection (README, PyPI, guide) by @vitali87 in #654
• fix(cpp): eliminate all 289 souffle orphan nodes via deferred registry-verified containment by @vitali87 in #655
• fix(go): resolve inline field-hop calls and build-variant package siblings by @vitali87 in #656
• fix(java): link new-expression to constructor and class instantiation by @vitali87 in #658
• fix(cpp): resolve includes against real files and unify name resolution across passes by @vitali87 in #657
• fix(java): root serialization hooks so reflectively-invoked methods are reachable by @vitali87 in #659
• fix(java): resolve nested-class type names referenced by simple name within a file by @vitali87 in #660
• fix(cpp): eliminate remaining dangling edges via pass-2 location reuse and deferred INHERITS resolution by @vitali87 in #663
• fix(java): anonymous-class override dispatch (OVERRIDES edges + lexical-scope calls) by @vitali87 in #662
• fix(java): cast-expression receivers and anonymous-class own-method calls by @vitali87 in #664
• fix(audit): enforce zero dangling relationships across all language fixtures by @vitali87 in #665
• fix(java): externalize implicit java.lang bases onto ExternalModule nodes by @vitali87 in #666
• fix(js-ts): reference functions consumed via casts, currying, member assignment, call args, param defaults, and shorthand methods by @vitali87 in #667
• fix(evals): restore all eight language oracles to 1.0 on thrift after the dangling-edge campaign by @vitali87 in #669
• fix(py,ts): click and zustand dead-code residuals plus same-line and overload-variant caller attribution by @vitali87 in #668
• fix(js): express dead-code residuals via named fn-expr references, member-call precision, twin fan-out, var-require imports, and test dir exclusion by @vitali87 in #670
• feat(cpp-frontend): emit IMPORTS edges for within-repo includes by @vitali87 in #671
• feat: register C/C++ and Rust macro definitions as Function nodes with resolvable invocations by @vitali87 in #672
• test(cpp): address codecov and sonar reports from #672 (macro guard coverage, complexity) by @vitali87 in #673
• feat(go): promote Go to fully supported by @vitali87 in #674
• fix(resolver): keep the static interface-method edge on sole-impl dispatch by @vitali87 in #676
• fix(js): unify duplicate function nodes via span claims and deferred anonymous registration by @vitali87 in #675
• fix(deps): patched grammar forks for comment-in-define declaration drop by @vitali87 in #678
• fix: emit OVERRIDES edges for interface and trait implementations by @vitali87 in #677
• refactor(constants): split constants.py into themed submodules by @vitali87 in #680
• fix(rust): type dyn and impl Trait receivers to their trait for call resolution by @vitali87 in #679
• fix(rust): type free-function factory results from recorded return types by @vitali87 in #681
• feat(cpp): hybrid frontend layering libclang macros and includes onto tree-sitter by @vitali87 in #682
• fix(deadcode): compute reachability client-side to remove per-root BFS query timeout by @vitali87 in #683
• fix(parsers): link returned closures to every duplicate-QN twin by @vitali87 in #684
• fix(parsers): reference first-party functions passed to unnamed callees by @vitali87 in #685
• fix(parsers): reference ternary-assigned and returned method values in python by @vitali87 in #686
• fix(parsers): resolve this-calls in js prototype methods to sibling methods by @vitali87 in #687
• fix(parsers): resolve package-attribute bases through star re-exports by @vitali87 in #688
• feat(cli): flag and settings to skip the semantic embedding pass by @vitali87 in #691
• fix(embedder): drain mps command buffers after each embedding batch by @vitali87 in #692
• fix(deadcode): treat methods of factory-built classes as dispatch roots by @vitali87 in #693
• fix(parsers): treat top-level browser-script symbols as page-global roots by @vitali87 in #694
• fix(parsers): link sibling-mixin shadow methods with OVERRIDES edges by @vitali87 in #695
• fix(parsers): reference first-class function values inside containers and class bodies by @vitali87 in #696
• fix(deadcode): treat python enum protocol hooks as reachability roots by @vitali87 in #697
• feat(sync): warn when incremental sync runs against a graph built by a different parser by @vitali87 in #698
• fix(deadcode): root property-family accessors invoked by attribute syntax by @vitali87 in #699
• fix(parsers): prefix absolute imports when the top-level package shares the repo name by @vitali87 in #700
• fix(parsers): unwrap bind, call, and apply to reference the underlying function by @vitali87 in #701
• fix(deadcode): strip the duplicate-qn marker before name-scoped root rules by @vitali87 in #703
• test(cpp): pin module attribution for macros used only in evaluated directives by @vitali87 in #704
• fix(cpp): recover whole-file parse collapse from unbalanced preprocessor branches by @vitali87 in #702
• feat(parsers): extract access modifiers and decorators via highlights.scm by @ChetanyaRathi in #566
• feat: selective relationship capture with READS_FROM/WRITES_TO I/O edges by @vitali87 in #638
• fix(cpp): reject reserved-keyword definition names and bind operators by operand type by @vitali87 in #709
• feat(flow): add opt-in FLOWS_TO data-flow edges for intra-procedural taint by @vitali87 in #707
• fix(python): factory-return chain inference and AST cache reload on eviction by @vitali87 in #706
• feat(cpp): hybrid type aliases, post-expansion CALLS, and HYBRID as default frontend by @vitali87 in #708
• feat: add MiniMax provider by @octo-patch in #626
• fix(io): scope-correct I/O attribution and direct-return FLOWS_TO edges by @vitali87 in #710
• test(parsers): spike tags.scm definition cross-validation (#524) by @vitali87 in #717
• feat(csharp): tree-sitter C# support for definitions, imports, and calls (Phase 1 of #102) by @vitali87 in #716
• fix(parsers): load community tags.scm as the cross-validation oracle (#524) by @vitali87 in #718
• feat(io): improve I/O and data-flow edge recall by @vitali87 in #715
• feat(csharp): INHERITS, IMPLEMENTS and OVERRIDES (Phase 2 of 4, #102) by @vitali87 in #719
• feat(parsers): cross-validate reference.call sites against cgr (#524) by @vitali87 in #721
• feat(csharp): typed call resolution (Phase 3 of 4, #102) by @vitali87 in #720
• fix: preserve parallel FLOWS_TO provenance edges under MERGE (#722) by @vitali87 in #724
• feat(csharp): dead-code, exports, stdlib -> Fully Supported (Phase 4 of 4, #102) by @vitali87 in #726
• fix(resolver): scope registry rehydrate to the indexed project (#711) by @vitali87 in #727
• chore(parsers): remove unused tags.scm cross-validation code by @vitali87 in #729
• feat(io): recognize httpx/aiohttp and pathlib.Path I/O in the registry (#723) by @vitali87 in #730
• feat: add Dart/Flutter language support (#140) by @vitali87 in #733
• feat(csharp): bind extension-method calls to their static definition by @vitali87 in #731
• feat(csharp): register operators, conversion operators, and finalizers as member nodes by @vitali87 in #728
• feat(flow): path-sensitive MAY taint analysis for FLOWS_TO (#713) by @vitali87 in #734
• feat(flow): resolve forward/cross-file return-taint via a fixpoint over summaries (#712) by @vitali87 in #735
• feat(csharp): unify partial-class parts for member and base resolution by @vitali87 in #732
• feat(io): READS_FROM/WRITES_TO for JavaScript/TypeScript I/O sinks (#714) by @vitali87 in #736
• feat(io): process.env.X environment reads for JavaScript/TypeScript (#714) by @vitali87 in #739
• feat(evals): C# L1 structure oracle (Roslyn syntax) by @vitali87 in #737
• feat(flow): straight-line FLOWS_TO taint for JavaScript/TypeScript (#714) by @vitali87 in #740
• feat(io): recognize destructured and node:-scheme builtin imports for JS/TS (#714) by @vitali87 in #741
• fix(csharp): start line skips leading #if-wrapped attribute directive by @vitali87 in #742
• fix(csharp): drop reserved-keyword parse-recovery artifacts as function nodes by @vitali87 in #745
• feat(io): READS_FROM/WRITES_TO for Go I/O sinks (#714) by @vitali87 in #744
• fix(evals): parse all #if branches in C# oracle to match cgr's no-preprocessor view by @vitali87 in #746
• feat(io): FLOWS_TO taint edges for Go (#714) by @vitali87 in #747
• feat(io): path-sensitive FLOWS_TO taint for JS/TS (#714) by @vitali87 in #749
• fix(csharp): recover #if-truncated class members as methods, not module functions by @vitali87 in #748
• feat(io): direct READS_FROM/WRITES_TO sinks for Java (#714) by @vitali87 in #750
• fix(evals): build rust oracle binary once and exec directly to end cargo-run link race by @vitali87 in #751
• feat(io): direct READS_FROM/WRITES_TO sinks for Rust (#714) by @vitali87 in #752
• feat(io): direct READS_FROM/WRITES_TO sinks for C++ (#714) by @vitali87 in #753
• test(flow): cover Java FLOWS_TO edges (#714) by @vitali87 in #754
• build(deps): bump transformers from 5.3.0 to 5.5.0 in the uv group across 1 directory by @dependabot[bot] in #743
• feat(flow): path-sensitive if-branch taint for Go and Java (#714) by @vitali87 in #755

New Contributors

• @octo-patch made their first contribution in #626

Full Changelog: v0.0.246...v0.0.345