v0.1.90

Highlights

• Dependency Updates: Numerous dependencies have been updated to their latest versions, including pydantic-ai-slim, actions/checkout, types, and transformers, ensuring access to the newest features and fixes.
• CLI Enhancements: The command-line interface now offers more granular control over project scope with cgr stats --project and cgr export --project. It also includes improved logging and error handling.
• Contextual Queries: Support for more detailed context queries has been added, including reasons and evaluation ingestor reads, enhancing the understanding of code interactions.
• Graph Improvements: The graph analysis capabilities have been expanded to follow cross-service links and implementors/overrides, providing a more comprehensive view of code dependencies.
• Code Quality & Refactoring: Several refactorings and fixes address code clarity, consistency, and the removal of dead code, improving the overall maintainability of the project.

What's Changed

• docs: align the PR checklist and contributing steps with the comment policy by @vitali87 in #2378
• build(deps): land the pending dependency bumps, with the fixes each needed by @vitali87 in #2352
• fix(cli): turn off the pydantic-ai startup banner for cgr by @vitali87 in #2374
• fix(cli): log at INFO by default and number the embeddings pass 5 by @vitali87 in #2375
• fix(deps): bump pydantic-ai-slim to 2.51.0 so claude-opus-5-5 validates by @vitali87 in #2373
• build(deps): bump actions/checkout from 6.0.2 to 7.0.1 by @dependabot[bot] in #2382
• build(deps): bump actions/upload-pages-artifact from 4.0.0 to 5.0.0 by @dependabot[bot] in #2380
• build(deps): bump docker/login-action from 4.0.0 to 4.6.0 by @dependabot[bot] in #2379
• build(deps): bump typer from 0.21.1 to 0.27.2 by @dependabot[bot] in #2384
• build(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2 by @dependabot[bot] in #2381
• build(deps): bump astral-sh/setup-uv from 8.3.1 to 10.2.0 by @dependabot[bot] in #2385
• build(deps): bump tree-sitter-lua from 0.4.1 to 0.5.0 by @dependabot[bot] in #2386
• build(deps): bump Microsoft.Build.Framework from 17.11.48 to 17.14.28 by @dependabot[bot] in #2387
• build(deps): bump python from fb83750 to 51dafde by @dependabot[bot] in #2388
• build(deps): bump astral-sh/uv from 04d046b to 100047e by @dependabot[bot] in #2389
• build(deps): bump oss-fuzz-base/base-builder-python from 6a90ec8 to ea2c867 in /.clusterfuzzlite by @dependabot[bot] in #2390
• fix(logging): stop user-facing sinks printing local variable values by @vitali87 in #2376
• ci: fix zizmor findings incl. action pinned to a known RCE (GHSA-8q5r-mmjf-575q) by @vitali87 in #2122
• feat(graph): follow cross-service links in flow verdicts and signature deltas by @vitali87 in #1978
• feat(context): context-slice queries, reasons, and the eval ingestor reads they need (#1536, 1/5) by @vitali87 in #2141
• feat(check): queries, constants and CLI help for the isolated check (#1718) by @vitali87 in #2148
• feat(check): isolated check capture and restore (#1718) by @vitali87 in #2146
• feat(gloss): #getter, #setter and #deleter name one member of a property (#1808) by @vitali87 in #2217
• refactor: clear 26 of main's small Sonar findings (#1669) by @vitali87 in #2226
• fix(doctor): accept the edges and markers cgr itself writes by @vitali87 in #2431
• feat(cli): scope cgr stats to projects or a workspace by @vitali87 in #2436
• fix(vector-store): store embeddings in the stack's Qdrant when QDRANT_URL is unset by @vitali87 in #2484
• fix(deps): drop dependencies removed from a manifest on incremental sync by @vitali87 in #2408
• build(deps-dev): bump ruff from 0.14.14 to 0.16.9 by @dependabot[bot] in #2383
• fix(packaging): ship codec/schema.proto so installed builds can diff-index by @vitali87 in #2492
• fix(logging): log per-symbol indexing and connection lifecycle at DEBUG by @vitali87 in #2491
• perf(sync): scope the orphan prune to this project and batch the legacy-identity check by @vitali87 in #2489
• fix(cypher): regenerate a query the database rejects, fed its error by @vitali87 in #2377
• fix(sync): keep a sync's work on Ctrl+C and let Ctrl+C stop the pre-chat sync by @vitali87 in #2425
• style: use len as the sort key flagged by ruff 0.16.9 by @vitali87 in #2537
• fix(parsers): stop Point.row reads freeing ints in tree-sitter 0.26.0 by @vitali87 in #2437
• fix(stack): pin the Qdrant and Memgraph Lab images by version and digest by @vitali87 in #2494
• fix(index): always write a complete snapshot and keep sync state out of the repository by @vitali87 in #2486
• fix(sync): keep a first sync free of the seed-prune warning and the upgrade notice by @vitali87 in #2487
• fix(markdown): emit LINKS_TO after every File node of the pass is buffered by @vitali87 in #2488
• fix(incremental): bind longer_project_prefixes in the known-definitions read by @vitali87 in #2419
• build(deps): bump tree-sitter-scala from 0.24.0 to 0.26.2 by @dependabot[bot] in #2721
• build(deps): bump transformers from 5.12.1 to 5.17.0 by @dependabot[bot] in #2718
• build(deps): bump astral-sh/uv from 100047e to a7aed32 by @dependabot[bot] in #2716
• build(deps): bump actions/setup-python from 6.2.0 to 7.0.0 by @dependabot[bot] in #2715
• build(deps): bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml from 2.3.3 to 2.6.0 by @dependabot[bot] in #2711
• build(deps): bump softprops/action-gh-release from 2.5.0 to 3.0.3 by @dependabot[bot] in #2712
• build(deps): bump codecov/codecov-action from 5.5.3 to 7.1.1 by @dependabot[bot] in #2713
• build(deps): bump oss-fuzz-base/base-builder-python from ea2c867 to 79cc75a in /.clusterfuzzlite by @dependabot[bot] in #2717
• build(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2 by @dependabot[bot] in #2714
• build(deps-dev): bump types-protobuf from 6.32.1.20251210 to 7.35.1.20260906 by @dependabot[bot] in #2719
• fix(workspace): refuse workspace names that escape the workspaces directory by @vitali87 in #2670
• fix(vector-store): verify the stack owns its Qdrant and honour an explicit QDRANT_DB_PATH by @vitali87 in #2525
• fix(watcher): keep the content event when debouncing inotify open/close events by @vitali87 in #2514
• fix(js): stop binding bare calls to object-literal property functions by @vitali87 in #2545
• fix(parsers): give a stem shared across languages no bare module name and point importers at their own file by @vitali87 in #2623
• fix(cli): exit quietly when a command stops inside the graph connection by @vitali87 in #2706
• fix(ast-grep): rewrite a $$$ capture as its source text, separators included by @vitali87 in #2726
• fix(stack): start the bundled Memgraph and Qdrant with telemetry off by @vitali87 in #2729
• build(deps): bump ast-grep-py from 0.44.1 to 0.45.3 by @dependabot[bot] in #2722
• fix(calls): name the rows a relationship flush lost and stop emitting computed arguments as callbacks by @vitali87 in #2530
• fix(capture): reject unknown capture tokens and flag a group that adds nothing by @vitali87 in #2509
• fix(check): trip --fail-on-found only on a definite arity verdict by @vitali87 in #2695
• fix(dead-code): root a dotted --decorator-root on the decorator it names by @vitali87 in #2692
• fix(graph-loader): name what a non-export file is missing and make metadata optional by @vitali87 in #2506
• docs(mcp): say index_repository rebuilds only its own project in the shared graph by @vitali87 in #2708
• fix(mcp): report failed tool calls with isError true by @vitali87 in #2699
• fix(cli): stop writing escape codes into redirected output by @vitali87 in #2413
• fix(cli): never derive a project name that starts with a dash by @vitali87 in #2702
• fix(python): never resolve a function's own local to the definition it shadows by @vitali87 in #2687
• docs(trace): say how pytest gets the cgr plugin before the first --cgr-trace run by @vitali87 in #2705
• fix(workspace): print each error once and refuse a file or overlapping path as a repo by @vitali87 in #2501
• build(deps): bump pyjwt from 2.13.0 to 2.15.1 (GHSA-ffc3-869f-jxw9) by @vitali87 in #2735
• fix(findings): match the Python broad_except and mutable-default smells structurally by @vitali87 in #2738
• fix(dead-code): root members of TS/JS classes exported by clause, default or CommonJS by @vitali87 in #2610
• fix(parsers): stop indexing Rust attribute arguments as calls by @vitali87 in #2600
• fix(dead-code): let the endpoint decide a route handler with --no-endpoint-roots by @vitali87 in #2686
• fix(graph): callees rows name the call site's file in path and the callee's in callee_path by @vitali87 in #2553
• fix(findings): fire the Python yaml_load and sqli_fstring rules on unsafe calls only by @vitali87 in #2737
• fix(stack): keep mgclient probe errors off the terminal while Memgraph starts by @vitali87 in #2452
• feat(cli): scope cgr export to projects, retire its inert options and fail fast on a bad -o by @vitali87 in #2498
• fix(cli): refuse an empty stats scope instead of counting every project by @vitali87 in #2513
• fix(watcher): write to the project cgr start derives for the watched repo by @vitali87 in #2540
• fix(trace): keep trace-derived CALLS edges across incremental re-parses by @vitali87 in #2551
• fix(deps): cap mcp below 2.0 so cgr mcp-server starts on fresh installs by @vitali87 in #2566
• fix(java): enum constants call the constructor they invoke by @vitali87 in #2576
• fix(lua): link calls to colon-methods via receiver types and both member spellings by @vitali87 in #2607
• fix(parsers): bind base lists to type declarations in C# scope order by @vitali87 in #2585
• fix(edits): re-ingest the files cgr edits undo restores by @vitali87 in #2569
• fix(doctor): probe Ollama before calling its model ready by @vitali87 in #2502
• fix(stack): report a failed daemon up once and briefly, and treat Memgraph Lab as optional by @vitali87 in #2493
• build(deps): bump virtualenv from 20.36.1 to 21.14.2 (GHSA-94p9-xgh2-xp45) by @vitali87 in #2740
• fix(parsers): resolve JSX member tags of external namespace imports as external by @vitali87 in #2577
• fix(php): give anonymous classes their own Class node by @vitali87 in #2594
• fix(cli): scope cgr start --update-graph -o to the synced project by @vitali87 in #2539
• fix(graph): let a deliberate exit leave the graph connection without an error by @vitali87 in #2496
• fix(cli): write dead-code and duplicates tables at full width to files and pipes by @vitali87 in #2630
• fix(java): record method references as REFERENCES edges by @vitali87 in #2601
• fix(mcp): start the server without a reachable Cypher model and keep startup errors off stdout by @vitali87 in #2570
• fix(incremental): stop a data file clearing its same-stem source's definitions by @vitali87 in #2563
• fix(calls): stop binding generic Python member calls to an arbitrary same-named method by @vitali87 in #2495
• fix(trace): resolve traceback frames recorded under another checkout root by @vitali87 in #2604
• fix(c): name functions whose macro annotation tree-sitter splits into a declaration by @vitali87 in #2580
• feat(python): parse .pyi stubs and honour PEP 263 source encodings by @vitali87 in #2526
• fix(cpp): keep calls of functions with a trailing annotation macro by @vitali87 in #2603
• fix(cli): refuse options cgr start --update-graph would drop and correct its help by @vitali87 in #2549
• fix(cli): report usage errors in delegated command groups instead of a traceback by @vitali87 in #2500
• fix(dead-code): classify test code by path words, not case-sensitive substrings by @vitali87 in #2632
• docs(capture): generate the --capture help and the capture groups docs from CaptureGroup by @vitali87 in #2612
• fix(ast-grep): keep same-named Swift, Kotlin and Solidity definitions apart and under their type by @vitali87 in #2606
• fix(flow): carry Python taint through builtins, methods and string building by @vitali87 in #2626
• fix(check): stop counting a *args or **kwargs unpacking as a positional argument by @vitali87 in #2795
• perf(graph): walk callers and callees one indexed query per level by @vitali87 in #2807
• build(deps): bump filelock from 3.32.7 to 4.0.6 by @dependabot[bot] in #2720
• fix(deps): log empty or invalid dependency manifests at DEBUG with one run summary by @vitali87 in #2613
• fix(language): refuse grammar commands outside a code-graph-rag checkout by @vitali87 in #2522
• docs: add recorded demo GIFs to every feature page by @vitali87 in #2862
• fix(c): reference functions stored as function pointers by @vitali87 in #2593
• feat(context): graph-ranked, token-budgeted context slice (#1536, 2/5) by @vitali87 in #2140
• fix(dead-code): root public PHP members and recognise co-located PHPUnit tests by @vitali87 in #2825
• fix(parsers): keep a Python class's plain name over a later same-named def and bind its calls by @vitali87 in #2789
• fix(parsers): type Python with-targets and module-attribute constructions by @vitali87 in #2582
• feat(constant): add the Constant node label to the schema and graph plumbing (#1806, 1/4) by @vitali87 in #2136
• feat(duplicates): report disjoint clusters with nested exact copies instead of overlapping groups by @vitali87 in #2827
• fix(parsers): index anonymous JS/TS class expressions as classes by @vitali87 in #2628
• fix(js): bind bare calls to their require/import, not to other files' function expressions by @vitali87 in #2505
• feat(signature): contract expectation, shared call-site helpers and constants for change_signature (#1533, 1/9) by @vitali87 in #2163
• fix(mcp): show the TARGET_REPO_PATH hint only for a repo-path error by @vitali87 in #2904
• fix(rename): name the CLI's --allow-heuristic in the CLI refusal by @vitali87 in #2898
• feat(check): cgr check --isolated wiring and the graph emulator's capture queries (#1718) by @vitali87 in #2147
• fix(graph): refuse an unknown project or name instead of answering [] by @vitali87 in #2562
• fix(parsers): bind JS/TS calls through barrel re-exports to the definition by @vitali87 in #2833
• fix(php): name an anonymous class under the qn its enclosing callable is registered with by @vitali87 in #2812
• fix(rust): resolve bare 2018-edition pub use re-exports to the local module by @vitali87 in #2599
• fix(parsers): stop C/C++ elaborated type uses from creating phantom classes by @vitali87 in #2786
• fix(check): report imports and all entries that name a removed symbol by @vitali87 in #2574
• fix(java): rank same-arity overloads by cast, subtype and inherited candidates by @vitali87 in #2800
• fix(rust): bind Type::fn() calls only to the named type's methods by @vitali87 in #2595
• feat(check): report signature changes outside Python with per-site arity verdicts by @vitali87 in #2832
• fix(language): list every parsing tier in list-languages and keep names readable by @vitali87 in #2508
• fix(sql): link calls between routines as CALLS edges by @vitali87 in #2819
• fix(dead-code): root C# static Main entry points whatever their accessibility by @vitali87 in #2820
• feat(context): expose the context slice as cgr context and an MCP tool, with docs (#1536, 3/5) by @vitali87 in #2142
• fix(lua): name t["key"] functions, keep their calls, and root returned module values by @vitali87 in #2617
• fix(js): label member calls bound by name alone heuristic and drop those the receiver's declared type rules out by @vitali87 in #2790
• fix(trace): match Windows frames under a differently-cased directory by @vitali87 in #2844
• fix(go): bind methods called on a call result or a composite literal by @vitali87 in #2824
• fix(rust): keep a type import when a same-named derive macro is imported by @vitali87 in #2822
• fix(parsers): bind JS/TS member calls on a new expression to the constructed class by @vitali87 in #2817
• fix(sync): say what Ctrl-C left and why the next sync rebuilds by @vitali87 in #2816
• fix(parsers): keep JSX members of bare package imports external when the package name matches a project path by @vitali87 in #2806
• fix(dart): scan factory constructors, link this/super delegations and chained extension calls by @vitali87 in #2804
• fix(findings): skip constant string literals in innerhtml_xss and document_write rules by @vitali87 in #2798
• fix(cpp): bind operator expressions only through an operand of class type by @vitali87 in #2794
• fix(shell): run confined reads without a prompt and send structural questions to the graph by @vitali87 in #2485
• fix(cli): refuse a project name containing the qualified-name separator by @vitali87 in #2497
• fix(cli): keep quiet error logs on stderr by @xujiantop-crypto in #2677
• docs(mcp): document io capture for flow tools by @BLVCK-MAMBA-6 in #2983
• test(context): list the server's derived project in the MCP scope test by @vitali87 in #2995
• ci: give the unit-test and SonarCloud jobs room for the grown suite by @vitali87 in #3068
• fix(structural): search and rewrite every language ast-grep parses by @vitali87 in #3103
• fix(mcp): flag every refused tool call with isError by @vitali87 in #3101
• fix(python): type a parameter by its quoted forward-reference annotation by @vitali87 in #3085
• fix(python): a function named as a default argument value is referenced by @vitali87 in #3084
• fix(calls): a CALLS edge to a same-named variant takes that variant's label by @vitali87 in #3081
• fix(findings): a mutable default built by a call is still shared by @vitali87 in #3075
• fix(graph): count the relationship rows a flush wrote, not the edges matched by @vitali87 in #3049
• fix(cpp): gate the libclang warnings on the C/C++ the indexer parses by @vitali87 in #3044
• fix(js-ts): inherit from a base re-exported under an alias by @vitali87 in #3033
• fix(mcp): hold the ingestor lock until a cancelled call's thread ends by @vitali87 in #2987
• fix(chat): re-ingest what the cgr start agent writes by @vitali87 in #2986
• fix(python): keep a guessed Protocol call a guess and dispatch to real conformers by @vitali87 in #2979
• fix(rename): treat an inline function's column renumbering as no rename by @vitali87 in #2976
• fix(deps): read a manifest saved with a UTF-8 BOM by @vitali87 in #2971
• fix(findings): except BaseException is a broad except by @vitali87 in #3074
• fix(findings): PHP backtick shell exec and define/const secrets by @vitali87 in #3072
• fix(findings): subprocess_shell needs the call's own shell=True keyword by @vitali87 in #3071
• fix(rust): Type::assoc() calls inside macro arguments get their CALLS by @vitali87 in #3127
• fix(solidity): index receive() and fallback() as contract methods by @vitali87 in #3241
• fix(rust): buffer an inline mod's node before the items it DEFINES by @vitali87 in #3223
• fix(export): a project export keeps the links between the resources it holds by @vitali87 in #3260
• fix(incremental): index a rehydrated definition under its name by @vitali87 in #3296
• fix(incremental): keep C# extension methods of unchanged files by @vitali87 in #3295
• fix(rename): rewrite a JSX element's closing tag with its opening tag by @vitali87 in #3094
• docs(data-flow): list the four FLOWS_TO edges the worked example produces by @vitali87 in #3046
• fix(cli): refuse a project name that already indexes another repository by @vitali87 in #2499
• fix(cli): report an unreachable or login-refusing Memgraph in one line by @vitali87 in #2504
• docs(cli): generate the CLI reference option tables from the commands' Click parameters by @vitali87 in #2523
• fix(config): report an invalid setting in one line instead of crashing every command by @vitali87 in #2556
• fix(java): resolve calls through import static to the imported member by @vitali87 in #2592
• fix(parsers): emit EnumVariant nodes for TypeScript, Dart and Python enums by @vitali87 in #2605
• fix(ts): resolve relative imports of and from dotted file names by @vitali87 in #2625
• fix(ast-grep): name the files left unparsed without the ast-grep extra and document the extra by @vitali87 in #2796
• fix(parsers): keep C++ classes closed when #if splits a member-initializer list by @vitali87 in #2799
• fix(php): record INSTANTIATES and __construct CALLS for new expressions by @vitali87 in #2818
• fix(calls): locate callable-parameter CALLS edges at the parameter's invocation by @vitali87 in #2826
• fix(index): never follow a symlink in any repository walk by @vitali87 in #2828
• feat(graph): follow implementors and overrides to a --depth by @vitali87 in #2787
• fix(parsers): stop typing Python self, cls and untyped parameters by fuzzy class-name match by @vitali87 in #2788
• fix(graph): resolve path:line targets in every path spelling and refuse an unknown file by @vitali87 in #2792
• fix(flow): clear taint through find/index-style lookups only on a receiver known to be a string by @vitali87 in #2851
• fix(csharp): bind type references to a partial class and rename every part by @vitali87 in #2829
• feat(markdown): keep each link's section, anchor, site and missing target on LINKS_TO by @vitali87 in #2830
• fix(evals): keep the child's error in oracle skip reasons when a forked child inherits gRPC log noise by @vitali87 in #2849
• fix(stack): probe Memgraph from a child process on Windows so mgclient's output is captured without moving fd 2 by @vitali87 in #2856
• feat(parsers): index the code cells of Jupyter notebooks by @vitali87 in #2831
• fix(sync): keep cgr's sync and edit state out of the working tree by @vitali87 in #2557
• fix(ts): give interface and abstract method signatures Method nodes by @vitali87 in #2581
• fix(doctor): pass graphs with TS type-alias heritage, endpoint projects and dropped findings by @vitali87 in #2572
• fix(rename): refuse when the source names the symbol where the graph has no site by @vitali87 in #2797
• fix(status): list syncs from the graph status reports on, not a local log (#2444) by @vitali87 in #2532
• feat(graph): follow re-exports in importers with --through-reexports by @vitali87 in #2627
• fix(parsers): follow Python class-body method aliases for references and calls by @vitali87 in #2803
• fix(go): build the go/types helper on Go 1.23.12 and name an older Go once by @vitali87 in #2417
• fix(go): bind same-package and test-file calls exactly, with or without go/types by @vitali87 in #2616
• fix(cpp): scope local structs under their function and bind functor calls by @vitali87 in #2631
• fix(parsers): fold Python typing.overload stubs into their implementation by @vitali87 in #2602
• fix(state): keep the edit history an older cgr records after the upgrade, and wait for one that locks the tree mid-commit by @vitali87 in #3344
• fix(mcp): name only the workspace's projects in unknown-project errors by @vitali87 in #3342
• fix(scala): bind imports of the project's own packages, new C() and parameterless calls by @vitali87 in #2823
• fix: regenerate the CLI reference and read the hash cache from the state directory by @vitali87 in #3343
• fix(graph): definition span and source include the decorators, and the JSON lists them by @vitali87 in #2511
• fix(ts): record IMPLEMENTS/INHERITS for generic and namespace-qualified heritage types by @vitali87 in #2793
• fix(endpoints): link Express handlers and built client URLs, and name a missing io capture instead of answering [] by @vitali87 in #2596
• fix(cli): sync a workspace's repositories on start --workspace --update-graph by @vitali87 in #2507
• fix(ts): keep a type and a same-named value as two nodes, not @line variants by @vitali87 in #2598
• fix(rust): bind Type::f() to the type a scoped or external use names by @vitali87 in #2791
• fix(incremental): type receivers through unchanged re-exports and Rust return types by @vitali87 in #2805
• fix(embeddings): key vectors by symbol and prune a project's stale ones on sync by @vitali87 in #2550
• fix(ignore): index git-tracked source under default-excluded names like bin, out and env by @vitali87 in #2490
• fix(parsers): give C# generic arity twins their own names and bind references by written arity by @vitali87 in #2629
• fix(incremental): keep overload and sole-implementer edges when a sync re-parses only the caller by @vitali87 in #2503
• fix(sync): let one writer sync a checkout at a time and retry transient Memgraph conflicts by @vitali87 in #2512
• perf(java): read each file's class headers once per call pass by @vitali87 in #3361
• perf(parsers): index each file's definitions once instead of rescanning them per definition by @vitali87 in #3364
• fix(ts): fold overload signatures into the function they declare by @vitali87 in #3357
• feat(cli): choose the project the same way on every command by @vitali87 in #3362
• fix(cpp): give each C++ member overload its own node by @vitali87 in #2821
• fix(embeddings): retry an embedding the store refused on the next sync, even if no file changed by @vitali87 in #3358
• fix(cpp): name a template specialization on one line, with no '.' separator inside by @vitali87 in #3356
• fix(calls): bind every hop of a fluent chain in TypeScript and Python by @vitali87 in #3359
• fix(ts): resolve a namespace member only through what the barrel exports by @vitali87 in #3355
• feat(cli): ship the real-time watcher as cgr watch by @vitali87 in #3365
• perf(incremental): keep the callers' edges when an edit leaves the file's interface unchanged by @vitali87 in #3363
• feat(dead-code): add --no-public-roots so unused public application code is reported by @vitali87 in #3366
• fix(sync): wait out a killed holder's lock release before refusing a sync by @vitali87 in #3367
• fix(fingerprint): keep a timed-out toolchain probe from changing the parser fingerprint by @vitali87 in #3368
• fix(go): record implicit interface satisfaction and dispatch calls through interfaces by @vitali87 in #3360
• build(deps): bump pydantic-ai-slim from 2.51.0 to 2.53.0 in the uv group across 1 directory by @dependabot[bot] in #3208
• build(deps-dev): bump ruff from 0.16.9 to 0.16.10 by @dependabot[bot] in #3354
• build(deps): bump transformers from 5.17.0 to 5.19.0 by @dependabot[bot] in #3352
• build(deps): bump qdrant/qdrant from v1.19.1 to v1.19.2 in /codebase_rag by @dependabot[bot] in #3350
• build(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 by @dependabot[bot] in #3347
• build(deps): bump github/codeql-action/upload-sarif from 4.38.2 to 4.38.3 by @dependabot[bot] in #3346
• build(deps): bump tree-sitter-php from 0.24.1 to 0.25.1 by @dependabot[bot] in #3351
• build(deps): bump typer from 0.27.2 to 0.27.3 by @dependabot[bot] in #3353
• build(deps): bump astral-sh/uv from 0.12 to 0.13 by @dependabot[bot] in #3348
• feat(signature): parameter specs, mapping sources and the change_signature contract check (#1533, 2/9) by @vitali87 in #2161
• feat(julia): add Julia as a supported language by @maxsintsov1996-netizen in #2024
• fix(fingerprint): treat a toolchain probe the OS could not start as unasked, not absent by @vitali87 in #3371
• refactor: remove dead code found by cgr dead-code by @vitali87 in #3372
• fix: close two gaps where copied code drifted apart (object-literal refs, MiniMax token budget) by @vitali87 in #3373
• refactor(evals): consolidate duplicated eval and benchmark code, fix the oracle guards it let drift by @vitali87 in #3374
• refactor: merge duplicated production helpers found by cgr duplicates by @vitali87 in #3376
• perf(trace): confirm a trace pair's static edge by index, not by scanning by @vitali87 in #3257
• fix(check): --project with the derived name reads the default run's scope by @vitali87 in #3079
• fix(findings): JS/TS hardcoded_secret sees members, properties and fields by @vitali87 in #3073
• fix(trace): keep a pprof frame's sampled line when the producer writes no start_line by @vitali87 in #3055
• fix(findings): Go ignored-error smells need the blank identifier itself by @vitali87 in #3069
• fix(editing): read and write a Python source in the encoding it declares by @vitali87 in #3023
• fix(js-ts): construct X through new (X)(...) and new (X as T)(...) by @vitali87 in #3064
• fix(rename): touch only the renamed name of a parenthesised Python import by @vitali87 in #3061
• fix(java): bind Outer.this.m() to the enclosing class by @vitali87 in #2972
• fix(config): report an unknown provider before asking for its key by @vitali87 in #3028
• build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in #2999
• build(deps): bump anthropics/claude-code-action from 1.0.231 to 1.0.240 by @dependabot[bot] in #2998
• build(deps): bump SonarSource/sonarqube-scan-action from 8.2.2 to 8.3.0 by @dependabot[bot] in #2997
• refactor: resolve the main-branch Sonar findings that have a code fix by @vitali87 in #2996
• fix(chat): end the session on Ctrl+D by @vitali87 in #2992
• fix(js): record a namespace import's IMPORTS edge to the imported file by @vitali87 in #2988
• fix(tokens): count tokens without tiktoken's download by @vitali87 in #2969
• ci: serialise version-bump runs and let stale runs stand down by @vitali87 in #2270
• fix(cpp): a macro before a class name no longer renames or drops the class by @vitali87 in #2958
• fix(editor): keep line endings and refuse ambiguous surgical replacements by @vitali87 in #2748
• fix(ts): record await f(x) and !f(x) as calls of f by @vitali87 in #2967
• fix(go): a call on a type-assertion receiver binds the asserted type by @vitali87 in #2961
• fix(java): mark implicit-public interface methods exported by @xujiantop-crypto in #2749
• fix(trace): print the --cgr-trace summary on a line of its own by @vitali87 in #2902
• fix(mcp): refuse a flow_verdict source or sink that names nothing by @vitali87 in #2975
• fix(dead-code): stop reporting TYPE_CHECKING stubs, Protocol classes, ast visitor handlers and pytest hooks by @vitali87 in #3375
• ci: split each unit-test cell into two shards so slow runners stop timing out by @vitali87 in #3381
• test: update the dead-code and structural-delta tests left stale by #2749 and #3079 by @vitali87 in #3380
• ci(release): tag a bump whose CI is unproven and defer only its release by @vitali87 in #3379

New Contributors

• @xujiantop-crypto made their first contribution in #2677
• @maxsintsov1996-netizen made their first contribution in #2024

Full Changelog: v0.1.38...v0.1.90