v0.4.19

🔒 Security

This release contains a security fix; see the Security Advisories page.

Upgrading is strongly recommended.

Highlights

• Dependency Updates: Several dependencies have been updated, including protobuf to 7.36.2, transformers to 5.21.0, and python to 3.15-slim, bringing in various bug fixes and new features.
• Quiet Mode Enhancement: The --quiet flag for the CLI now suppresses the scanning line for dead code and duplicates, providing a cleaner output.
• Signature Change Tests: Comprehensive acceptance, transaction, and mapping tests have been added for the change_signature feature, ensuring robust functionality.
• Context Budget Fix: The system now correctly handles cases where a target doesn't fit within the allocated budget, preventing unexpected behaviour.
• Performance Improvements: Optimisations have been made to improve performance, including indexing file definitions and returning registry trie results directly.
• Code Quality: Changes have been made to report decorator and modifier changes that affect method calls and to ensure submodule grammars are loaded correctly.
• CGR Prune Feature: A new cgr prune functionality has been added to remove projects where the root no longer exists.

New Contributors

• @AdityaxDeore made their first contribution in #3524
• @mdpant made their first contribution in #3221

Full Changelog: v0.4.5...v0.4.19

What's Changed

• build(deps): bump pytest-asyncio from 1.4.0 to 1.4.1 by @dependabot[bot] in #3519
• build(deps): bump jedi from 0.20.0 to 0.20.1 by @dependabot[bot] in #3518
• build(deps-dev): bump ty from 0.0.91 to 0.0.92 by @dependabot[bot] in #3517
• build(deps-dev): bump ruff from 0.17.2 to 0.17.3 by @dependabot[bot] in #3516
• build(deps): bump protobuf from 6.33.6 to 7.36.2 by @dependabot[bot] in #3515
• fix(cli): --quiet hides the scanning line of dead-code and duplicates by @vitali87 in #3505
• test(signature): acceptance, transaction and MCP tests for change_signature (#1533, 6/9) by @vitali87 in #2169
• test(signature): mapping tests for change_signature (#1533, 7/9) by @vitali87 in #2168
• test(signature): definition and renamed-parameter tests for change_signature (#1533, 8/9) by @vitali87 in #2165
• ci: correct the pull_request_target enforcement date in the split-score comment by @vitali87 in #3520
• ci: publish release assets with gh and gate the workflows on zizmor by @vitali87 in #3503
• feat(py): resolve calls through the bindings that reach them, and the with protocol by @vitali87 in #3521
• fix(context): return no pieces when the target does not fit the budget by @vitali87 in #3506
• build(deps): bump pyasn1 from 0.6.4 to 0.6.5 in the uv group across 1 directory by @dependabot[bot] in #3522
• fix(gloss): anchor a note's mentions the way its subject is anchored by @vitali87 in #3329
• test(signature): hierarchy, receiver and default guards for change_signature (#1533, 9/9) by @vitali87 in #2167
• perf(java): return the registry trie result instead of rescanning on a miss by @AdityaxDeore in #3524
• fix(check): report decorator and modifier changes that change how a method is called by @vitali87 in #3311
• perf(python): index each file's definitions once instead of re-searching it per lookup by @vitali87 in #3538
• ci(dependabot): watch the cgr-graph-rs crate and its fuzz targets by @vitali87 in #3536
• build(deps): drop semgrep from the dev group by @vitali87 in #3537
• fix(parser): load submodule grammars only from cgr's own checkout by @vitali87 in #3540
• ci(release): publish server.json to the MCP Registry after PyPI by @vitali87 in #3535
• perf(indexer): find called parameters and Python local aliases in Rust on the tree bridge by @vitali87 in #3556
• build(deps): bump memgraph/lab from 3.14.0 to 3.14.1 in /codebase_rag by @dependabot[bot] in #3553
• build(deps): bump transformers from 5.20.2 to 5.21.0 by @dependabot[bot] in #3552
• build(deps): bump anthropics/claude-code-action from 1.0.262 to 1.0.264 by @dependabot[bot] in #3551
• build(deps): bump astral-sh/setup-uv from 10.3.2 to 10.3.3 by @dependabot[bot] in #3550
• build(deps): bump SonarSource/sonarqube-scan-action from 8.3.0 to 8.4.0 by @dependabot[bot] in #3548
• build(deps): bump grpcio from 1.84.1 to 1.85.0 by @dependabot[bot] in #3546
• build(deps): bump torch from 2.14.1 to 2.15.0 by @dependabot[bot] in #3545
• build(deps): bump python from 3.14-slim to 3.15-slim by @dependabot[bot] in #3544
• build(deps): bump python from 0d0db5b to 17b9724 in /.oss-scanner by @dependabot[bot] in #3543
• build(deps): bump @ruby/prism from 2.0.0 to 2.1.0 in /evals/oracles/ruby_oracle by @dependabot[bot] in #3541
• fix(context): count a traced pair's hotness once per caller by @vitali87 in #3533
• feat: add cgr prune for projects whose root no longer exists by @vitali87 in #3534
• feat: add cgr prune for projects whose root no longer exists by @mdpant in #3221

New Contributors

• @AdityaxDeore made their first contribution in #3524
• @mdpant made their first contribution in #3221

Full Changelog: v0.4.5...v0.4.19