v0.6.62

🔒 Security

OpenTelemetry Python API: Denial of service through quadratic-time traceparent parsing (medium severity, CVSS 5.3), dependency advisory GHSA-mf5v-w3w3-f6cg / CVE-2026-126360.

Upgrading is strongly recommended.

Highlights

• Type Handling: Improved handling of type receivers, arrays, and element access in TypeScript and JavaScript.
• Import Resolution: Enhanced resolution of imports, particularly for CommonJS renamed properties and path-qualified functions.
• Dead Code Elimination: Removed dead code related to the C, C++, and Scala public API.
• Incremental Builds: Ensured unchanged classes retain their field types across incremental syncs.
• Python Property Access: Scoped Python property reads to their respective receivers.
• Cross-Language Imports: Rejected cross-language internal import targets to improve clarity.
• Constructor Initialisation: Correctly handled attribute field initializers in TS/JS, Java and C# constructors.

New Contributors

• @hahahahahayesyeseys made their first contribution in #2841
• @DYNOSuprovo made their first contribution in #2774

Full Changelog: v0.6.30...v0.6.62

What's Changed

• build(deps): bump rusqlite in /rust/cgr_graph_rs by @dependabot[bot] in #3555
• fix(ts): type receivers through aliases, readonly arrays and element access by @vitali87 in #3309
• fix(js): record side-effect imports as IMPORTS edges by @vitali87 in #3284
• fix(rust): a function reached through a glob use binds exactly by @vitali87 in #3242
• fix(js): bind a CommonJS renamed property export to its function by @vitali87 in #2994
• fix(rust): resolve a path-qualified Type::fn() through the path it is written with by @vitali87 in #2993
• fix(tests): skip a module-scoped fixture over a missing grammar by @vitali87 in #2985
• fix(dead-code): C, C++ and Scala public API is a dead-code root by @vitali87 in #2952
• fix(incremental): unchanged classes keep their field types across a sync by @vitali87 in #3219
• fix(rust,cpp): a member call never binds to a free function by @vitali87 in #3220
• fix(js): select tsconfig customConditions in workspace package exports by @vitali87 in #3012
• fix: scope Python property reads to their receiver by @vitali87 in #3600
• fix: scope Python property reads to their receiver by @hahahahahayesyeseys in #2841
• fix(parsers): reject cross-language internal import targets (#2756) by @vitali87 in #3601
• fix(parsers): reject cross-language internal import targets (#2756) by @DYNOSuprovo in #2774
• fix(calls): attribute TS/JS, Java and C# field initializers to the constructor by @AdityaxDeore in #3526
• fix(java): type try-with-resources variables and catch parameters by @AdityaxDeore in #3525
• chore(deps): bump grpcio from 1.85.0 to 1.85.1 by @dependabot[bot] in #3596
• chore(deps-dev): bump ty from 0.0.95 to 0.0.98 by @dependabot[bot] in #3593
• chore(deps): bump tree-sitter-scala from 0.26.3 to 0.26.4 by @dependabot[bot] in #3592
• chore(deps): bump anthropics/claude-code-action from 1.0.265 to 1.0.269 by @dependabot[bot] in #3590
• chore(deps): bump SonarSource/sonarqube-scan-action from 8.4.0 to 8.4.1 by @dependabot[bot] in #3589
• chore(deps): bump pip from 26.2.2 to 26.3 in /scripts by @dependabot[bot] in #3598
• chore(deps): bump golang from c65ecfe to af1bfc2 in /.oss-scanner by @dependabot[bot] in #3599
• chore(deps): bump sigstore/cosign-installer from 4.1.2 to 4.1.3 by @dependabot[bot] in #3588
• chore(deps): bump memgraph/lab from 3.14.1 to 3.14.2 in /codebase_rag by @dependabot[bot] in #3597
• fix(rename): keep a Java or C# method's signature in the name the contract expects by @vitali87 in #2710
• fix(js-ts): a method call no longer also calls a same-named module function by @vitali87 in #3207
• fix(trace): a Python frame whose name the file lacks is unresolved by @vitali87 in #3082
• fix(csharp): an overloaded extension method's call reaches its overload set by @vitali87 in #3083
• fix(rename): keep a JS/TS shorthand property's key; rename namespace destructures by @vitali87 in #3301
• fix(cli): print names and paths literally in report tables and diff-index by @vitali87 in #2672
• fix(io): Dart and PHP reads and writes get their READS_FROM / WRITES_TO by @vitali87 in #3119
• fix(deps): bump opentelemetry-api to 1.45.2 for GHSA-mf5v-w3w3-f6cg by @vitali87 in #3605

New Contributors

• @hahahahahayesyeseys made their first contribution in #2841
• @DYNOSuprovo made their first contribution in #2774

Full Changelog: v0.6.30...v0.6.62