v0.10.8

Note on v0.10.7: this release supersedes v0.10.7, which was lost to a release-pipeline
publishing error (published under the tag 0.10.7 instead of v0.10.7; package installers
resolve the v-prefixed tag, and release immutability makes the name unrecoverable). The npm
and PyPI 0.10.7 packages are deprecated/yanked for that reason — their binaries were fine,
their download URLs were not. v0.10.8 carries the identical code content plus the pipeline
hardening that prevents a recurrence.

A community-heavy patch release: 19 pull requests merged since v0.10.6, most from
contributors. Thank you all!

Graph correctness

• Cypher aggregates no longer undercount (#1196). Both truncation mechanisms are fixed:
  unlabeled scans stopped collecting candidates at max_rows before aggregation ran
  (#1323, @Enferlain), and relationship-expansion buffers were capped so aggregation never
  saw rows beyond an internal growth limit (#1698). count()/collect() now see the
  complete match set; max_rows limits only the rows returned, as documented.
• Python aliased from-imports resolve to the real definition (#1371, @Joseph-MingEn).
  from .gate import execute as bridge_execute now produces a CALLS edge to execute
  itself rather than losing the call, and aliased base-class imports land on the real class
  node. On our django benchmark this recovered 26 INHERITS and 42 OVERRIDE edges with zero
  losses elsewhere, and left TypeScript graphs byte-identical.
• Cross-language suffix matching for qualified-name lookups (#1647, @rudi193-cmd).
• search_graph stops returning semantic-only ghosts — results backed by nothing but a
  similarity edge no longer surface as if they were definite matches (#1319, @JJordan0C).
• List-valued fields extract correctly instead of collapsing to their first element
  (#1325, @Enferlain).
• Index responses report persisted coverage truthfully (#1326, @Enferlain): an
  incremental run that does not revisit a file with recorded parse gaps no longer reports
  those gaps as vanished — the response now composes its skipped/parse-partial summaries
  from the stored coverage state, falling back to per-run data only if that read fails.

Windows

• Non-ASCII search content no longer degrades to ? (#1704). The search_code raw scan
  pipes PowerShell output, and PowerShell 5.1 encodes that pipe in the console OEM
  codepage — so Cyrillic, CJK, or accented content turned into question marks depending on
  which console the server inherited. The pipe is now pinned to UTF-8 unconditionally.
• search_code understands UTF-8 output paths and gains a context column for matches
  (#1253, @anfedoro).
• Code search is bounded and cancellable — abandoning a query no longer leaves an
  orphaned scan running (#1608, @ertankucukoglu).

Platforms & tools

• FreeBSD support (#1467, @PR9000).
• list_projects pagination: a lean default response plus offset/limit and
  include_details for the full view (#1181, @tmonestudio).
• Extensionless shebang scripts detect their language (#1203, @ibaldr89).
• Index-mode capability rebuild (#1263, @astandrik).
• is_test detection for tests/ directories (#1308) and a diff-aware clang-tidy
  hook (#1310, both @Yyunozor).

Release pipeline (the v0.10.7 lesson, hardened)

• Release gates fail closed on cancelled jobs: a timed-out gate can no longer cascade into
  a silently skipped test matrix (#1719).
• Malformed version inputs are refused preflight — a bare, non-v-prefixed version can never
  again publish an unresolvable tag (#1719).

Internal

• Test harnesses use isolated daemon runtimes so suite runs cannot touch the account
  daemon (#1695, @astandrik); LF checkout contracts for shell entrypoints and git hooks
  (#1314 @mlandolfi90, #1699 with @xumian520); the stdin-gate regression tests no longer
  depend on the registry shipping a zero-argument tool (#1704).

Security Verification

Every binary published below was scanned by VirusTotal before smoke and soak testing, and the verdict for the exact shipped bytes is linked per product (decisive engines: 61–68).
Every shipped binary was clean.

Selection is tuple-local and defaults to stripped. The selected executable SHA-256 was verified again after packaging; archive containers were not redundantly submitted to VirusTotal. Their hashes remain available in checksums.txt.

Durable evidence: candidate provenance, candidate VirusTotal results, selection decisions.