tirth8205/code-review-graph v2.3.3

on GitHub

Large additive release accumulated since v2.3.2 — 141 non-merge commits, 8 new languages/extensions, 5 new platform install targets, 6 new framework call resolvers, comprehensive Windows hardening, VS Code accessibility pass, and a full sweep of community PRs.

Highlights

Languages and extensions

• Nix (flake-aware), Verilog/SystemVerilog, SQL, ReScript, GDScript (Godot)
• .hh (C++ headers) and .ksh extensions; shebang-based detection for extension-less scripts
• Julia: parametric constructors, @enum, public exports

Platforms

• GitHub Copilot + Copilot CLI, Gemini CLI, Qoder, OpenCode, Cursor hooks
• Native Codex install alignment

Framework call resolution

• Spring DI — receiver method calls resolve through @Autowired/constructor injection to concrete InjectedType.method; emits INJECTS edges + stereotype metadata
• Temporal — workflow/activity stub calls resolve to implementations
• Kafka — @KafkaListener and KafkaTemplate.send(...) emit CONSUMES/PRODUCES edges
• Jedi-based Python call resolution (improved cross-file accuracy)
• Python callback REFERENCES edges
• Mocha TDD suite(), Bun test, __tests__/ directory detection

MCP server / CLI

• crg-daemon multi-repo watch daemon (subprocess.Popen child supervision, 35 tests)
• Streamable HTTP transport (serve) alongside stdio
• serve --tools flag and CRG_TOOLS env var for tool filtering
• External database directory support for network filesystems
• SVN support for change analysis

Embeddings

• OpenAI-compatible provider (OpenAI / Azure OpenAI / any compatible endpoint), configurable batch size

VS Code extension / visualization

• WCAG 2.1 AA contrast across standalone HTML and webview
• Distinct d3.symbol shapes per node kind (colorblind-friendly)
• Full keyboard navigation (tab/arrow/enter/escape, focus styles, skip-link)
• ARIA roles on tooltip, detail panel, legend, search results, edge pills
• Help overlay with interaction guide
• Empty-state webview, contextual depth slider, edge filter popover
• Detail panel relocated to the left; GitHub Dark palette unified
• IMPLEMENTS, TESTED_BY, DEPENDS_ON edge types in standalone HTML

Fixed

Parser

• C++ scoped/destructor/operator method names (PR #371, PR #403)
• Java method/superclass/super_interfaces extraction (PR #275, #278)
• Java import resolution to file paths (PR #280)
• PHP CALL extraction — methods, statics, unqualified (PR #298)
• Module-scope CALLS edges (PR #285)

Windows

• MCP stdio hang on long-running tools — auto-select thread pool (PR #400)
• MCP stdin hang on git/svn subprocesses — stdin=DEVNULL everywhere (PR #425)
• Non-UTF-8 locale handling — encoding="utf-8" on subprocess.run
• Windows test failures — UTF-8/CRLF/stop_at boundary (PR #274)

Hooks and install

• Hooks JSON schema with required matcher (PR #288)
• Merge-don't-overwrite for existing hook arrays + .bak backup (PR #114, #145, #203)
• Pre-commit hook uses update subcommand (PR #315)
• Skip hooks gracefully outside git repos (PR #293)
• Poetry / uv environment detection for the MCP serve command (PR #287)

MCP server

• fastmcp ≥3.2.4 compatibility — _apply_tool_filter restored
• FastMCP banner suppressed for stdio transport (PR #290)
• MCP config: cwd, skills path, JSONC tolerance

Other

• __version__ stuck at 2.1.0 since v2.1.0 — embeddings.py builds the cloud-API User-Agent from this string, so cloud-embedding traffic was being mis-attributed across every release between v2.1.0 and v2.3.2.
• SQLite transaction safety + FTS5 sync (PR #94, #279)
• CLI build/update/watch run post-processing (signatures/FTS/flows/communities) (PR #98)
• Flow trace adjacency loaded in-memory (PR #296)
• Dead-code callback references (PR #424)

Security

• Embeddings RCE hardening (PR #397) — RCE paths gated behind explicit env var; cloud requests send a versioned User-Agent (PR #390); refuses to mix indexes built with different providers.

Upgrade notes

• uvx --reinstall code-review-graph or pip install -U code-review-graph
• Re-run code-review-graph install once to pick up the JSONC-tolerant config writer and the corrected cwd / skills path in .mcp.json
• The __version__ fix changes the cloud-embedding User-Agent from code-review-graph/2.1.0 to code-review-graph/2.3.3 — update any proxy allow-lists keyed on the old string.
• The VS Code extension still ships separately — repackage/republish the .vsix to publish the v2.3.3 a11y improvements to the Marketplace.

See CHANGELOG.md for the full breakdown.