vitali87/code-graph-rag v0.0.421 on GitHub

Highlights

C# Enhancements: Significant improvements to the Roslyn hybrid frontend, including exact overloads, extension binding, and LINQ query calls. Also includes fixes for discovering solutions and handling arity-sibling base types.
Flow Improvements: Expanded flow taint analysis to include Rust macros and C++ stream sinks, with enhancements for branch-merge loops, try/if/match statements, and union taint.
Evaluations & Structure Oracle: Refinements to the structure oracle for C# interfaces and top-level script functions, alongside improvements to C# call retrieval and suppression of phantom members.
I/O Subsystem: Introduced handle-aware I/O and support for various sinks including Java network sinks and Socket streams, alongside improvements to the lean non-Python walk.
Language Support: Added Dart highlights, initialized language grammars lazily, and implemented an OpenAI-compatible embedding provider.

What's Changed

feat(csharp): Roslyn hybrid frontend B1 — semantic base classification by @vitali87 in #756
feat(flow): flow taint into Rust macro and C++ stream sinks by @vitali87 in #757
feat(csharp): exact overloads, extension binding, partial identity, and LINQ query calls via Roslyn hybrid frontend by @vitali87 in #759
ci(sonarcloud): raise job timeout to 30 minutes by @vitali87 in #760
fix(csharp): discover .slnx solutions and surface Roslyn frontend failures by @vitali87 in #761
fix(csharp): recover arity-sibling base types dropped by the self-loop guard by @vitali87 in #762
fix(evals): classify C# interface bases as INHERITS in the structure oracle by @vitali87 in #763
fix(csharp): bind local functions to their exact hosting overload via recorded node spans by @vitali87 in #767
fix(evals): anchor top-level C# script functions to the module in the structure oracle by @vitali87 in #769
feat(docs): generate language and MCP tool tables from code and fix stale guides by @vitali87 in #766
feat(io): handle-aware I/O for the lean non-Python walk plus Python cursor derive by @vitali87 in #770
feat(evals): C# call-retrieval eval measuring the Roslyn hybrid frontend win by @vitali87 in #771
feat(flow): branch-merge loops, try, and Rust if/match in the lean flat walk by @vitali87 in #772
fix(csharp): recover same-scope arity-pair and partial-sibling INHERITS edges by @vitali87 in #774
fix(evals): suppress Roslyn error-recovery phantom members in the C# oracle by @vitali87 in #776
fix(csharp): infer target-typed new() construction sites from the enclosing declaration by @vitali87 in #777
chore(deps): bump mcp from 1.25.0 to 1.28.1 by @dependabot[bot] in #775
fix(providers): register the opus 4.8 1M context window by @vitali87 in #778
refactor: improve exception logging for embedding utilities by @Shashank23123458867504 in #765
fix(parsers): compile JS highlights and add Dart highlights so modifiers and decorators populate by @vitali87 in #779
chore(deps): bump torch from 2.12.1 to 2.13.0 in the uv group across 1 directory by @dependabot[bot] in #781
fix(csharp): dead-code dogfood round 1 on Polly, 190 false flags down to 23 by @vitali87 in #782
fix(csharp): resolve bare-name calls to in-scope local functions and arity-matched overloads by @vitali87 in #784
fix(csharp): reference property reads and type cast receivers so read-only members stay reachable by @vitali87 in #785
fix(csharp): reference whole method-group overload families and dispatch generic calls to generic overloads by @vitali87 in #786
fix(cpp): constructor-temporary chains and macro-attributed definition names by @vitali87 in #783
fix(csharp): resolve fluent-chain receivers, generic member names, and type twins for call recall by @vitali87 in #787
fix(cpp): drop macro-invocation phantom Function nodes, keep recovery-orphaned ctors by @vitali87 in #788
fix(csharp): semantic calls oracle and precision gates for name-trie fabrications by @vitali87 in #789
fix(cpp): reattach recovery-orphaned ctors as class methods and redirect construction CALLS to C++ ctors by @vitali87 in #791
fix(csharp): recover conditional-directive parses and keep same-arity overload families reachable by @vitali87 in #790
Add help command improvements to CLI by @TreavVasu in #793
fix(tests): strip ANSI from CLI help smoke asserts so rich-colorized CI logs pass by @vitali87 in #795
fix(cpp): emit CALLS to base and delegated ctors from member initializer lists by @vitali87 in #792
feat(csharp): Roslyn external-site facts eliminate untypeable-receiver phantom calls by @vitali87 in #794
feat(csharp): AUTO frontend default resolves to hybrid when dotnet is available by @vitali87 in #798
fix(cpp): resolve using-alias and typedef constructions to the aliased class by @vitali87 in #797
fix(cpp): destructor reachability from construction sites by @vitali87 in #799
fix(cpp): recover class and namespace heads swallowed by bare scope-marker macros by @vitali87 in #800
chore: make pre-commit --all-files pass repo-wide by @vitali87 in #801
feat(vector-store): add optional Milvus backend by @zc277584121 in #780
feat(parsers): initialize language grammars lazily (#68) by @vitali87 in #802
feat(embedder): OpenAI-compatible embedding provider by @vitali87 in #803
feat(dart): CALLS extraction from selector chains and named-constructor naming (#140 follow-up) by @vitali87 in #804
feat(csharp): Roslyn facts for projects outside the solution by @vitali87 in #805
feat(dart): receiver type inference for member calls by @vitali87 in #806
feat(dart): recorded return types for class-qualified call locals plus inherited-lookup coverage by @vitali87 in #807
fix(mcp): patch CVE-2026-52869 exposure with mcp>=1.28.1 and a loopback default bind by @vitali87 in #809
fix(io): collapse JS default-export segment when matching sink registries by @vitali87 in #811
fix(traversal): keep Cargo src bin binaries while ignoring build-output bin dirs by @vitali87 in #812
fix(js): ingest mjs cjs mts cts module extension variants by @vitali87 in #810
fix(go): type free-fn call bindings and honor receiver types in flow taint resolution by @vitali87 in #813
fix(io): classify env member assignments as writes by @vitali87 in #814
feat(mcp): bearer authentication for the HTTP endpoint by @vitali87 in #816
feat(flow): switch-family path sensitivity for the lean flow walk by @vitali87 in #815
feat(flow): union taint through ternaries and short-circuit value selection by @vitali87 in #818
fix(flow): branch-and-merge Python match arms by @vitali87 in #817
fix(dart): seed dead-code reachability roots from lexical visibility by @vitali87 in #819
feat(dart): resolve method calls on construction-temporary and factory receivers by @vitali87 in #821
feat(io): C language flow support with a shared libc catalog and Java system properties by @vitali87 in #820
feat(io): model Java java.net/http NETWORK sinks and Socket streams by @vitali87 in #822
fix(incremental): disambiguate cross-language module qn on incremental add by @vitali87 in #823
test(evals): add polyglot cross-language ingestion eval and regression guard by @vitali87 in #824
feat(io): add C# to the I/O subsystem with BCL direct sinks by @vitali87 in #825
feat(csharp): model new-shaped I/O handles (streams, HttpClient, ADO.NET) by @vitali87 in #826
feat(csharp): emit FLOWS_TO taint edges through argument-wrapped sinks by @vitali87 in #828
feat(tools): ast-grep structural search and replace toolkit (#415) by @vitali87 in #827
docs(readme): slim README to a product overview that links to docs/ by @vitali87 in #829
feat(parsers): ast-grep pattern-driven language tier with Ruby support by @vitali87 in #830
feat(readme): auto-generate Latest News from a curated NEWS.md by @vitali87 in #831
docs(readme): remove Fork History section by @vitali87 in #832
feat(graph): detect patterns/smells/security issues via opt-in ast-grep findings (#413) by @vitali87 in #833
docs(news): add Ruby ast-grep tier to Latest News by @vitali87 in #834
fix(findings): stop hardcoded_secret flagging empty strings, templates, env-var names and URLs by @vitali87 in #835
docs: use British English across documentation and user-facing strings by @vitali87 in #836
fix(findings): flag loose inequality (!=) and regression-lock every rule fires by @vitali87 in #837
chore: drop (H) comment markers and the no-docs enforcement hook by @vitali87 in #838
fix(findings): widen xss, sqli and factory rules to catch missed sinks by @vitali87 in #839

New Contributors

@Shashank23123458867504 made their first contribution in #765
@TreavVasu made their first contribution in #793
@zc277584121 made their first contribution in #780

Full Changelog: v0.0.345...v0.0.421