🔒 Security
This release contains a security fix; see advisory GHSA-6q48-6c7w-9gw2.
Upgrading is strongly recommended.
Highlights
- CodeQL: Improved handling of interface implementers and Python calls for more accurate analysis.
- Checks: Enhanced error reporting for invalid function calls and missing parameters.
- Python: Added support for inferring instance attributes from annotations.
- Tracing: Now reads gzip-compressed Xdebug traces.
- CI/Release: Updated to scan pull requests from forks and manage release labels.
- Rust: Improved handling of macro calls and workspace listings.
- General: Various fixes for import resolution, naming conflicts, and project syncing.
What's Changed
- fix(incremental): keep interface implementers of unchanged files by @vitali87 in #3299
- fix(check): stop false too_many on unbound Python calls and *rest after a default by @vitali87 in #2946
- fix(check): fail on a keyword the callee rejects or a required parameter left unfilled by @vitali87 in #2947
- fix: infer Python instance attributes from annotations by @mvanhorn in #3345
- build(deps): bump github/codeql-action/upload-sarif from 4.38.3 to 4.39.0 by @dependabot[bot] in #3395
- ci(release): release a breaking change at once instead of waiting for the cadence by @vitali87 in #3408
- fix(trace): read gzip-compressed Xdebug traces by @vitali87 in #3409
- build(deps-dev): bump pre-commit from 4.6.2 to 4.7.0 by @dependabot[bot] in #3405
- build(deps-dev): bump semgrep from 1.178.0 to 1.181.0 by @dependabot[bot] in #3403
- build(deps): bump python from
51dafdetoa2b82f3by @dependabot[bot] in #3401 - build(deps): bump astral-sh/uv from
cdc6093to4a1f366by @dependabot[bot] in #3400 - build(deps): bump astral-sh/setup-uv from 10.2.0 to 10.3.0 by @dependabot[bot] in #3399
- build(deps): bump anthropics/claude-code-action from 1.0.240 to 1.0.252 by @dependabot[bot] in #3398
- build(deps): bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml from 2.6.0 to 2.7.0 by @dependabot[bot] in #3397
- build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.2 by @dependabot[bot] in #3396
- fix(agent): settle tool approvals in cgr start -a and MCP ask_agent by @vitali87 in #2727
- fix(rust): a turbofish call inside a macro gets its CALLS edge by @vitali87 in #3238
- fix(incremental): re-parse the files that attach members to a re-indexed module by @vitali87 in #3280
- fix(incremental): keep the declared namespaces of unchanged PHP files by @vitali87 in #3297
- fix(js-ts): a default-imported class types its instances by @vitali87 in #3233
- fix(cli): sweep the project's glosses on cgr delete-project by @vitali87 in #3322
- fix(gloss): repair only the syncing project's unattached notes by @vitali87 in #3319
- fix(check): skip the files a sync would not index by @vitali87 in #3289
- fix(endpoints): a mount in a package's init.py keeps its prefix by @vitali87 in #3263
- fix(parse): UTF-16 and UTF-32 sources with a BOM are parsed as their text by @vitali87 in #3222
- fix(js): keep a whole-module import's IMPORTS edge on that module by @vitali87 in #3287
- fix(calls): resolve a function used as a collection value in its enclosing scope by @vitali87 in #3273
- fix(parsers): walk deep Rust/Go/C++ bodies iteratively and contain call-pass failures per caller by @vitali87 in #3269
- fix(rust): a workspace listing its root package as "." indexes on Python 3.12 by @vitali87 in #3268
- fix(io): a same-origin URL is a resource of the project that requests it by @vitali87 in #3262
- fix(traceback): analyse every ExceptionGroup member, beside the group's stack by @vitali87 in #3321
- fix(mcp): answer out-of-range input and unknown symbols in the tools' own words by @vitali87 in #3315
- fix(check): a caller that dropped its call with the callee is not dangling by @vitali87 in #3314
- fix(rename): refuse a Go method that satisfies an in-project interface by @vitali87 in #3305
- fix(dart): resolve imports of the project's own package to its modules by @vitali87 in #3291
- fix(check): report importers of a deleted or moved module by @vitali87 in #3285
- fix(endpoints): gorilla/mux routes take their verb from the .Methods chain by @vitali87 in #3265
- fix(sync): start every reingest from empty Python inference caches by @vitali87 in #2977
- fix(check): --isolated refuses only over IO links the checked project anchors by @vitali87 in #3258
- fix(mcp): endpoint_callers resolves its target and refuses one naming no endpoint by @vitali87 in #3255
- ci: switch CodeQL to advanced setup so pull requests from forks are scanned by @vitali87 in #3394
- build(deps): bump certifi from 2026.7.22 to 2026.10.19 in the uv group across 1 directory by @dependabot[bot] in #3416
- ci(release): maintainer-only "release now" label, and cancel superseded bump runs by @vitali87 in #3417
- fix(ci): turn off gRPC fork handlers in tests and patch virtualenv by @vitali87 in #3421
New Contributors
Full Changelog: v0.2.10...v0.2.16