🔒 Security
This release contains a security fix; see the Security Advisories page.
Upgrading is strongly recommended.
Highlights
- Dependency Updates: Includes updates to several dependencies, including uv, certifi and grpcio.
- Security Enhancements: Incorporates an OSS Scanner build image and threat model.
- Data Export: Ensures all node properties within the graph are exported.
- CI Improvements: Confirms breaking changes are documented in release notes and ensures CI checks for this.
- SQL Fixes: Addresses several SQL-related issues including grammar errors and dead-code roots.
- Rust Fixes: Improves indexing of methods and handling of types in Rust code.
- Build Fixes: Repairs build issues related to eMudhra root certificates and distrusted components.
What's Changed
- build(deps): bump the uv group across 1 directory with 2 updates by @dependabot[bot] in #3430
- build(security): add the OSS Scanner build image and threat model by @vitali87 in #3429
- fix(build): move uv, pip and pypi-publish past the emSign root distrust by @vitali87 in #3435
- fix(evals): type the node-exists rows as ResultRow and type-check evals in CI by @vitali87 in #3437
- fix(index): export every node property the graph carries by @vitali87 in #3237
- fix(deps): move certifi to 2026.10.23 and grpcio to 1.84.1 by @vitali87 in #3438
- ci: check that a breaking change carries its release notes by @vitali87 in #3432
- feat(release): publish breaking-change notes in the release body by @vitali87 in #3433
- feat(port): cgr port check pairs two implementations and judges each pair (#3413) by @vitali87 in #3415
- fix(incremental): restore inbound edges after the deferred definition stages by @vitali87 in #3279
- fix(sql): one statement the grammar cannot read costs only that statement by @vitali87 in #3254
- fix(sql): routines are dead-code roots, and DDL that names one calls it by @vitali87 in #3251
- fix(rust): a local built by any constructor, or typed Self, types its calls by @vitali87 in #3247
- fix(calls): each hop of a method chain is sited at its own name by @vitali87 in #3228
- fix(rust): index the methods of an impl for &T, &mut T or *const T by @vitali87 in #3209
- fix(mcp): refuse flow_verdict, explain_traceback and rank_root_causes on an unindexed project by @vitali87 in #3440
- fix: repair red main, and ship nothing main's CI has not passed by @vitali87 in #3448
- fix(build): deselect every distrusted eMudhra root in the image and CI stores by @vitali87 in #3439
Full Changelog: v0.3.2...v0.3.13