⚠️ Breaking changes
A repository's .cgr.md no longer reaches the agent's system prompt until you approve its content. cgr start and cgr optimize show the file and ask (the default is no), and remember the approval until the file changes. cgr start -a and the MCP server's ask_agent cannot ask, so they skip a .cgr.md you have not approved and log why. Your own ~/.cgr.md loads as before.
To keep the old behaviour, approve each repository's file once in cgr start, or export CGR_TRUST_PROJECT_INSTRUCTIONS=true in your shell or CI environment to load every repository's file without asking (a .env file cannot set it, since it usually belongs to the repository). Use the variable only for repositories you control, such as CI on your own code.
Existing installs: nothing is approved yet, so the first cgr start in each repository with a .cgr.md asks once. Until then, non-interactive runs work without the file. See Project instructions.
Highlights
- Dependencies Updated: Several dependencies have been updated to the latest versions, including neo4j, qdrant-client, and memgraph/lab, bringing in bug fixes and new features.
- Rust Performance Improvements: Optimisations have been made to the Rust indexer, including hashing definitions and computing interface fingerprints more efficiently.
- CLI Enhancements: The
change_signatureoperation is now accessible through the CLI and MCP, with improved handling for partial graphs. - Security Focus: Enhanced security measures include approving .cgr.md files, prompting before reading credential files, and annotating MCP tools.
- Graph-RS Testing: Expanded fuzz testing for the Graph-RS component with new targets and improved input decoding.
- MiniMax Models Added: Current MiniMax text models have been included.
- CI Improvements: Various CI updates include running CodeQL on all pull requests and streamlining cache management.
What's Changed
- fix(build): pin the last pip installs and base images by hash by @vitali87 in #3449
- build(deps): bump neo4j from 6.3.1 to 6.4.1 by @dependabot[bot] in #3470
- build(deps-dev): bump semgrep from 1.181.0 to 1.182.1 by @dependabot[bot] in #3469
- build(deps): bump qdrant-client from 1.19.1 to 1.20.0 by @dependabot[bot] in #3468
- build(deps-dev): bump ruff from 0.16.10 to 0.17.2 by @dependabot[bot] in #3467
- build(deps): bump regex from 2026.9.10 to 2026.9.29 by @dependabot[bot] in #3466
- build(deps): bump memgraph/lab from 3.13.2 to 3.14.0 in /codebase_rag by @dependabot[bot] in #3463
- build(deps): bump qdrant/qdrant from v1.19.2 to v1.20.0 in /codebase_rag by @dependabot[bot] in #3462
- build(deps): bump golang from 1.27.2-trixie to 1.27.3-trixie in /.oss-scanner by @dependabot[bot] in #3460
- build(deps): bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml from 2.6.0 to 2.7.0 by @dependabot[bot] in #3454
- build(deps): bump actions/setup-python from 7.0.0 to 7.1.0 by @dependabot[bot] in #3453
- build(deps): bump astral-sh/setup-uv from 10.3.0 to 10.3.2 by @dependabot[bot] in #3452
- build(deps): bump github/codeql-action/upload-sarif from 4.39.0 to 4.39.1 by @dependabot[bot] in #3451
- chore: ignore every .env.* file except .env.example by @vitali87 in #3450
- build(deps): bump @ruby/prism from 1.9.0 to 2.0.0 in /evals/oracles/ruby_oracle by @dependabot[bot] in #3465
- build(deps): bump eclipse-temurin from 21-jdk to 25-jdk in /.oss-scanner by @dependabot[bot] in #3459
- build(deps): bump github/codeql-action/init from 4.39.0 to 4.39.1 by @dependabot[bot] in #3455
- build(deps): bump syn from 3.0.6 to 3.0.9 in /evals/oracles/rs_oracle by @dependabot[bot] in #3464
- build(deps): bump memgraph/memgraph-mage from 3.3 to 3.7 in /codebase_rag by @dependabot[bot] in #2723
- perf(indexer): hash definitions in Rust on py-tree-sitter's own trees by @vitali87 in #3475
- build(deps): hold the OSS Scanner image's python base at 3.12 by @vitali87 in #3484
- build(deps): bump docker/login-action from 4.6.0 to 4.7.0 by @dependabot[bot] in #3483
- build(deps): bump anthropics/claude-code-action from 1.0.252 to 1.0.261 by @dependabot[bot] in #3482
- build(deps-dev): bump zensical from 0.0.65 to 0.0.72 by @dependabot[bot] in #3479
- build(deps): bump transformers from 5.19.0 to 5.20.2 by @dependabot[bot] in #3478
- build(deps-dev): bump coverage from 7.16.2 to 7.17.0 by @dependabot[bot] in #3477
- build(deps): bump filelock from 4.2.1 to 4.2.4 by @dependabot[bot] in #3476
- test(graph-rs): add the fuzz input decoder and the Cypher and JSON fuzz targets by @vitali87 in #3442
- feat(signature): the change_signature operation (#1533, 4/9) by @vitali87 in #2166
- perf(indexer): walk each Python scope once, in Rust when the tree bridge can by @vitali87 in #3492
- test(graph-rs): add the graph procedures fuzz target by @vitali87 in #3443
- build(deps): bump anthropics/claude-code-action from 1.0.261 to 1.0.262 by @dependabot[bot] in #3486
- build(deps): bump astral-sh/uv from 0.13.5 to 0.13.6 by @dependabot[bot] in #3487
- build(deps): bump pydantic-settings from 2.15.0 to 2.16.1 by @dependabot[bot] in #3490
- build(deps): bump tree-sitter-scala from 0.26.2 to 0.26.3 by @dependabot[bot] in #3491
- perf(indexer): compute interface fingerprints in Rust on the tree bridge by @vitali87 in #3495
- test(graph-rs): add the bulk writer and walk fuzz target by @vitali87 in #3444
- ci(fuzz): build and run the graph-rs cargo-fuzz targets in ClusterFuzzLite by @vitali87 in #3494
- fix(cli): refuse rename and change-signature over a partial graph, and mark their own re-ingest by @vitali87 in #3493
- fix: index Haskell operator and infix definitions by @mvanhorn in #3485
- feat(signature): expose change_signature through the CLI and MCP, with docs (#1533, 5/9) by @vitali87 in #2164
- feat(security)!: approve a repository's .cgr.md before it loads, ask before reading credential files, and annotate MCP tools by @vitali87 in #3471
- fix(mcp): classify change_signature as a destructive writer by @vitali87 in #3501
- build(deps): bump tree-sitter-markdown from 0.5.1 to 0.5.4 by @dependabot[bot] in #3489
- build(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0 by @dependabot[bot] in #3481
- build(deps-dev): bump ty from 0.0.84 to 0.0.91 by @dependabot[bot] in #3480
- build(deps): bump mcp from 1.30.0 to 2.3.0 by @dependabot[bot] in #3488
- test(graph-rs): add the fuzz package manifest by @vitali87 in #3445
- fix(graph-rs): run pagerank iteration counts past u32::MAX like Python by @vitali87 in #3441
- fix(sync): retire the incomplete-run markers of runs a full rebuild supersedes by @vitali87 in #3496
- docs: add an accessibility statement and a barrier report form by @vitali87 in #3498
- fix(ci): run CodeQL on pull requests into any branch by @vitali87 in #3497
- ci: restore no cache in the runs that publish the wheels or the image by @vitali87 in #3504
- ci: drop pull_request_target and persisted checkout credentials by @vitali87 in #3502
- feat: add current MiniMax text models by @octo-patch in #3422
- ci(release): publish a deferred release once main's CI passes by @vitali87 in #3507
- ci(release): leave a deferred release as a draft by @vitali87 in #3508
Full Changelog: v0.3.13...v0.4.5