🔒 Security
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early (high severity, CVSS 7.5), dependency advisory GHSA-6fqq-452j-qhrp / CVE-2026-107286.
Upgrading is strongly recommended.
Highlights
- Type Handling: Improved handling of type context managers, walrus operators, and match binding targets in both Python and TypeScript.
- Rename Refinement: Prevented Go renames from unexporting names used by other packages.
- Profile Naming: Corrected the naming of pprof profiles to avoid "malformed" errors when no samples are present.
- Output Budget: Increased the Anthropic output budget to improve the default thinking experience.
- Module Resolution: Resolved issues with module resolution in various scenarios, including ES module default imports and bare name bindings.
- Dead Code Elimination: Removed dead code roots associated with IPython rich-display methods.
- Incremental Refresh: Improved incremental refresh to ensure callers are updated when dispatch targets change.
What's Changed
- fix(py): type contextmanager, walrus and match binding targets by @vitali87 in #3585
- fix(py): type contextmanager, walrus and match binding targets by @AdityaxDeore in #3528
- fix(java): calls on an enum constant or a new expression resolve by @vitali87 in #3125
- fix(trace): name a pprof profile with no samples instead of calling it malformed by @vitali87 in #3040
- fix(rename): refuse a Go rename that unexports a name another package uses by @vitali87 in #3093
- fix(dead-code): a pub trait's methods are exported by @vitali87 in #2950
- docs(trace): pass the JVM agent to Maven tests through Surefire's argLine by @vitali87 in #3057
- fix(incremental): refresh callers when dispatch targets change by @AdityaxDeore in #3527
- fix(schema): Resource declares the project its ENDPOINT kind carries by @vitali87 in #3120
- fix(findings): str.format() queries and os.system f-strings are injection by @vitali87 in #3077
- fix(providers): raise the Anthropic output budget so default thinking fits by @vitali87 in #2980
- fix(python): bind a bare name to no function its module cannot see by @vitali87 in #2968
- fix(ts): bind a method called on a free function's result by @vitali87 in #2962
- fix(csharp): a call on an
as-cast receiver binds the cast's type by @vitali87 in #2960 - fix(dead-code): IPython rich-display methods are dead-code roots by @vitali87 in #2956
- fix(dart): locate call sites at the callee so rename can rewrite them by @vitali87 in #2782
- fix(js-ts): resolve a call through an ES-module default import to the default export by @vitali87 in #2743
- build(deps-dev): bump pytest from 9.1.1 to 9.2.0 by @dependabot[bot] in #3549
- build(deps): bump pyo3 in /rust/cgr_graph_rs by @dependabot[bot] in #3554
- chore(deps): bump the codeql-action group with 3 updates by @dependabot[bot] in #3586
- feat(move): graph-aware move of a module-level definition (#1534) by @vitali87 in #2907
- chore(deps-dev): bump ruff from 0.17.3 to 0.17.4 by @dependabot[bot] in #3595
- chore(deps): bump jsonschema from 4.25.1 to 4.26.0 by @dependabot[bot] in #3594
- chore(deps): bump astral-sh/uv from 0.13.6 to 0.13.7 by @dependabot[bot] in #3591
- chore(deps): bump docker/login-action from 4.7.0 to 4.8.0 by @dependabot[bot] in #3587
- fix(calls): type a field hop where the field is declared by @vitali87 in #3292
- fix(incremental): keep Go result types and package clauses of unchanged files by @vitali87 in #3281
- fix(ts): read tsconfig as JSONC without eating "@/" and "**/.ts" by @vitali87 in #3229
- fix(incremental): requeued annotations keep the types they already resolved to by @vitali87 in #3218
- fix(rust): type a local from a helper reached through an inline module or module path by @vitali87 in #3010
- fix(python): follow a star re-export to type a receiver by @vitali87 in #2989
Full Changelog: v0.6.0...v0.6.30