🔒 Security
OpenTelemetry Python API: Denial of service through quadratic-time traceparent parsing (medium severity, CVSS 5.3), dependency advisory GHSA-mf5v-w3w3-f6cg / CVE-2026-126360.
Upgrading is strongly recommended.
Highlights
- Type Handling: Improved handling of type receivers, arrays, and element access in TypeScript and JavaScript.
- Import Resolution: Enhanced resolution of imports, particularly for CommonJS renamed properties and path-qualified functions.
- Dead Code Elimination: Removed dead code related to the C, C++, and Scala public API.
- Incremental Builds: Ensured unchanged classes retain their field types across incremental syncs.
- Python Property Access: Scoped Python property reads to their respective receivers.
- Cross-Language Imports: Rejected cross-language internal import targets to improve clarity.
- Constructor Initialisation: Correctly handled attribute field initializers in TS/JS, Java and C# constructors.
New Contributors
- @hahahahahayesyeseys made their first contribution in #2841
- @DYNOSuprovo made their first contribution in #2774
Full Changelog: v0.6.30...v0.6.62
What's Changed
- build(deps): bump rusqlite in /rust/cgr_graph_rs by @dependabot[bot] in #3555
- fix(ts): type receivers through aliases, readonly arrays and element access by @vitali87 in #3309
- fix(js): record side-effect imports as IMPORTS edges by @vitali87 in #3284
- fix(rust): a function reached through a glob use binds exactly by @vitali87 in #3242
- fix(js): bind a CommonJS renamed property export to its function by @vitali87 in #2994
- fix(rust): resolve a path-qualified Type::fn() through the path it is written with by @vitali87 in #2993
- fix(tests): skip a module-scoped fixture over a missing grammar by @vitali87 in #2985
- fix(dead-code): C, C++ and Scala public API is a dead-code root by @vitali87 in #2952
- fix(incremental): unchanged classes keep their field types across a sync by @vitali87 in #3219
- fix(rust,cpp): a member call never binds to a free function by @vitali87 in #3220
- fix(js): select tsconfig customConditions in workspace package exports by @vitali87 in #3012
- fix: scope Python property reads to their receiver by @vitali87 in #3600
- fix: scope Python property reads to their receiver by @hahahahahayesyeseys in #2841
- fix(parsers): reject cross-language internal import targets (#2756) by @vitali87 in #3601
- fix(parsers): reject cross-language internal import targets (#2756) by @DYNOSuprovo in #2774
- fix(calls): attribute TS/JS, Java and C# field initializers to the constructor by @AdityaxDeore in #3526
- fix(java): type try-with-resources variables and catch parameters by @AdityaxDeore in #3525
- chore(deps): bump grpcio from 1.85.0 to 1.85.1 by @dependabot[bot] in #3596
- chore(deps-dev): bump ty from 0.0.95 to 0.0.98 by @dependabot[bot] in #3593
- chore(deps): bump tree-sitter-scala from 0.26.3 to 0.26.4 by @dependabot[bot] in #3592
- chore(deps): bump anthropics/claude-code-action from 1.0.265 to 1.0.269 by @dependabot[bot] in #3590
- chore(deps): bump SonarSource/sonarqube-scan-action from 8.4.0 to 8.4.1 by @dependabot[bot] in #3589
- chore(deps): bump pip from 26.2.2 to 26.3 in /scripts by @dependabot[bot] in #3598
- chore(deps): bump golang from
c65ecfetoaf1bfc2in /.oss-scanner by @dependabot[bot] in #3599 - chore(deps): bump sigstore/cosign-installer from 4.1.2 to 4.1.3 by @dependabot[bot] in #3588
- chore(deps): bump memgraph/lab from 3.14.1 to 3.14.2 in /codebase_rag by @dependabot[bot] in #3597
- fix(rename): keep a Java or C# method's signature in the name the contract expects by @vitali87 in #2710
- fix(js-ts): a method call no longer also calls a same-named module function by @vitali87 in #3207
- fix(trace): a Python frame whose name the file lacks is unresolved by @vitali87 in #3082
- fix(csharp): an overloaded extension method's call reaches its overload set by @vitali87 in #3083
- fix(rename): keep a JS/TS shorthand property's key; rename namespace destructures by @vitali87 in #3301
- fix(cli): print names and paths literally in report tables and diff-index by @vitali87 in #2672
- fix(io): Dart and PHP reads and writes get their READS_FROM / WRITES_TO by @vitali87 in #3119
- fix(deps): bump opentelemetry-api to 1.45.2 for GHSA-mf5v-w3w3-f6cg by @vitali87 in #3605
New Contributors
- @hahahahahayesyeseys made their first contribution in #2841
- @DYNOSuprovo made their first contribution in #2774
Full Changelog: v0.6.30...v0.6.62