Dev build 3.0.17-dev.cbe895a

Dev build from commit cbe895a0454df8bfe21ac6a321e91b03888460b4 on main.

Dev build 3.0.13-dev.88695fd

Dev build from commit 88695fdc389891679a87ae1c83d5e0251a69470c on main.

Dev build 3.0.11-dev.f786334

Dev build from commit f786334a324b310cdf04d1c2af6c50a4adb0766b on main.

Dev build 3.0.10-dev.e00a5f4

Dev build from commit e00a5f4227568dad954d44b08772ef0313f8cbce on main.

v3.0.4 Performance

Native engine goes full-stack: CFG, AST nodes, and WASM double-parse elimination. This release completes the native engine migration — CFG computation and AST node extraction now run in Rust for 8 languages, eliminating the redundant WASM pre-parse on native builds.

Performance

• native: compute CFG in Rust native engine for all 8 languages (JS/TS/TSX, Python, Go, Rust, Java, C#, Ruby, PHP) — ports buildFunctionCFG algorithm to Rust with per-language CfgRules, eliminates WASM re-parsing in CFG phase (#342)
• native: extract AST nodes (call, new, throw, await, string, regex) for all non-JS languages in Rust via shared walk_ast_nodes_with_config() — astMs drops from ~651ms to ~50ms (#340)
• builder: skip ensureWasmTrees entirely when native engine provides complete CFG + dataflow + AST data — wasmPreMs drops from ~388ms to 0 on native builds (#344)

Bug Fixes

• native: fix function-scoped const declarations being incorrectly extracted as top-level constants (#344)
• benchmark: show all build phases (astMs, cfgMs, dataflowMs, wasmPreMs) in benchmark report and document v3.0.0→v3.0.3 native regression cause (#339)

3.0.3 (2026-03-04)

Note: 3.0.2 was an internal/unpublished version used during development.

Dev build 3.0.6-dev.39b34ea

Dev build from commit 39b34eacb117e536d397f8ba04de8aea5f2bed7d on main.

v3.0.3 Performance

Performance

• ast: use single transaction for AST node insertion — astMs drops from ~3600ms to ~350ms (native) and ~547ms (WASM), reducing overall native build from 24.9 to 8.5 ms/file (#333)

v3.0.2 Patch

Dataflow goes multi-language, build performance recovery, and native engine parity fixes. This patch extends dataflow analysis from JS/TS-only to all 11 supported languages, recovers build performance lost after CFG/dataflow became default-on, fixes language-aware identifier collection in dataflow, and closes a native engine scoping bug for constants.

Features

• dataflow: extend dataflow analysis to all supported languages (Python, Go, Rust, Java, C#, PHP, Ruby) with per-language DATAFLOW_RULES and makeDataflowRules() factory (#318)

Bug Fixes

• dataflow: use isIdent in collectIdentifiers for language-aware referencedNames — fixes PHP variable_name and other non-identifier node types being missed in return statements (#324)
• native: skip local constants inside function bodies — the native JS extractor incorrectly extracted function-scoped const as top-level constants (#327)
• native: enable extended kinds (parameters, properties, constants, receivers) in parity tests and update native binary to v3.0.1 (#327)

Performance

• builder: fix v3.0.1 build performance regression (14.1 → ~5.8 ms/file) — eliminate redundant WASM parsing via ensureWasmTrees(), memoize createParsers(), filter CFG/dataflow to changed files only (#325)

Documentation

• update build performance, query, and incremental benchmarks for 3.0.1 (#321, #322, #323)

v3.0.1 Patch

Post-release fixes and dataflow multi-language expansion. This patch extends dataflow analysis (flows_to, returns, mutates edges) from JS/TS-only to all 11 supported languages, enables --cfg and --dataflow by default on builds, closes several native/WASM engine parity gaps, and fixes miscellaneous issues found during v3.0.0 dogfooding.

Features

• dataflow: extend dataflow analysis to all supported languages (Python, Go, Rust, Java, C#, PHP, Ruby, Terraform) (221a791)
• builder: enable --cfg and --dataflow by default on builds (#312)

Bug Fixes

• native: close engine parity gap between native and WASM (#292) (#309)
• native: extract new/throw/await/string/regex AST nodes in native engine (#306) (#314)
• native: bump native engine version to 3.0.0 (#305) (#310)
• queries: include role-based entry points in flow --list (#313)
• benchmark: handle missing WASM grammars gracefully in benchmark scripts (#311)
• ci: prevent duplicate benchmark PRs on stable releases (#304)

Documentation

• document dataflow multi-language support in README (851f060)
• mark resolved bugs and suggestions in dogfood reports (#316)
• add dogfood report for v3.0.0 (#307)
• update build performance, query, and incremental benchmarks for 3.0.0 (#298, #299, #300)

Chores

• ci: include Cargo.toml in publish version bump commit (#315)
• ci: replace npm ci with npm install in benchmark and license workflows (#308)

v3.0.0

Dataflow analysis, intraprocedural CFG, AST node storage, expanded node/edge types, and a streamlined CLI surface. This release introduces three new analysis dimensions — dataflow tracking (flows_to, returns, mutates edges), intraprocedural control flow graphs for all 11 supported languages, and stored queryable AST nodes (calls, new, string, regex, throw, await). The type system expands with parameter, property, and constant node kinds plus contains, parameter_of, and receiver edge kinds, enabling structural queries without reading source. Export gains GraphML, GraphSON, and Neo4j CSV formats plus an interactive HTML viewer (codegraph plot). A stable normalizeSymbol utility standardizes JSON output across all commands. The CLI surface is streamlined by consolidating redundant commands into fewer, more capable ones.

⚠ BREAKING CHANGES

• mcp: MCP tools fn_deps, symbol_path, and list_entry_points removed — use query with deps/path modes and execution_flow with list mode instead (d874aa5)
• cli: commands fn and path removed — use query instead; query --path replaced by standalone path <from> <to> (d874aa5)
• cli: commands batch-query, hotspots, manifesto, and explain removed — use batch, triage --level, check, and audit --quick respectively (4f08082)

Features

• cli: add dataflow analysis — build --dataflow extracts flows_to, returns, mutates edges tracking data movement through functions (JS/TS MVP), with dataflow command, MCP tool, and batch support (#254)
• cli: add intraprocedural control flow graph (CFG) — build --cfg constructs basic-block CFGs from tree-sitter AST, cfg command with text/DOT/Mermaid output (#274)
• cli: extend CFG to all supported languages — Python, Go, Rust, Java, C#, Ruby, PHP with per-language CFG_RULES and cross-language processIf/processSwitch/processTryCatch (#283)
• cli: add stored queryable AST nodes — persist calls, new, string, regex, throw, await nodes in ast_nodes table, queryable via ast command with SQL GLOB pattern matching (#279)
• cli: expand node types with parameter, property, constant kinds and parent_id column for sub-declaration queries across all 9 WASM extractors (#270)
• cli: add expanded edge types — contains (file→definition, parent→child), parameter_of (inverse), receiver (method-call dispatch) (#279)
• cli: add exports <file> command — per-symbol consumer analysis with re-export detection and counts (#269)
• export: add GraphML, GraphSON, Neo4j CSV formats and interactive HTML viewer (codegraph plot) with hierarchical/force/radial layouts, complexity overlays, and drill-down (#268)
• cli: add normalizeSymbol utility for stable 7-field JSON schema across all query and search commands (#267)
• cli: add batch-query multi-command mode with splitTargets() for comma-separated expansion and multiBatchData() for mixed-command orchestration (#256)
• queries: expose fileHash in where and query JSON output (#257)
• builder: add scoped rebuild for parallel agents (#269)

Bug Fixes

• queries: correct reexport query direction and add exports integration tests (#276)
• parser: correct extractor line counts and duplicate section numbering (fa7eee8)
• triage: map triage sort values to valid hotspot metrics (a1583cb)
• complexity: fix C# language ID mismatch (c_sharp → csharp) in COMPLEXITY_RULES, HALSTEAD_RULES, and COMMENT_PREFIXES (#283)
• dataflow: handle spread args, optional chaining, and reassignment in dataflow extraction (#254)

Refactoring

• consolidate MCP tools — reduce surface from 32 to 29 by merging fn_deps/symbol_path/list_entry_points into query and execution_flow (#263)
• consolidate CLI — remove 5 redundant commands (batch-query, hotspots, manifesto, explain, query --path) in favor of unified alternatives (#280)
• consolidate MCP tools to match CLI changes from PR #280 (cbda266)
• consolidate CFG rules with defaults factory and validation (#284)
• align dataflow.js with normalizeSymbol and ALL_SYMBOL_KINDS (#285)

Documentation

• add architecture audit and roadmap for v2.7.0 (5fe0a82)
• add competitive deep-dives for Joern and Narsil-MCP (#260, #262, #264, #265)
• add one-PR-one-concern rule to git conventions (#281)
• update references to consolidated CLI commands (#282)
• add TypeScript migration as Phase 4 in roadmap (#255)
• add Claude Code MCP registration to recommended practices (#273)

Chores

• add CLA Assistant workflow (#244)
• add pre-commit diff-impact hook (#271)
• remove stale benchmark files from generated/ (#275)