code-graph-rag v0.0.639 Adds Runtime Call Tracing for Seven Language Runtimes and Interprocedural Taint Propagation

GitHub·medium signalXBlueskyLinkedInCopy link

vitali87/code-graph-rag (4,331 stars) cut v0.0.639 on 2026-08-14 at 18:54 UTC, adding runtime call tracing for Go, JVM, Node.js, .NET, PHP, Lua and Dart on top of its static graph, plus argument taint propagation into a callee's sinks via parameter-sink summaries, pass-through return taint, and closure-capture taint for the Python flow walk. FLOWS_TO lean-walk coverage expanded to Lua and to positional parameter slots in Java, C#, Rust and C. The project also instituted a CI policy shipping security patches out-of-cadence with a mandatory release disclaimer — a governance detail worth copying for anyone maintaining a code-analysis tool agents depend on.