v1.6.10

# GitNexus v1.6.10

> **The resolution-correctness release.** Receiver chains are now typed from AST structure in all 14 languages, imports resolve against declared module configuration instead of path-suffix guesses, and interface dispatch understands generic instantiation — while analyze itself gained a single-writer lock, an atomic index swap and a bounded buffer pool. 396 commits since v1.6.9.

## ✨ Highlights

- 🧬 **Receiver chains are typed from AST structure across all 14 languages**, with an explicit lower bound on what the graph is willing to claim. Inline constructors, closure-valued bindings, generic-typed fields and named receivers all resolve now. (#2708, #2744, #2747, #2833, #2855)
- 📦 **Imports resolve against real module configuration** — tsconfig paths, Java/Kotlin declared packages, Go module paths, PHP Composer autoload maps, Python `__init__.py` re-exports — instead of guessing from path suffixes. (#2953, #2955, #2984, #2987, #2990, #2864)
- 🍃 **Spring modeling goes deep** — AOP transactions, caching and security, `@Bean` factories, `@Resource` and constructor injection, profiles, conditions and auto-configuration, plus a full bean candidate inventory. (#2783, #2740, #2678, #2632, #2494)
- 🛡️ **Analyze got much harder to break** — a single-writer lock on the index write path, atomic index swap with read-pool invalidation, a bounded buffer pool sized to the graph, the large-repo OOM cascade fixed, and schema versions derived from a DDL fingerprint instead of a hand-incremented constant. (#2658, #2614, #2560, #2649, #2798)
- 🔒 **MCP hardening** — a repository allowlist, fail-closed read-only mode, deterministic ordering on every capped query, and bounded output budgets, so `impact` and `context` are reproducible run to run. (#2787, #2796)
- 🧭 **New surfaces** — NestJS decorator routes so `api_impact` stops calling live endpoints non-existent, full Codex support with hooks and a plugin marketplace, CodeBuddy and Qoder integrations, a `bunx` lane for bun-only machines, and one-click Render deploy. (#3017, #2369, #2368, #2765, #2804)

---

## ⚠️ Breaking changes

- **Node `^22.18.0 || >=24.11.0` is now the supported floor**; the `@types/uuid` stub is dropped
- **The non-functional `group` matching knobs are gone** — `matching.bm25_threshold`, `matching.embedding_threshold`, `detect.embedding_fallback` in `group.yaml`, the `gitnexus group sync --skip-embeddings` flag, and the MCP `group_sync` `skipEmbeddings` argument (#3020)

## 🚀 Added

- **Spring framework modeling expanded end to end** — AOP transactions, caching and security (#2783), `@Bean` factories and `@Resource` injection (#2740), profiles/conditions/auto-configuration (#2678), constructor and standard injection (#2632), bean candidate inventory (#2494), configuration-property consumers, and non-HTTP handler entry points (#2891)
- **Receiver chains typed from AST structure across all 14 languages**, with an explicit epistemic lower bound on what the graph can claim (#2708, #2744, #2747)
- **Java enum constant bodies modeled as first-class instances**, with JLS 13.1 anonymous-class naming (#2558)
- **More route surfaces indexed** — Java constant-based route paths such as `@PostMapping(ApiPathConstants.X)` (#2980) and JavaScript data route tables (#2972)
- **MCP server hardening** — repository allowlist, fail-closed read-only mode, deterministic output budgets, and normalized `impact`/`context` aliases
- **`bunx` lane so bun-only machines can run GitNexus** (#2765)
- **Codex support** — hooks, plugin marketplace and setup (#2328, #2369) — plus CodeBuddy and Qoder coding-agent integrations (#2368)
- **Skills mirrored to `.agents/skills/`** when an `.agents/` directory exists
- **One-click Render deploy** (#2804)
- **`serve` origin/proxy configuration is validated and port-scoped** (#2820)
- **Expanded TypeScript/JavaScript taint sink model** (#2490)
- **Wiki generation accepts explicit HTTP LLM hosts** (#2491)
- **Embedding request-body dimensions configurable** via `GITNEXUS_EMBEDDING_REQUEST_DIMS` (#2574)
- **Refreshed MiniMax model and endpoint configuration** (#2780)
- **`MAX_CALLABLE_VALUE_TARGETS` and `MAX_PROPERTY_DISPATCH_FANOUT` configurable via env** (#2725, #2726)
- **Opt-in `analyze --self-commit`** for AGENTS.md/CLAUDE.md churn (#2640)
- **Buffer pool sized to the graph before the database opens**, with an adaptive size hint
- **CI review agent runs as a coordinated reviewer swarm** on Sonnet 5 with structured, linked reviews (#2570, #2572), alongside the GitNexus Engineering Tool Kit skills (#2566) and an online skill-evolution loop (#2571)
- **Icebug community-engine prototype behind a gate** (#2376)

## 🐛 Fixed

- **`group sync` stops claiming matching it never did** — the advertised BM25/embedding cascade was config, help text and MCP schema with no matcher behind it; the unread `matching.bm25_threshold`, `matching.embedding_threshold`, `detect.embedding_fallback` and `--skip-embeddings` surfaces are removed (#3020)
- **Emitted Next.js build output is ignored during ingestion**, and the inert `public/build` entry is deleted (#3018)
- **NestJS decorator routes are indexed** so `api_impact` and `route_map` stop reporting live endpoints as non-existent (#3017)
- **Import resolution gated by real module configuration** instead of path-suffix guessing — TypeScript config (#2953, #2956), Java and Kotlin declared packages (#2955, #2990), Go module paths (#2984), PHP Composer autoload maps (#2987), Python `__init__.py` re-exports (#2864) and unaliased dotted namespace imports (#2826, #2828), and JavaScript module extensions (#3034)
- **Interface dispatch is generic-instantiation aware** (#2912, #2939), fans out from Case 3b receivers (#2832, #2842) and from C# record interface calls (#2904), and resolves through generic-typed field receivers in every language (#2833, #2855)
- **Go method sets modeled exactly** so interface satisfaction is decidable (#2813, #2829), out-of-repo package qualifiers resolve, and an undecided interface check is no longer reported as a decided negative (#2873, #2921)
- **Go pointer-receiver calls resolve**, reporting the program boundary instead of hedging (#2766, #2782)
- **Java record support** — graph nodes for `record_declaration`, component accessors, enum and record interface heritage (#2564, #2916, #2935, #2936), plus `E.CONST.method()` enum-constant receiver dispatch (#2561) and JLS binary-name identities for local classes, enums, records and interfaces (#2562, #2653)
- **Rust module-qualified calls resolve against the module tree** (#2730, #2741), items are qualified by their enclosing `mod` chain (#2742, #2745), duplicate type names stay ambiguous in range binding (#2514, #2652), and `Box<dyn Trait>` names normalize
- **Closure bindings are call sources in every language**, and function-local values carry their own identity (#2693, #2695, #2699, #2718)
- **A named receiver's member never resolves lexically** (#2714), platform builtins stop resolving to unrelated same-file symbols (#2549), and inline constructor receivers are typed in every spelling (#2708, #2737)
- **Python calls resolve through constructor-injected fields** (#2628) and module-imported classes (#2770)
- **Package directories that repeat higher in the path resolve correctly** (#2881, #2929)
- **`check` stops reporting erased and deferred imports as initialization cycles** (#2934)
- **`detect_changes` no longer scales its query with the diff's hunk count** (#2915, #2930), and CR-only line-ending diffs are ignored (#2839)
- **`group` stops reporting what could not be measured as a measurement of zero** (#3012), resolves HTTP consumers through configured clients and constant route tables (#3008), and preserves manifest-only impact crossings (#2784)
- **`impact` and `context` are reproducible** — deterministic ordering on every capped query (#2787, #2796) — and Convex caller results are marked incomplete rather than empty (#3044)
- **Object handler identity is preserved** during ingestion (#3046), nested source directories are discovered (#3043), and parse-node insertion is canonicalized
- **Large-repo analyze OOM and the false worker-timeout cascade are fixed** (#2649, #2679)
- **Single-writer lock on the index write path** (#2658, #2677), atomic index swap with read-pool staleness invalidation (#2614), and reliable large incremental writeback commits (#2409, #2425)
- **Remote URLs are stripped of credentials before they are persisted** (#2914, #2928), and every registry write gets its own tmp path (#2888, #2920)
- **Schema version derived from a DDL fingerprint** instead of a hand-incremented constant (#2798, #2808), and the scope-resolution relation cross product is fully declared (#2792, #2793)
- **FTS reliability** — binary payloads stay out of the description column and an unbuildable index is confined to its own table (#2919), FTS-indexed DML is gated before the incremental writeback (#2841, #2854), analyze degrades instead of aborting on index-build failure (#2548), real LOAD errors surface and broken extension files self-heal (#2374, #2375), and Windows missing-dependency load failures are diagnosed (#2383)
- **`VECTOR` is loaded only when needed** (#3045) and before the incremental writeback touches embedding rows (#2623, #2624)
- **Buffer pool bounded instead of taking the native 80%-of-RAM default** (#2560), scaled by the OS page-size granule ratio (#2631, #2636), with a COPY-safe floor and actionable diagnostics for non-4K page sizes (#2424)
- **`Napi::Error` SIGABRT on analyze eliminated** — C++ type lookups are indexed and workers terminate only at JS-safe points (#2432, #2436)
- **Native-load failures fail closed**, including truncated-binary SIGBUS (#2441, #2651), and glibc-too-old loads are no longer misdiagnosed (#2672, #2689)
- **Index staleness reporting fixed** — no false-stale status after analyze, with inline staleness in `query`/`context`/`impact`/`cypher` (#2655, #2668, #2683)
- **Windows path handling** — the `\\?\` long-path prefix no longer breaks repo path matching (#2667, #2700), `parts` negation is honored (#2720), and missing-shadow errors let `serve` repo-switch recover (#2382, #2387)
- **Embeddings survive partial failures** — unparseable 200 responses are retried (#2790, #2795), batch inserts are retry-safe (#2453), HTTP generation is resumable, resume checkpoints bind to their provider, and proxy-blocked installs self-heal (#2370, #2372)
- **Custom HTTP embedding endpoint failures are reported as themselves**, not as Hugging Face download errors (#2385, #2386)
- **Exact symbol content with 0-based line storage and 1-based MCP display** (#2377, #2379, #2380)
- **`rename` reports every edit that apply writes** and reconciles its report on partial failure (#2605)
- **Global registry transactions serialized across processes** (#2716)
- **Swift indented conditional directives are preprocessed** so class bodies survive parsing (#2771), and Swift member-containment pairs are declared in the `CONTAINS` DDL (#2769)
- **JavaScript `exports.foo = function () {}` CommonJS exports are indexed** (#2723, #2729), and `const X = () => {}` is no longer double-indexed as a Function plus an edgeless Const twin (#2687, #2691)
- **JVM sibling injection is proximity-bounded** (#2732), and C#/Kotlin free calls are gated by instance ownership (#2563, #2654)
- **Dart extension type symbols are extracted** (#2539), and declarations recover after embedded NUL bytes (#2430)
- **CLI and hooks fail loudly on backend error payloads**, with an MCP query hint when the server owns the DB lock (#2396, #2397)
- **Committed agent guides stop churning**, with an `--index-only` nudge (#2907, #2927), and `gitnexus-plan` artifacts publish on macOS without an interpreter (#2905, #2922)
- **The 300-flows cap is removed for large repositories** (#2198)

## 🔧 Changed

- **Structural relationships are held out of the JS heap by default** during analyze (#2680, #2685)
- **Global ignore support** — `core.excludesFile`, `.git/info/exclude`, and a user-level global ignore file are honored (#2606)
- **Plugin manifests sync on every version bump** (#2445), and planning output under `docs/plans` is no longer tracked

## ⚡ Performance

- **Import resolution indexed instead of scanned** — every scanning resolver with a consolidated memo (#2911), a per-run workspace index for Go/C#/Dart/Ruby (#2898), and Kotlin import resolution (#2872)
- **MCP server startup drops the analyze-only language-provider closure** (#2802, #2806)
- **C++ qualified namespace members indexed once per pipeline run** (#2788, #2794)
- **Vendored Leiden O(communities × N) copy removed**, with Icebug wired to its real API (#2337, #2692)
- **`core.excludesFile` / `info/exclude` resolution memoized** (#2606)

<details>
<summary><b>📦 Chore / Dependencies</b> — 132 dependency &amp; CI-action bumps</summary>

- **Security overrides** — `sharp` pinned to >=0.35.0 for the libvips vulnerabilities (#2993) and `adm-zip` to >=0.6.0 for a memory-allocation vulnerability (#2992)
- **gitnexus runtime (53 bumps)** — `@ladybugdb/core` through 0.18.3 (#2473, #2634, #2863, #2924), `js-yaml` 4.3.0 → 5.3.0 (#2618, #2710, #2831, #3024, plus the 5.0.0 revert in #2596), `tsx` ×7, `@types/node` ×5, `express-rate-limit` ×3, `@modelcontextprotocol/sdk` (#2815), `node-addon-api` 8.9.0 → 8.9.2 (#2816, #3002), `uuid` 14.0.2 (#3025), `vitest` 4.1.11 (#3027), the Babel 8 toolchain, `hono`, `fast-uri`, `brace-expansion`, `ip-address`, `body-parser`
- **gitnexus-web (43 bumps)** — `vite` ×3, `@vitejs/plugin-react` ×3, `@vercel/node` ×4, `react-i18next` ×3, `lucide-react` ×3, `@langchain/core`, `@langchain/langgraph`, `@langchain/anthropic`, `axios`, `@tailwindcss/vite`, `wait-on`, `@testing-library/jest-dom`
- **CI actions (34 bumps)** — the CodeQL action group, the Docker build/login/metadata/buildx/qemu suite, `actions/setup-node` v6→v7, `actions/setup-python`, `actions/attest-build-provenance`, `release-drafter` ×3, `dorny/paths-filter` ×2, `ossf/scorecard-action`, `raven-actions/actionlint`, `softprops/action-gh-release`, plus `tar`, `mermaid` and `dompurify`
- **CI hardening** — Windows shard watchdog widened with exit diagnostics (#2449), the platform-sensitive matrix sharded to fix the Windows cross-platform timeout (#2394), and CI Report no longer dies silently when the tests job fails (#2728)

</details>

---

## 📥 Upgrade

```bash
npm install -g gitnexus@1.6.10
```

Then re-index — this release changes how receivers, imports and interface dispatch resolve, so an existing index will not carry the new edges:

```bash
gitnexus analyze
```

**Full changelog:** [`v1.6.9...v1.6.10`](https://github.com/abhigyanpatwari/GitNexus/compare/v1.6.9...v1.6.10)