From fa66a9c7285951231661f8482ae3263c046c0d28 Mon Sep 17 00:00:00 2001 From: Helweg Date: Tue, 20 Oct 2026 13:59:16 +0200 Subject: [PATCH] chore(release): prepare v0.37.1 --- .claude-plugin/marketplace.json | 2 +- .claude-plugin/plugin.json | 2 +- .codex-plugin/plugin.json | 2 +- CHANGELOG.md | 18 ++++++++++++++---- CONTRIBUTING.md | 2 +- SECURITY.md | 2 +- package-lock.json | 4 ++-- package.json | 4 ++-- 8 files changed, 23 insertions(+), 13 deletions(-) diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json index ce8917df..31749834 100644 --- a/.claude-plugin/marketplace.json +++ b/.claude-plugin/marketplace.json @@ -10,7 +10,7 @@ "name": "codebase-index", "description": "Semantic code search and codebase graph tools for Claude Code", "source": "./", - "version": "0.37.0" + "version": "0.37.1" } ] } diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json index c3655bde..4711c3a6 100644 --- a/.claude-plugin/plugin.json +++ b/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "codebase-index", - "version": "0.37.0", + "version": "0.37.1", "description": "Semantic code search and codebase graph tools for Claude Code", "displayName": "Codebase Index", "author": { diff --git a/.codex-plugin/plugin.json b/.codex-plugin/plugin.json index 745fc391..8f8ac0d5 100644 --- a/.codex-plugin/plugin.json +++ b/.codex-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "codebase-index", - "version": "0.37.0", + "version": "0.37.1", "description": "Semantic code search and codebase graph tools for Codex", "author": { "name": "Kenneth", diff --git a/CHANGELOG.md b/CHANGELOG.md index 86b9ef5e..41d3d8a7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,14 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [0.37.1] - 2026-10-20 + ### Added -- **Watcher failure diagnostics for contributors**: Retain bounded, test-owned observations and private fixture snapshots only when the default-root-build watcher rejection scenarios fail, with failure-only CI artifact pickup. Production watcher behavior, consumer assertions, and test deadlines are unchanged; unavailable internal observations are explicitly marked missing. +- **Watcher failure diagnostics for contributors** (#451): Retain bounded, test-owned observations and private fixture snapshots only when the default-root-build watcher rejection scenarios fail, with failure-only CI artifact pickup. Production watcher behavior, consumer assertions, and test deadlines are unchanged; unavailable internal observations are explicitly marked missing. + +### Changed + +- **Runtime dependencies** (#446, #449): Update the internal queue from `p-queue` 9.3.3 to 10.0.0 and locked Zod from 4.6.5 to 4.6.7. The published Node.js minimum remains 22.13. Custom-provider `requestIntervalMs` values above 2,147,483,647 ms are now rejected by the queue instead of overflowing Node's timer delay. +- **Development toolchain** (#447, #448, #449): Update tsup from 8.5.1 to 9.0.0, the Pi development host to 1.3.0, Vitest and coverage tooling to 5.0.5, and typescript-eslint to 8.71.2. Development requires Node.js 22.19 or newer within 22.x, 24.11 or newer within 24.x, or 26 or newer; this does not raise the published runtime floor. +- **Linked citation regression coverage** (#453): Assert selected caller-test citation paths and source ranges alongside the existing linkage expectations without changing production test-discovery behavior. ### Fixed -- **Large BM25 index saves** (#452): Stream borrowed native index data directly to a lease-owned temporary file instead of cloning the index and transferring complete JSON through a JavaScript string. Preserve the existing JSON format, atomic rename and cleanup, and structural generation ordering; report buffered-write failures before publication. -- **Pi real-host prompt tests**: Use Pi 1.3's user-trigger/options runner API and raise only the development host floor to 1.3, retaining sibling section/append preservation and intentional override assertions in both extension orders. The optional Pi peer contract, production extension, legacy string-return fallback, and omp behavior are unchanged. +- **Fresh-checkout builds**: Build the native module before TypeScript's built-CLI smoke so `npm ci` followed by `npm run build` works without a pre-existing native binding. Keep the actual CLI smoke enabled. +- **Large BM25 index saves** (#452, #454): Stream borrowed native index data directly to a lease-owned temporary file instead of cloning the index and transferring complete JSON through a JavaScript string. Preserve the existing JSON format, atomic rename and cleanup, and structural generation ordering; report buffered-write failures before publication. The native `save(destination)` option is a backward-compatible API addition supporting this fix. +- **Pi real-host prompt tests** (#448): Use Pi 1.3's user-trigger/options runner API, retaining sibling section/append preservation and intentional override assertions in both extension orders. The optional Pi peer contract, production extension, legacy string-return fallback, and omp behavior are unchanged. ## [0.37.0] - 2026-10-16 @@ -1035,7 +1044,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - File watcher for automatic re-indexing - OpenCode tools: `codebase_search`, `index_codebase`, `index_status`, `index_health_check` -[Unreleased]: https://github.com/Helweg/open-codebase-index/compare/v0.37.0...HEAD +[Unreleased]: https://github.com/Helweg/open-codebase-index/compare/v0.37.1...HEAD +[0.37.1]: https://github.com/Helweg/open-codebase-index/compare/v0.37.0...v0.37.1 [0.37.0]: https://github.com/Helweg/open-codebase-index/compare/v0.36.3...v0.37.0 [0.36.3]: https://github.com/Helweg/open-codebase-index/compare/v0.36.2...v0.36.3 [0.36.2]: https://github.com/Helweg/open-codebase-index/compare/v0.36.1...v0.36.2 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index e384ff4d..a5c82090 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -42,7 +42,7 @@ Use this when you just want the shortest path to a good PR: ### Prerequisites -- Node.js 22.19 or newer for development (required by the Pi development dependencies). Node.js 24 LTS is recommended. The published package supports Node.js 22.13 or newer. +- Development Node.js range: `^22.19.0 || ^24.11.0 || >=26.0.0` (Pi and tsup development dependencies). Node.js 24.11+ LTS is recommended. The published package still supports Node.js 22.13 or newer. - Rust toolchain (for native module) - npm diff --git a/SECURITY.md b/SECURITY.md index f4fe9f06..526cf599 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -54,7 +54,7 @@ Track override decisions in [#379](https://github.com/Helweg/open-codebase-index | `postcss@>=8.0.0 <8.5.26` | `^8.5.26` | Retain the sourceMappingURL map-file-disclosure floor from commit `5b0cf22`, including earlier PostCSS fixes | | `vite@>=8.0.0 <8.0.16` | `^8.0.16` | [GHSA-v6wh-96g9-6wx3](https://github.com/advisories/GHSA-v6wh-96g9-6wx3) and [GHSA-fx2h-pf6j-xcff](https://github.com/advisories/GHSA-fx2h-pf6j-xcff) | -The development-only `tsup@^8.1.0` override replaces its `esbuild` edge with `^0.28.1`. Current `tsup@8.5.1` declares `^0.27.0`, whose fresh resolution is vulnerable `0.27.7`: [GHSA-g7r4-m6w7-qqqr](https://github.com/advisories/GHSA-g7r4-m6w7-qqqr), a low-severity Windows development-server file-read issue fixed in `0.28.1`. This is an intentional, scoped parent-range exception, not a claim that every declared range is satisfied. The native CLI/YAML, bundler, built CLI, full suite, and both minimum-runtime packed identities were exercised on macOS ARM64; this does not establish Windows or Linux runtime coverage. Remove the exception when tsup supports a patched esbuild range; do not restore a global pin that downgrades chord's exact `0.28.2` edge. +The retained development-only `tsup@^8.1.0` override replaces its `esbuild` edge with `^0.28.1`. It was introduced for `tsup@8.5.1`, whose declared `^0.27.0` range resolved to vulnerable `0.27.7`: [GHSA-g7r4-m6w7-qqqr](https://github.com/advisories/GHSA-g7r4-m6w7-qqqr), a low-severity Windows development-server file-read issue fixed in `0.28.1`. This scoped parent-range exception does not apply to the current root `tsup@9.0.0`, which declares patched `esbuild@^0.28.2`; the selector is retained pending separate override cleanup. Do not restore a global pin that downgrades chord's exact `0.28.2` edge. The prior override review exercised the native CLI/YAML, bundler, built CLI, full suite, and both minimum-runtime packed identities on macOS ARM64; that historical evidence does not establish current-release qualification or Windows/Linux runtime coverage. ### Removed Overrides and Resolved Pi Exception diff --git a/package-lock.json b/package-lock.json index 1412429b..dd48e5fd 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "opencode-codebase-index", - "version": "0.37.0", + "version": "0.37.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "opencode-codebase-index", - "version": "0.37.0", + "version": "0.37.1", "license": "MIT", "dependencies": { "@modelcontextprotocol/sdk": "^1.29.0", diff --git a/package.json b/package.json index 2f6d9b3c..4fadc381 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "opencode-codebase-index", - "version": "0.37.0", + "version": "0.37.1", "description": "Host-neutral semantic codebase search with embeddings, symbol discovery, and call-graph tooling", "type": "module", "main": "dist/index.js", @@ -38,7 +38,7 @@ "node": ">=22.13.0" }, "scripts": { - "build": "npm run build:ts && npm run build:native", + "build": "npm run build:native && npm run build:ts", "build:ts": "tsup && node scripts/smoke-test-built-cli.mjs", "smoke:package": "node scripts/smoke-test-packed-cli.mjs", "build:native": "cd native && cargo build --release && napi build --release --platform",