chore(deps-dev): bump code-review-graph from 2.3.6 to 2.3.8

[dependabot]

Bumps code-review-graph from 2.3.6 to 2.3.8.

Release notes

Sourced from code-review-graph's releases.

v2.3.8

Patch release. 85 merged pull requests since v2.3.7, most of them fixes from community reports.

Watch mode stops going quiet

watch was the weakest surface in 2.3.7, and three separate failures could leave the daemon reporting ok while the graph stopped updating:

• OS watches are no longer registered inside ignored trees, so a Maven target/ or a large node_modules cannot exhaust the inotify budget (#811).
• Deleting and recreating a watched directory (rm -rf src && mkdir src, or two ordinary git checkouts) is recognized as a replaced directory rather than a dead watcher, on filesystems that change the inode and on those that hand the same one straight back.
• A repository reached through a symlinked path is watched and indexed instead of silently dropping every event, through both watch --repo and serve --auto-watch (#892).

One graph per repository, however you spell the root

Every path-valued --repo is canonicalized at the CLI boundary, and the full build, incremental update and watch entry points each resolve their root. ., a relative path, a trailing slash, a symlinked path and an absolute path no longer split the graph or reconcile each other away. A run whose stored File nodes all belong to a different root is now refused with a clear error instead of emptying the graph file by file (#889).

Token budgets that hold

#849 found get_affected_flows returning roughly 247k tokens inside a workflow documented as "5 tool calls, 800 tokens total". Measuring all 30 registered tools against a real 5.6k-node graph found the same shape in ten more places. Every response list now carries a hard ceiling, keeps its untruncated total, and reports "showing N of M", so a short answer is distinguishable from a truncated one (#849, #853, #887). Four query tools remain and are tracked in #888.

Honest empty results

Empty results from query_graph, get_impact_radius and semantic_search_nodes now carry a one-sentence confidence field saying why the count is zero — never indexed, graph behind the working tree, a known static-analysis gap for that language, or a verified real absence. Responses that carry results are byte-identical to before (#314, #819, #850, #851).

Also in this release

• code-review-graph forget PATH ... drops already-parsed files without a full rebuild.
• uninstall --platform NAME unbinds a single platform and leaves the rest intact.
• A Voyage AI embedding provider, and embeddings persisted after every batch so an interrupted cloud run keeps its progress (#783).
• Language fixes: C# receiver calls and namespace imports, Swift initializers and subscripts, Java method names, Kotlin import comments, Go generic receivers, Python module-suffix import resolution, jsconfig.json path aliases.
• visualize --serve works offline, and status no longer reports phantom languages.

Full detail in CHANGELOG.md.

v2.3.7

code-review-graph 2.3.7

Maintainer-reconciliation release containing the verified work merged since v2.3.6. The four client-validation drafts remain excluded. No breaking changes.

Highlights

• expanded CLI-first workflows, CommonJS parsing, quiet/JSON output, enrichment, and dead-code analysis
• broader Terraform, Ansible, VB.NET, SystemVerilog, Rust, PHP/Laravel, Julia, Python, C#, Java, Spring, and WebFlux graph coverage
• bounded transitive test coverage, churn risk, weighted impact ranking, graph provenance, documentation-aware embeddings, and safe JSON export
• safer uninstall and platform configuration, including CodeBuddy and official OpenCode contracts
• hardened MCP concurrency, daemon lifecycle, Windows process handling, Git path parsing, ignore rules, community detection, and visualization layout
• updated supported dependency and GitHub Action versions, plus secure fork-PR review handling
• closed all three open high-severity CodeQL alerts

Validation

... (truncated)

Changelog

Sourced from code-review-graph's changelog.

[2.3.8] - 2026-08-21

Added

• Empty results from query_graph, get_impact_radius, and semantic_search_nodes now carry a one-sentence confidence field saying why the count is zero: the target was never indexed, the graph is behind the working tree, a known static-analysis gap applies to that language and query (PHP container resolution and include/require, JS/TS callbacks and route registration, npm-aliased imports, Java AOP and reflection, Go structural interface satisfaction, C# DI, Python getattr and registry decorators), or the zero is a verified real absence. The field is capped at 140 characters and is emitted only when the result list is empty, so responses that carry results are byte-identical to before. One honest sentence is far cheaper than the wrong conclusion or the repo-wide grep a bare zero provokes (#314, #819, #850, #851).
• Added a Voyage AI embedding provider (--provider voyage, key from VOYAGE_API_KEY, opt-in request throttling via CRG_VOYAGE_MIN_INTERVAL_SEC). Embeddings are now persisted after each batch for every provider, so an interrupted cloud run keeps completed batches and re-runs skip up-to-date nodes (#783).
• Added code-review-graph forget PATH [PATH ...] to drop already-parsed files from the graph without a full rebuild. Paths may be absolute, relative to the repository root, a directory (every file underneath is dropped), or a glob pattern, and --dry-run previews the selection. The result is equivalent to rebuilding the graph without those files: surviving referrers are re-parsed so no edge is left pointing at a deleted node, and flows, communities, the FTS index, and embeddings are all repaired (#678).
• Added --platform NAME to code-review-graph uninstall to unbind a single platform's MCP registration while preserving the graph data and every other configured integration. Without --platform the command still performs the full uninstall (#678).

Fixed

• Almost every MCP tool response is now bounded. #849 found get_affected_flows returning roughly 247k tokens inside a workflow documented as "5 tool calls, 800 tokens total"; measuring all 30 registered tools against a real 5.6k-node graph found the same shape in ten more places, several of them on the default path. Each list now carries a hard ceiling, keeps its untruncated total, and reports "showing N of M" in the summary, so a caller can tell a short answer from a truncated one. Four query tools are still unbounded and tracked in #888 (#849, #853, #887).
• A repository is now one graph however its root is spelled. Every path-valued --repo is canonicalized at the CLI boundary, and the full build, incremental update and watch entry points each resolve their root, so ., a relative path, a trailing slash, a symlinked path and an absolute path no longer split the graph or reconcile each other away. An incremental run whose stored File nodes all belong to a different root is refused with a clear error instead of emptying the graph file by file, while orphan-only

... (truncated)

Commits

• 2c6dae3 Merge pull request #901 from tirth8205/chore/lock-2.3.8
• 8841df0 chore(lock): record 2.3.8 for the local package
• eb32c97 Merge pull request #900 from tirth8205/release/v2.3.8
• 2c2487c release: v2.3.8
• 8c71aea Merge pull request #899 from tirth8205/integrate/889-repo-root-identity
• 994dd91 chore: record the new test module and skip vendored eval clones in the SDK sweep
• d5810d2 Merge pull request #894: preserve graphs across repository root spellings
• 84b346e Merge pull request #890 from tirth8205/fix/811-watch-observer-robustness
• 3b278ff test(watch): assert the recreate outcome, not the platform that produced it
• 1eded60 fix: preserve graphs across repository root spellings
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Bumps dev tool code-review-graph from 2.3.6 to 2.3.8 to pick up watch-mode fixes, canonical repo-root handling, and bounded tool responses. Only developer workflows change; runtime behavior is unchanged.

• Developers must reinstall dev dependencies to pick up code-review-graph 2.3.8. If it refuses an incremental run due to a different repo root, rebuild the graph or run with the canonical repo path.

^{Written for commit 4338e4a. Summary will update on new commits.}

[dependabot]

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud