Martin Vogel
4fdcdd4239
fix(security): close open scanner alerts
...
Dependabot/CodeQL #33 — postcss XSS GHSA-qx2v-qp2m-jg93:
npm audit fix in graph-ui (8.5.8 -> 8.5.14, above the <8.5.10 vuln range)
CodeQL #39 — TOCTOU race in artifact.c ensure_gitattributes():
Replace stat() + fopen() with open(O_WRONLY|O_CREAT|O_EXCL).
Atomic create-only-if-absent closes the check-vs-write window.
Falls through to merge driver setup if file already exists.
CodeQL #55 — pip install not pinned in release.yml:
Pin build==1.3.0 and twine==6.2.0. Comment explains why
--require-hashes is not used (transitive-deps overhead).
Dismissed (won't-fix):
- #56 contents: write — required for 'gh release edit --draft=false';
no narrower permission exists.
- #54-51 Crystal grammar warnings — vendored upstream code.
- #50-40 Agda grammar warnings — vendored upstream code.
2026-05-05 00:51:52 +02:00
Martin Vogel
18fa9979ee
Replace vmem with mimalloc global allocator, add extraction-phase prescan, fix __init__.py QN collision
...
Memory management:
- Vendor mimalloc v2.1.9 as global allocator (MI_OVERRIDE=1 in prod)
- New mem.h/mem.c: RSS-based budget tracking via mi_process_info()
- Remove vmem.c/vmem.h (mmap-based budget tracking)
- Remove slab tier2 bump allocator (~300 LOC); >64B goes to mimalloc
- Slab tier1 pages from malloc (= mimalloc) instead of vmem
- Arena blocks from malloc instead of vmem
- Budget raised from 35% to 50% RAM (no more untracked C++ heap)
Extraction-phase prescan (eliminates disk re-reads):
- HTTP call sites: keyword check + URL extraction during extraction
- HTTP routes: decorator + source-based extraction during extraction
- Config file refs: regex scan during extraction
- httplinks: 41.8s → 13ms on Linux kernel (3,212x faster)
- configlink: 41.4s → 0.8s on Linux kernel (54x faster)
- Linux kernel fast-mode total: 2m38s → 1m18s
Bug fixes:
- __init__.py Module QN no longer collides with Folder QN
- index.ts same fix for JS/TS packages
- 13 regression tests for QN collision at FQN + extraction layers
- search_graph/search_code default limit raised from 10 to 500k
- Resolve all clang-tidy, cppcheck, and clang-format warnings
Repo cleanup:
- tree-sitter-form, tree-sitter-magma moved to tools/
- .gitignore: build/, node_modules/, graph-ui/dist/, TEST_PLAN.md
2026-03-17 22:05:57 +01:00
Martin Vogel