chore(deps): bump @optave/codegraph-linux-x64-musl from 3.9.3 to 3.9.4 by dependabot[bot] · Pull Request #963 · optave/ops-codegraph-tool

dependabot · 2026-04-18T10:23:22Z

Bumps @optave/codegraph-linux-x64-musl from 3.9.3 to 3.9.4.

Release notes

Sourced from @optave/codegraph-linux-x64-musl's releases.

v3.9.4

Resolution accuracy and incremental-build reliability. The JS/TS extractor now resolves named function references passed as callback arguments — Express middleware, event handlers, Array.map/.filter/.then callbacks, and destructured handler bindings are tracked as real call edges instead of appearing as dead code. On a 1 895-file TypeScript monorepo this surfaced 21 previously-invisible callers of a single auth middleware. A version-mismatch bug that silently forced every native incremental build into a full 5.8s rebuild is fixed — no-op rebuilds now exit in ~200ms. Three WASM incremental-build bugs are also fixed: edge loss during reverse-dep purges, unnecessary reparses, and a V8 crash during GC of orphaned WASM trees. Fan-in/out and import counts are now consistent between full and incremental build paths.

Bug Fixes

js-extractor: resolve named function references passed as arguments — middleware, callback, and handler references emit dynamic call edges; destructured bindings from factory calls emit function definitions, eliminating false "dead-unresolved" results for functions passed by reference (#947)

wasm: resolve incremental edge loss, unnecessary reparses, and V8 crash — save-and-reconnect approach preserves edges without reparsing reverse-dep files; error-path tree cleanup prevents GC crashes (#938)

native: resolve version-mismatch that broke incremental builds — no-op rebuild dropped from 5.8s to 214ms (#928, #930)

structure: reconcile import_count semantics between fast path and full path — both paths now consistently count distinct imported files (#942)

include imports-type in fast-path fan_in/fan_out queries — aligns incremental metrics with full-build behavior for files with type-only imports (#948)

rust: fix test compilation errors in extractor tests — renamed Import.path → Import.source and missing build_import_edges arguments (#950)

ci: add resilience to Claude Code workflow for fork branch races — concurrency groups and pre-flight branch verification with 3 retries (#949)

Performance

native: port full-build structure computation to Rust — eliminates JS DB round-trip through reconstructFileSymbolsFromDb() on full builds (#937)

native: defer NativeDatabase.openReadWrite until after change detection — saves ~60ms on every incremental build invocation, no-op builds exit before opening native connection (#939)

native: raise native edge-building threshold to smallFilesThreshold — small incrementals (≤5 files) use JS edge path to avoid napi-rs marshaling overhead (#940)

Chores

disable adaptive thinking via CLAUDE_CODE_DISABLE_ADAPTIVE_THINKING env var (#943)

Changelog

Sourced from @optave/codegraph-linux-x64-musl's changelog.

3.9.4 (2026-04-17)

Resolution accuracy and incremental-build reliability. The JS/TS extractor now resolves named function references passed as callback arguments — Express middleware, event handlers, Array.map/.filter/.then callbacks, and destructured handler bindings are tracked as real call edges instead of appearing as dead code. On a 1 895-file TypeScript monorepo this surfaced 21 previously-invisible callers of a single auth middleware. A version-mismatch bug that silently forced every native incremental build into a full 5.8s rebuild is fixed — no-op rebuilds now exit in ~200ms. Three WASM incremental-build bugs are also fixed: edge loss during reverse-dep purges, unnecessary reparses, and a V8 crash during GC of orphaned WASM trees. Fan-in/out and import counts are now consistent between full and incremental build paths.

Bug Fixes

js-extractor: resolve named function references passed as arguments — middleware, callback, and handler references emit dynamic call edges; destructured bindings from factory calls emit function definitions, eliminating false "dead-unresolved" results for functions passed by reference (#947)

wasm: resolve incremental edge loss, unnecessary reparses, and V8 crash — save-and-reconnect approach preserves edges without reparsing reverse-dep files; error-path tree cleanup prevents GC crashes (#938)

native: resolve version-mismatch that broke incremental builds — no-op rebuild dropped from 5.8s to 214ms (#928, #930)

structure: reconcile import_count semantics between fast path and full path — both paths now consistently count distinct imported files (#942)

include imports-type in fast-path fan_in/fan_out queries — aligns incremental metrics with full-build behavior for files with type-only imports (#948)

rust: fix test compilation errors in extractor tests — renamed Import.path → Import.source and missing build_import_edges arguments (#950)

ci: add resilience to Claude Code workflow for fork branch races — concurrency groups and pre-flight branch verification with 3 retries (#949)

Performance

native: port full-build structure computation to Rust — eliminates JS DB round-trip through reconstructFileSymbolsFromDb() on full builds (#937)

native: defer NativeDatabase.openReadWrite until after change detection — saves ~60ms on every incremental build invocation, no-op builds exit before opening native connection (#939)

native: raise native edge-building threshold to smallFilesThreshold — small incrementals (≤5 files) use JS edge path to avoid napi-rs marshaling overhead (#940)

Chores

disable adaptive thinking via CLAUDE_CODE_DISABLE_ADAPTIVE_THINKING env var (#943)

Commits

6fa49a8 docs: prepare release notes for v3.9.4 (#952)
7244dbf fix(ci): split impact workflow for fork PR compatibility (#951)
7a47ce2 feat(js-extractor): resolve named function references passed as arguments (#947)
b961d1c fix(ci): add resilience to Claude Code workflow for fork branch races (#949)
3640e51 fix: include imports-type in fast-path fan_in/fan_out queries (#948)
e1c0d66 fix(rust): fix test compilation errors and add verification rule to CLAUDE.md...
01d7f8a docs(backlog): add Weft-inspired items #103 and #104 (#945)
5c986f4 chore: disable adaptive thinking via env var (#943)
060685f fix(structure): reconcile import_count semantics between fast path and full p...
a770c23 perf(native): defer NativeDatabase.openReadWrite until after change detection...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [@optave/codegraph-linux-x64-musl](https://github.com/optave/ops-codegraph-tool) from 3.9.3 to 3.9.4. - [Release notes](https://github.com/optave/ops-codegraph-tool/releases) - [Changelog](https://github.com/optave/ops-codegraph-tool/blob/main/CHANGELOG.md) - [Commits](v3.9.3...v3.9.4) --- updated-dependencies: - dependency-name: "@optave/codegraph-linux-x64-musl" dependency-version: 3.9.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

greptile-apps · 2026-04-18T10:25:27Z

Greptile Summary

This dependabot PR bumps @optave/codegraph-linux-x64-musl from 3.9.3 to 3.9.4, picking up bug fixes for incremental build reliability and JS/TS call-edge resolution. However, the resulting lock file has two concerns worth investigating before merging:

The libc runtime-constraint fields are stripped from all three Linux platform packages in package-lock.json (including the un-bumped linux-arm64-gnu and linux-x64-gnu at 3.9.3), suggesting the lock file was regenerated with a different npm version. Without libc, npm cannot distinguish glibc vs. musl environments and may install the wrong native binary on Linux.
@optave/codegraph-linux-x64-musl is now listed under the root dependencies block in the lock file (not optionalDependencies), unlike all other platform siblings, which may cause it to be treated as a mandatory dependency on non-musl hosts.

Confidence Score: 3/5

Not safe to merge until the libc field removal and lock file dependencies placement are verified as intentional and correct.

Two P1 findings in package-lock.json: loss of libc discrimination for Linux platform packages and asymmetric placement of one sibling in dependencies vs. optionalDependencies. These could cause the wrong native binary to be installed on Linux environments, leading to runtime failures.

package-lock.json — specifically the libc field removal and the new root dependencies entry for linux-x64-musl.

Important Files Changed

Filename	Overview
package.json	Bumps `@optave/codegraph-linux-x64-musl` to 3.9.4 in optionalDependencies while leaving all other platform siblings at 3.9.3, creating a cross-platform version skew.
package-lock.json	Updates resolved/integrity for musl package; removes `libc` constraints from gnu and musl packages (including un-bumped 3.9.3 packages), and adds musl package under root `dependencies` block — both of which indicate the lock file was regenerated with a different npm version and may cause wrong platform binaries to be selected on Linux.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[npm install] --> B{Detect platform}
    B -->|linux/x64 + glibc\nBEFORE| C[Installs linux-x64-gnu@3.9.3\nSkips linux-x64-musl\nlibc=glibc match only]
    B -->|linux/x64 + musl\nBEFORE| D[Installs linux-x64-musl@3.9.3\nSkips linux-x64-gnu\nlibc=musl match only]
    B -->|linux/x64 + glibc\nAFTER| E[Installs linux-x64-gnu@3.9.3\nMay ALSO install linux-x64-musl@3.9.4\nno libc field to discriminate]
    B -->|linux/x64 + musl\nAFTER| F[Installs linux-x64-musl@3.9.4\nMay ALSO install linux-x64-gnu@3.9.3\nno libc field to discriminate]
    style E fill:#ffcccc
    style F fill:#ffcccc

_{Reviews (1): Last reviewed commit: "chore(deps): bump @optave/codegraph-linu..." | Re-trigger Greptile}

greptile-apps · 2026-04-18T10:25:31Z

@@ -1330,25 +1328,19 @@
      "cpu": [
        "x64"
      ],
-      "libc": [
-        "glibc"
-      ],
      "license": "Apache-2.0",
      "optional": true,
      "os": [
        "linux"
      ]
    },
    "node_modules/@optave/codegraph-linux-x64-musl": {
-      "version": "3.9.3",
-      "resolved": "https://registry.npmjs.org/@optave/codegraph-linux-x64-musl/-/codegraph-linux-x64-musl-3.9.3.tgz",
-      "integrity": "sha512-a9mBp6T+5YoEt1gpyVKs1s5lOmQd/UAtSlNIc5NkxXyQgyWrZID8zUbVX9nWpZzGghotAeX/nmUqWo1kwZA95w==",
+      "version": "3.9.4",
+      "resolved": "https://registry.npmjs.org/@optave/codegraph-linux-x64-musl/-/codegraph-linux-x64-musl-3.9.4.tgz",
+      "integrity": "sha512-ducrB0b/OLXcNGxUee7Y3Too3YpwJ86NqfrmD/n10vi/tUT0EkE11XnPF9DVD03vlkcWiGBJY+xxhLmTEgjCeg==",


libc constraints removed from un-bumped platform packages

The libc field is removed from @optave/codegraph-linux-arm64-gnu and @optave/codegraph-linux-x64-gnu (both still at 3.9.3) even though neither version changed. The libc field is how npm distinguishes glibc vs. musl environments on Linux — without it, both the gnu and musl platform packages will match any linux/x64 system, so Alpine (musl) containers may now pull in the glibc binary, and glibc systems may pull in the musl binary. This looks like the lock file was regenerated with a different npm version that strips these fields, rather than being an intentional change.

greptile-apps · 2026-04-18T10:25:32Z

      "version": "3.9.3",
      "license": "Apache-2.0",
      "dependencies": {


linux-x64-musl added to root dependencies (not optionalDependencies)

@optave/codegraph-linux-x64-musl is now listed under the root package's dependencies block in the lock file, while in package.json it remains under optionalDependencies. The other platform siblings (linux-arm64-gnu, linux-x64-gnu, etc.) are not listed in this block. This asymmetry could cause npm to treat this one platform package as a mandatory dependency on non-musl environments, which is likely unintentional.

greptile-apps · 2026-04-18T10:25:33Z

@@ -135,7 +135,7 @@
    "@optave/codegraph-darwin-x64": "3.9.3",


Platform package version skew

@optave/codegraph-linux-x64-musl is bumped to 3.9.4 while all other platform binaries (darwin-x64, linux-arm64-gnu, linux-x64-gnu, win32-x64-msvc) remain at 3.9.3. The 3.9.4 release notes mention native ABI changes (renamed Import.path → Import.source, new build_import_edges arguments). If the JS host layer expects a consistent binary interface across all platform packages, mixing versions may cause silent mismatches on non-musl environments.

dependabot · 2026-04-18T21:21:02Z

Looks like @optave/codegraph-linux-x64-musl is up-to-date now, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 18, 2026

greptile-apps Bot reviewed Apr 18, 2026

View reviewed changes

dependabot Bot closed this Apr 18, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/optave/codegraph-linux-x64-musl-3.9.4 branch April 18, 2026 21:21

github-actions Bot locked and limited conversation to collaborators Apr 18, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump @optave/codegraph-linux-x64-musl from 3.9.3 to 3.9.4#963

chore(deps): bump @optave/codegraph-linux-x64-musl from 3.9.3 to 3.9.4#963
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/optave/codegraph-linux-x64-musl-3.9.4

dependabot Bot commented on behalf of github Apr 18, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Apr 18, 2026

Uh oh!

greptile-apps Bot Apr 18, 2026

Uh oh!

greptile-apps Bot Apr 18, 2026

Uh oh!

greptile-apps Bot Apr 18, 2026

Uh oh!

dependabot Bot commented on behalf of github Apr 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Apr 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v3.9.4

Bug Fixes

Performance

Chores

3.9.4 (2026-04-17)

Bug Fixes

Performance

Chores

Uh oh!

greptile-apps Bot commented Apr 18, 2026

Greptile Summary

Confidence Score: 3/5

Important Files Changed

Flowchart

Uh oh!

greptile-apps Bot Apr 18, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Apr 18, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Apr 18, 2026

Choose a reason for hiding this comment

Uh oh!

dependabot Bot commented on behalf of github Apr 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Apr 18, 2026 •

edited

Loading