chore(deps): bump codebase-memory-mcp from 0.8.1 to 0.9.0

[dependabot]

Bumps codebase-memory-mcp from 0.8.1 to 0.9.0.

Release notes

Sourced from codebase-memory-mcp's releases.

v0.9.0

codebase-memory-mcp v0.9.0

A large robustness and platform-support release since v0.8.1 — first-class Windows support, big indexing performance and memory-safety gains, broad extraction-accuracy fixes across many languages, and a substantially better graph UI.

Highlights

• First-class Windows support — end-to-end non-ASCII path handling, installer/runtime reliability fixes, a UI-hang fix, and a native windows-arm64 build + smoke pipeline.
• Indexing performance & resilience — a kernel-scale campaign cut indexing wall-time ~61% with deterministic output, plus a crash/hang supervisor that quarantines a bad file and indexes the rest instead of aborting the whole run.
• Memory safety on large repositories — accurate Linux RSS accounting, peak-vs-live reconciliation, bounded parallel retention for low-RAM machines, and a use-after-free fix in cross-thread slab frees.
• Graph UI — a configurable node budget up to 10M nodes with scaled rendering and contrast controls, dead-code filtering, node code preview, GitHub deep-links, URL routing, and offline label rendering (no remote font fetches).
• Extraction accuracy — many CALLS / IMPORTS / route-extraction correctness fixes across C/C++, Python, Go, PHP, Kotlin, Java, TypeScript/JavaScript, Rust, and more.

What's changed

Windows support

End-to-end non-ASCII path support (_wfopen, wide-argv + CreateProcessW, escaped/NUL-terminated worker command lines); installer reliability and Mark-of-the-Web docs; a git-spawn handle-inheritance fix that resolved a UI deadlock; drive-letter handling in the hook augmenter; large-.db size handling; a real error when Windows persistence export fails; and a full native windows-arm64 build + smoke pipeline.

Indexing, performance & memory safety

~61% faster kernel-scale indexing with deterministic output; a TypeScript-at-scale cascade fix with parallel-only crash recovery; a crash/hang supervisor that quarantines the culprit file; accurate /proc RSS on Linux; peak-vs-live RSS reconciliation; bounded, source-capped parallel retention for low-RAM peak RSS; supervised-subprocess RSS isolation for background auto-index/watcher; an O(1) aligned-page cross-thread slab-free fix (use-after-free); graph-buffer upsert-contract and mem-budget fixes; host-tiered RAM budget; and per-file indexing failures now reported via skipped[] + a logfile instead of failing silently.

LSP / extraction accuracy

CALLS-edge correctness (string-dispatch edges, C/C++ enclosing-function attribution, receiver-aware self-recursion, recursion-depth caps in py/go/php/kotlin, a memoized guard for a Python exponential re-eval hang); route/HTTP extraction (reject filesystem paths so client routes join server routes, canonicalize parameterized paths, Spring routes on Kotlin controllers, Django REST @action); imports/resolution (IMPORTS keyed by local name, reject non-file-like targets, tsconfig alias ../ climbs, mixed Java/Kotlin callgraph edges, stable Java USAGE ownership); plus Class.lines accuracy, INHERITS/IMPLEMENTS counted in degree, a heap-allocated walk_defs frame stack fixing stack overflow on deep files, and a reproduce-first bug suite with a 5-platform board.

Graph UI

Node budget up to 10M with scaled rendering and contrast controls; offline label rendering (no remote CDN fonts); dead-code filtering, node code preview, and GitHub deep-links; URL routing, filter-panel UX and camera fly-to; the filter sidebar stays visible when everything is filtered out; Windows folder navigation in the index picker; indexing-job failures surfaced instead of silently completing; projects unwatched on UI delete; bounded octree recursion for coincident points.

MCP server & CLI

Structured tool metadata; the CLI accepts flags, stdin, and --args-file with per-tool --help; project resolution by internal name + ghost-DB filtering and a project_name alias; trace_path no longer conflates distinct same-named functions and follows CROSS_* edges; valid UTF-8 snippets for non-UTF-8 sources; correct JSON control-char escaping; cypher label-filtered traversal no longer truncates at 10 and preserves node properties through WITH; get_architecture overview subset; detect_changes honors since.

Discovery, watcher & lifecycle

Honor .git/info/exclude, global core.excludesFile, and linked-worktree ignore sources; honor exclusions in pkgmap/path-alias/envscan walks; .cbmignore negation can no longer un-skip safety-core dirs; deploy/ dirs no longer double-indexed; scoped search handles repo paths with spaces; prune projects whose root stays missing; an auto_watch config gate; correct canonical_root for worktrees and subdirectory projects; ADR preservation across full re-index.

Grammars, build & docs

Vendored InterSystems ObjectScript grammars and the Mojo parser; SBOM now computes the grammar count and completes the non-MIT license summary. Full validation pipeline on PRs with superseded-run cancellation; issue-triage bots; per-leg smoke gating that fixes matrix collapse / false-green; gcc-15 and Nix-on-macOS build fixes. Config-file reference and extra_extensions docs.

Thanks to our contributors

This release includes merged work and reported issues from a large community. Thank you:

@​77652189 · @​alexisperinger-ux · @​Andy11-cpu · @​apappas1129 · @​BombaxCeiba · @​Bortlesboat · @​caioribeiroclw-pixel · @​catsmonster · @​Flipper1994 · @​Golevka2001 · @​GothUncc · @​HackAttack · @​halindrome · @​imateusdev · @​isc-tdyar · @​JOhnsonKC201 · @​jonghyunlee-29cm · @​jstar0 · @​jsw6701 · @​KerseyFabrications · @​kirilklein · @​kriswill · @​linze0721 · @​minorityre · @​moofone · @​mvanhorn · @​Naam · @​nguiaSoren · @​pcristin · @​rainder · @​rarepops · @​Ravandevil25 · @​RithvikReddy0-0 · @​RollerCoaster1899 · @​sahil-mangla · @​ShauryaaSharma · @​SS-42 · @​SyntaxSawdust · @​win4r

…and everyone who filed the issues these fixes resolved. Dependency updates via Dependabot.

Full changelog: DeusData/codebase-memory-mcp@v0.8.1...v0.9.0

Security Verification

All release binaries scanned with 70+ antivirus engines — 0 detections.

... (truncated)

Commits

• b637e33 Merge pull request #944 from DeusData/fix/dryrun-hardening
• be410a6 cli: compute self-update checksum in-process instead of shelling out
• 6e118fc Merge pull request #942 from DeusData/feat/ui-node-budget
• b2a592f Merge pull request #941 from DeusData/sec/hardening-2026-07
• 8e65f8f feat(graph-ui): density-aware contrast + Display controls
• 9969253 feat(graph-ui): type-in node budget with live loading progress
• 926e818 feat(ui): honor the requested node budget up to a 10M ceiling
• 839463d ui: send the Content-Security-Policy on the index document too
• cc16082 docs: document the CBM_ALLOWED_ROOT indexing boundary
• ce86ba7 ui: send a strict Content-Security-Policy with the served frontend
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Nebulazer123]

Superseded by #11, which incorporates this dependency update and passed the integrated v1.3.0 release CI.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.