This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+8 more
Summary
AI summaryUpdates Testing, Bug Fixes, and commons-lang across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Bugfix | Medium |
Fix cross-module Java/Kotlin import resolution between Maven and Gradle projects. Fix cross-module Java/Kotlin import resolution between Maven and Gradle projects. Source: llm_adapter@2026-06-11 Confidence: low |
— |
| Bugfix | Medium |
Fixes incorrect Java and Kotlin import resolution across Maven modules and Gradle subprojects. Fixes incorrect Java and Kotlin import resolution across Maven modules and Gradle subprojects. Source: granite4.1:30b@2026-06-11-audit Confidence: low |
— |
Full changelog
Bug Fixes
- Fix cross-module Java/Kotlin import resolution (#7) — Java and Kotlin imports between Maven modules and Gradle subprojects now resolve correctly.
Previously, resolveJavaImport and resolveKotlinImport only checked hardcoded source roots relative to the project root, missing files in module subdirectories like module-b/src/main/java/.
The parser now runs a pre-pass that discovers:
- Maven modules from
<module>entries inpom.xml(recursive, with depth limit) - Gradle subprojects from
include()entries insettings.gradle/settings.gradle.kts
Supports recursive nested modules and both standard and non-standard source layouts (src/main/java, src/main/kotlin, src/test/java, src, test).
Validated on google/guice (13 modules, 647 files)
| Metric | Before | After |
|---|---|---|
| Cross-file Java edges | 0 | 2,247 |
| Cross-module edges | 0 | 759 |
| Injector dependents | 0 | 124 (across 10 extension modules) |
| Broken imports on Injector deletion | 0 | 124 |
Testing
- Added vitest test runner with
npm testscript - Added unit tests for JVM module discovery
- Added integration tests for cross-module Java and Kotlin import resolution
- Added cross-project isolation test (no state leaks between parseProject calls)
- Regression tested: single-module Java (commons-lang), TypeScript (hono), Python (flask), self-parse — all unchanged
- All 23 MCP tools tested: 23/23 PASS
Fixes #7 — thanks to @asaarela-bw for the detailed bug report.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Earlier breaking changes
- v1.6.1 Health scores from v1.6.1+ are not directly comparable to earlier versions.
Beta — feedback welcome: [email protected]