This release adds 1 notable feature for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+14 more
Affected surfaces
ReleasePort's take
Light signalv1.38.0 adds memory diagnostics endpoint and AI cancellation to daemon. Indexer extract-worker crash loops now capped with backoff; tree-sitter WASM heap explicitly freed on every parse.
Why it matters: Deploy if indexing experiences crashes or memory growth. Backoff prevents cascade failures; per-parse heap release stops WASM accumulation during large codebase indexing runs.
Summary
AI summaryAdded memory diagnostics endpoint, AI cancellation support, and multisink resilience to the daemon.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
daemon includes memory diagnostics endpoint, AI cancellation, multisink resilience, and LocalBackend re-entry guard daemon includes memory diagnostics endpoint, AI cancellation, multisink resilience, and LocalBackend re-entry guard Source: granite4.1:8b-q6_K@2026-05-21 Confidence: high |
— |
| Dependency | Medium |
upgrade to latest trace-mcp via npm install -g trace-mcp@latest and trace-mcp init upgrade to latest trace-mcp via npm install -g trace-mcp@latest and trace-mcp init Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
ai fixes missing src/ai/abort.ts referenced by anthropic/gemini providers ai fixes missing src/ai/abort.ts referenced by anthropic/gemini providers Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
app launcher-shim resolves binary via explicit resolution instead of PATH-only `which` app launcher-shim resolves binary via explicit resolution instead of PATH-only `which` Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
daemon preserves error.message and .codeName when logging failures daemon preserves error.message and .codeName when logging failures Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
indexer caps extract-worker crash loop with backoff and dedup indexer caps extract-worker crash loop with backoff and dedup Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
indexer releases tree-sitter Tree WASM heap via tree.delete() in every parse path indexer releases tree-sitter Tree WASM heap via tree.delete() in every parse path Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
install self-healing postinstall writes launcher.env and plist install self-healing postinstall writes launcher.env and plist Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
logger implements atomic-rename rotation surviving multi-GB log files logger implements atomic-rename rotation surviving multi-GB log files Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Bugfix | Low |
updater performs atomic backup and rollback for ENOTEMPTY retry path updater performs atomic backup and rollback for ENOTEMPTY retry path Source: granite4.1:30b@2026-05-21-audit Confidence: low |
— |
| Other | Medium |
updater.test.ts clears TRACE_MCP_NO_AUTO_UPDATE in CI updater.test.ts clears TRACE_MCP_NO_AUTO_UPDATE in CI Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Other | Medium |
updater.test.ts bypasses isDevCheckout like rollback suite updater.test.ts bypasses isDevCheckout like rollback suite Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Other | Medium |
tools add behavioural coverage for dead-exports, untested-exports, and decision-graph tools tools add behavioural coverage for dead-exports, untested-exports, and decision-graph tools Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Other | Medium |
tools add behavioural coverage for misc and framework-aware tools tools add behavioural coverage for misc and framework-aware tools Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Other | Medium |
tools add behavioural coverage for planning, intent, and batch tools tools add behavioural coverage for planning, intent, and batch tools Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Other | Medium |
diag adds [FILE END] marker to surface actually-hung file diag adds [FILE END] marker to surface actually-hung file Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Other | Medium |
diag adds file-start reporter to identify CI hang culprit diag adds file-start reporter to identify CI hang culprit Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Other | Medium |
drop --ignore-scripts from build install for native bindings compilation drop --ignore-scripts from build install for native bindings compilation Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Other | Medium |
exclude embed-repo behavioural test (pinpointed hang via FILE END diag) exclude embed-repo behavioural test (pinpointed hang via FILE END diag) Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Other | Medium |
exclude fixture and xml-plugin test files (1.38 release unblocker) exclude fixture and xml-plugin test files (1.38 release unblocker) Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Other | Medium |
exclude integration and daemon test dirs (bisect for CI hang) exclude integration and daemon test dirs (bisect for CI hang) Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Other | Medium |
exclude tests/perf/** from per-commit shards exclude tests/perf/** from per-commit shards Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Other | Medium |
exclude toon-drift and debounce-abort tests — bisection landed exclude toon-drift and debounce-abort tests — bisection landed Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Other | Medium |
shard tests, share build artifact, and add safety-net timeouts (<3 min target) shard tests, share build artifact, and add safety-net timeouts (<3 min target) Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
Full changelog
1.38.0 (2026-05-17)
Features
- daemon: memory diagnostics endpoint + AI cancellation + multisink resilience + LocalBackend re-entry guard (e8f4116)
Bug Fixes
- ai: commit missing src/ai/abort.ts referenced by anthropic/gemini providers (49922e4)
- app: launcher-shim binary resolution instead of PATH-only
which(db52e74) - ci: postinstall test inherits workflow opt-out env + verbose reporter (dc42b46)
- daemon: preserve error.message + .codeName when logging failures (edaa124)
- indexer: cap extract-worker crash loop with backoff + dedup (fad5bf2)
- indexer: release tree-sitter Tree WASM heap via tree.delete() in every parse path (0a85793)
- install: self-healing postinstall writes launcher.env + plist (3761619)
- logger: atomic-rename rotation that survives multi-GB log files (b4d1499)
- test: updater.test.ts must also clear TRACE_MCP_NO_AUTO_UPDATE in CI (20c5683)
- test: updater.test.ts must bypass isDevCheckout like rollback suite (d4cc672)
- updater: atomic backup + rollback for ENOTEMPTY retry path (38115e7)
Documentation
- decision-memory: document live-capture, review queue, and privacy filter (aa02099)
Tests
- tools: behavioural coverage for dead-exports, untested-exports, and decision-graph tools (ebb888c)
- tools: behavioural coverage for misc + framework-aware tools (61e94a4)
- tools: behavioural coverage for planning, intent, and batch tools (88682ba)
CI/CD
- bisect: also exclude src/telemetry/tests/** — suspect OtlpSink (5823b76)
- bump cache key to v2 to invalidate poisoned node_modules (4b6be53)
- diag: add [FILE END] marker to surface the actually-hung file (39bf4e7)
- diag: file-start reporter to identify CI hang culprit (c6c0c3a)
- drop --ignore-scripts from build install so native bindings compile (28e4a76)
- drop sharding for 1.38.0 release — reliable single-job test run (6366c58)
- exclude embed-repo behavioural test (pinpointed hang via FILE END diag) (1c4ac23)
- exclude fixture + xml-plugin test files (1.38 release unblocker) (7d00584)
- exclude integration + daemon test dirs (bisect for CI hang) (d9b529b)
- exclude tests/perf/** from per-commit shards (bbc45e0)
- exclude toon-drift + debounce-abort tests — bisection landed (50cc141)
- shard tests + share build artifact + safety-net timeouts (<3 min target) (92fdd11)
Upgrade
npm install -g trace-mcp@latest
trace-mcp init
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About nikolai-vysotskyi/trace-mcp
Framework-aware code intelligence that indexes source code into a cross-language dependency graph. Understands framework semantics — routes, ORM relations, component rendering, DI trees — for navigation, impact analysis, call graphs, refactoring, security scanning, and cross-session memory.
Related context
Related tools
Earlier breaking changes
- v1.41.1 Removes desktop app from core repository (phase E).
Beta — feedback welcome: [email protected]