knodin 0.14.0 → 0.14.1

package/dist/src/engine/index.js

@@ -6515,6 +6515,13 @@ const MSBUILD_PROJECT_REFERENCE = /<(?:ProjectReference|Import)\s[^><]*?(?:Inclu
 // classes span lines lets a malformed entry reach across the file and record a
 // path that was never written next to it.
 const SOLUTION_PROJECT_ENTRY = /^Project\("\{[^}\n]*\}"\)\s*=\s*"[^"\n]*",\s*"([^"\n]+)"/gm;
+/** Extract raw project paths without charging engine/database setup to parser performance. */
+export function extractDotnetProjectReferenceTargets(content, relativePath) {
+    const pattern = relativePath.endsWith(".sln")
+        ? SOLUTION_PROJECT_ENTRY
+        : MSBUILD_PROJECT_REFERENCE;
+    return [...content.matchAll(pattern)].map((match) => match[1]);
+}
 /**
  * Link-only indexer for the .NET build graph: `.csproj`/`.props`/`.targets` via
  * MSBuild XML, and `.sln` via its own line format (which is not XML). Produces
@@ -6538,11 +6545,8 @@ async function indexDotnetProjectFile(content, relativePath, repoPath, db) {
                 evidence: rawTarget.slice(0, 500),
             });
     };
-    const pattern = relativePath.endsWith(".sln")
-        ? SOLUTION_PROJECT_ENTRY
-        : MSBUILD_PROJECT_REFERENCE;
-    for (const match of content.matchAll(pattern))
-        record(match[1]);
+    for (const target of extractDotnetProjectReferenceTargets(content, relativePath))
+        record(target);
     persistLinkOnlyEdges(db, relativePath, [...edges.values()]);
 }
 /** Net brace depth change across a line, ignoring braces inside strings. */

package/docs/releases/0.14.1.md

@@ -0,0 +1,30 @@
+# knodin 0.14.1
+
+Compatible security patch release for EASFDC-8539, EASFDC-8540,
+EASFDC-8541, EASFDC-8546, EASFDC-8547, EASFDC-8549, EASFDC-8551,
+EASFDC-8559, and EASFDC-8687.
+
+## Security dependency updates
+
+- Require `adm-zip` 0.6.1 or newer, removing the vulnerable 0.6.0 transitive
+  resolution used by `onnxruntime-node`.
+- Require `fast-uri` 4.1.3 or newer; the resolved version is 4.2.1.
+- Require `qs` 6.16.0 or newer for the MCP SDK, Express, and body-parser
+  dependency paths.
+- Update the cross-repository Fastify fixture to 5.12.1 so security scanning
+  no longer reports the intentionally indexed fixture as vulnerable.
+
+`npm audit` reports zero known vulnerabilities for the release lockfile.
+
+## Performance regression evidence
+
+The malformed-MSBuild regression now measures the production reference parser
+directly at Knodin's 1 MiB indexing limit. The parser completes in milliseconds
+under the 2.5-second ceiling, and a separate scaling assertion rejects the old
+quadratic behavior. End-to-end graph persistence remains covered independently
+so database and engine startup do not distort the parser security gate.
+
+## Compatibility
+
+This patch changes no CLI, MCP, graph schema, or stored-data contract. Existing
+0.14.0 graphs remain compatible and require no migration.

package/package.json

@@ -1,8 +1,8 @@
 {
 	"name": "knodin",
-	"version": "0.14.0",
+	"version": "0.14.1",
 	"knodin": {
-		"compatibility": "breaking"
+		"compatibility": "compatible"
 	},
 	"description": "knodin — source-evidenced local code intelligence with known bounds. Stable identity, fresh evidence, truthful budgets, and recoverable bounded views.",
 	"license": "MIT",
@@ -75,6 +75,7 @@
 		"docs/releases/0.13.0.md",
 		"docs/releases/0.13.1.md",
 		"docs/releases/0.14.0.md",
+		"docs/releases/0.14.1.md",
 		"docs/releases/0.3.0.md",
 		"docs/releases/0.4.0.md",
 		"docs/releases/0.4.1.md",
@@ -194,8 +195,9 @@
 	},
 	"overrides": {
 		"@hono/node-server": "^2.0.5",
-		"adm-zip": "^0.6.0",
-		"fast-uri": "^4.1.1",
+		"adm-zip": "^0.6.1",
+		"fast-uri": "^4.1.3",
+		"qs": "^6.16.0",
 		"sharp": "^0.35.4"
 	},
 	"devDependencies": {