Reach for Go and Rust methods: receiver types from dependency code, and targets inside units by abhisek · Pull Request #53 · safedep/code

abhisek · 2026-10-19T09:38:05Z

What this changes

vet v2 reachability needs to know whether a project calls the vulnerable function of an advisory. 74% of the Go vulnerability database symbols are methods, as Tokenizer.Next. Most of them are called from inside the dependency itself. This PR makes the call graph answer for those symbols. One commit per Linear issue of the milestone "v2.2a Reachability MVP":

Commit	Issue	Change
`d4b7bc6`	FOU-545	The Rust link step no longer overflows the stack on `use smallvec::smallvec;`, or on a second cycle found in selectors 0.22.0
`955e75a`	FOU-542	Receiver-form table tests for Go and Rust, and a measurement over 10 Go and 10 Rust real projects (`test/projectgraph/report.md`)
`ed2291e`	FOU-546	A call on an external call result, as `html.NewTokenizer(r).Next()`, writes an `unknown-receiver` record and does not read as no-such-target
`691e410`	FOU-547	A Go dependency unit leaves out only the files that no Go build reads: test files, `//go:build ignore` and custom tags. It keeps the files of every platform. A generated table file blanks only its data values and keeps its function bodies
`0ab63c5`	FOU-543	Go result types of external functions and methods bind the receiver: multi-return, chained calls, interface results, and `GOROOT/src` as a unit
`b83cc3f`	FOU-544	The link step links Rust crates and binds the receiver from result, reference and generic types, `?`, `unwrap`, traits and associated functions
`7e0a52c`	FOU-555	reach matches a target against the external key of each definition of a unit, so a target that only the code of its unit calls is found. A build script, an example or a benchmark of a Rust crate no longer turns off the library-surface roots

Results on real projects

Targets found	Before	After
Go methods (1,298)	29	331
Go functions (256)	13	51
Rust methods (38)	0	16
Rust functions (13)	0	4

No target of the measure reads not-found. Every other target is uncertain with a cause. The share of Go method targets that end as unknown-receiver falls from 0.227 to 0.119.

html.NewTokenizer(r) followed by z.Next(), with the real golang.org/x/net@v0.61.0 as a unit, is now found, with no truncation and no budget line.

Review

A sub-agent review of the first six commits found two honesty regressions in FOU-547 and a pre-existing hole. All are fixed, with a case for each:

A skeleton of a generated file dropped every call and marked the file complete. A .pb.go call read as no-such-target. Case go/dependency-generated-code.
An index of linux/amd64 alone dropped the darwin twin of a function. A darwin-only call read as no-such-target. The GoPlatform option and the -go-platform flag are gone. Case go/dependency-platform-files.
A target that only dependency code calls read as not-found (FOU-555). Cases go/dependency-internal-call and rust/dependency-internal-call. Fixing it showed that a Rust library with a build.rs had no library-surface roots. Case rust/library-build-script.

Two findings stay open as FOU-556: false edges from the Rust ? heuristic, and no-dependency-source noise on chained builtins. Neither hides a call.

Versions

fileindex.Version 11 to 14, projectgraph.Version 11 to 15, reach.Version 2 to 3. Each bump has its rows in test/projectgraph/version_test.go.

Checks

go build ./..., go vet ./... and go test ./... -count=1 pass at each commit. At the head, go test -tags projectgraph ./test/projectgraph/ and golangci-lint run ./... pass with 0 issues. The measure runs with scripts/fetch_method_corpus.sh and PROJECTGRAPH_METHOD_CORPUS.

Generated by Claude Code

…OU-545) A Rust file with use smallvec::smallvec made the link step die with a stack overflow. The use binds smallvec. The walk of the path read the first smallvec through the same binding, and that binding led back to the same use, with no end. Rust resolves the first name of a use path against the crates and the modules, never against the binding of the same use. resolveRust now keeps the paths that each file resolves now. A repeat of a path gives no answer, so the walk tries the next candidate and ends. The path then names the crate, as smallvec//smallvec. The crate selectors 0.22.0 showed a second cycle of the same kind. An impl of Display for the enum Component holds use self::Component::*. The base Display can resolve through that wildcard, which asks for the external base of Component again. findExternalBase now keeps the classes that it reads, and a repeat has no external base. A link test runs use smallvec::smallvec, use a::a, use a::a::a and use self::a as a, and a second one the wildcard of the class in its impl. Each one overflowed the stack before the fix. The case rust/use-crate-name links a crate with the use and finds SmallVec::new. No graph of an existing case changes, so the version stays, and the hash rows of 11/11 take the new case. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PFQbqPqd9xn1fT6hBsyoUm Signed-off-by: Claude <noreply@anthropic.com>

…ncertain (FOU-542) The word "often" had no number behind it. This change gives the number and the rows that later fixes must flip. receivers_test.go has one row per form of the receiver of a method call of a dependency type, for Go and for Rust: a declared variable, a parameter, a struct field, a first-party return, an external return, a multi-return, a chained call and an interface return, and for Rust a reference and generic parameter, an associated function, a clone, a trait object and a generic bound. Small synthetic units under testdata/receivers give the dependency code. Each row names its answer. A row that fails today names the issue that fixes it, FOU-543, FOU-544 or FOU-546, and its answer today, so go test stays green. methods_test.go measures real projects under the projectgraph tag: 10 Go and 10 Rust projects that depend on a module or a crate with method symbols in the Go vulndb or in RustSec. corpus.txt pins each project and each dependency, and advisories.json pins the advisories. Every symbol of an advisory that affects a pinned dependency is a target, and the code of the dependency is a unit. scripts/fetch_method_corpus.sh fetches the code. The test counts found, not-found, uncertain by cause and no-such-target, per language and per symbol kind. report.md has the first numbers. 0.227 (294/1298) of the Go method targets and 0.342 (13/38) of the Rust ones end as unknown-receiver. The first run found a second stack overflow in the Rust link step, in selectors 0.22.0. The FOU-545 commit holds that fix. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PFQbqPqd9xn1fT6hBsyoUm Signed-off-by: Claude <noreply@anthropic.com>

…n-receiver (FOU-546) html.NewTokenizer(r).Next() with no dependency code gave no-such-target for golang.org//x//net//html//Tokenizer//Next and left no unresolved record. The walk took Next as a member of the external key of the called name, so the call made an edge to html//NewTokenizer//Next, a key that names no symbol. With no record, a later rule that reads no-such-target as not called for an imported package would hide a real call. The link step now adds an unknown-receiver record with the method name when it takes the method of a call on a call result as a member of the key of the called name. The edge stays, because a Go call of a type name converts a value and the method of the type then runs. A construction gives an instance of the called class, so new Yaml().load() and Yaml().load() of Python or Kotlin get no record. The reach query then answers uncertain at the site of the call through the method scope of the record. Python, JavaScript and Rust chains get the same record. reach answers no-such-target as before when no uncertainty concerns the target. The graph keeps no record of the imports of an external package, so the query cannot tell an imported package from another one, and this change does not turn no-such-target into not-found. The case go/chained-external-call checks the record, the kept edge and the uncertain answer. The cases go/interface-method-set, javascript/commander-action and javascript/references-argument gain the record of a call on a call result. The Go chained rows of the receiver table move to unknown-receiver, and FOU-543 now fixes them. projectgraph.Version is 12. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PFQbqPqd9xn1fT6hBsyoUm Signed-off-by: Claude <noreply@anthropic.com>

…he data of tables (FOU-547) A -deps run with golang.org/x/net@v0.61.0 printed seven truncations of the package-clauses limit, a budget line for idna/tables15.0.0.go and unresolved calls of _test.go files. Each gen.go has //go:build ignore and package main, so the link step saw a second package clause in its directory. The table file hit the depth limit of the index with a string of thousands of parts. Each truncation and budget turned a reach answer for the module into uncertain, so the dependency code made the answer worse. The index step now leaves out a Go file of a dependency unit only when no Go build reads it by default: a _test.go file, a file with //go:build ignore, and a file whose constraint needs a tag that the go command never sets, as purego. go/build decides for each GOOS and GOARCH with the bytes that the run read. The index keeps the files of every platform, because a reach answer must hold for each platform that a project builds for. An index of one platform dropped the darwin twin of a function, and a call that only darwin makes read as no-such-target. Result.Excluded lists the files. A file of the project stays as it is. A generated Go file of a unit, or a tables*.go file, whose index hits a limit gets a second index from its skeleton: each top-level var value that holds only data blanked, with the lines and the columns kept. Function bodies and values with a call or a function literal stay, so the calls of a generated file stay in the graph. A skeleton without bodies dropped every call of a .pb.go file and marked it complete. The index keeps the hash of the file, so the store serves it on the next run. A skeleton that still hits a limit stays truncated. The same x/net run now prints no truncation and no budget line. An indexer test checks a unit with gen.go, a _test.go file, a purego file, a //go:build windows file, a _linux.go file and a large generated table whose body calls a function. The cases go/dependency-build-files, go/dependency-generated-code and go/dependency-platform-files check the graph and the reach answers. fileindex.Version is 12. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PFQbqPqd9xn1fT6hBsyoUm Signed-off-by: Claude <noreply@anthropic.com>

…l functions and methods (FOU-543) z := html.NewTokenizer(r); z.Next() gave uncertain with unknown-receiver even with the code of x/net as a unit. The link step read the result type only of a first-party function, and only its first result. The Go index records the type of each result by position, in Results, and each name of an assignment or a short variable declaration that one call binds, with the position in Typed.Index. The blank name binds nothing. The link step reads the definition of a function in the project or in the unit that gives its package, and binds the type of the result to the name. A type of a unit becomes its external key, as golang.org//x//net//html//Tokenizer, so the call gets the key that a target names, and a package edge joins the key to the definition. A walk through an external key takes the result type of each function or method of a unit in turn, so pkg.F().M() and a.B().C() resolve. An interface result keeps the cha edges, and an implementation in a unit gets its edge through its external key. With no implementation the record has the new reason interface-receiver. A result of a package that no unit gives has the new reason no-dependency-source, and so has the record of a call on a call result from FOU-546. The standard library is a unit too: GOROOT/src as go:std@<version> gives each import path whose first element has no dot. To make that unit usable, the index step now also leaves out the files of a Go unit that are not Go source, the files under testdata and under a directory that starts with _ or ., and the cmd module of the std unit. The skeleton of a generated table blanks const values too, and an older DO NOT EDIT line or a name that starts with table marks such a file. The real GOROOT then links with no truncation, and http.NewRequest followed by req.Write finds net//http//Request//Write. The Go rows of the receiver table now pass. The case go/dependency-result-types checks the forms against a unit and a std unit, and go/dependency-implements-interface now finds Impl.Run by its external key. report.md has the numbers after this change. The govulncheck set still finds 9 of 9 stacks, and pycg-micro keeps 0.954. fileindex.Version is 13 and projectgraph.Version is 13. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PFQbqPqd9xn1fT6hBsyoUm Signed-off-by: Claude <noreply@anthropic.com>

…t, reference and generic types (FOU-544) A -deps run with a crate printed "the link step does not link the rust code of cargo:smallvec@1.13.2", and the link step knew a Rust receiver type only from Type::new. So a call on a parameter, a field, a result or a clone of a type of a crate read as unknown-receiver. The link step now links the Rust code of a cargo: unit. Each space has its own crates, and the root module of a crate of a unit is the unit, so two versions of one crate stay apart. A path of another crate, with or without a use, records its crate as the origin of the key, and the unit that gives the crate links it. The external key of an item of a unit is the path that another crate writes, with the shortest pub use of the root. A Rust unit has a surface, so a summary lists its symbols. The Rust index records the return type of each function and method, with Self as the type of the impl. Option<T> and Result<T, E> keep T in Returns and the wrapper in the new field Wraps. unwrap and expect give T, and so does a ?, which the index does not record. Another method of the wrapper gives no type. A declared type of a parameter, a field or a local that a unit gives binds the receiver, and an associated function binds its result. clone, to_owned, default and from on a type of a unit keep the type also when the crate derives them. A trait of a unit, as a trait object or a generic bound, gets the cha edges to its impls through their external keys, or a record with the new reason trait-receiver. The Rust rows of the receiver table now pass, and each probe of the real smallvec 1.13.2 finds SmallVec::insert_many. The case rust/dependency-crate checks a crate with a private module, a Result that unwrap opens and a generic bound. report.md has the numbers after this change. The govulncheck set still finds 9 of 9 stacks. fileindex.Version is 14 and projectgraph.Version is 14. The cache of the type that a unit gives for a key now skips an answer that the cycle guard of unitDefinitions shaped. An outer walk of the same name made it miss a definition, and the cache kept the miss for later queries, so the answer depended on the order of the walk. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PFQbqPqd9xn1fT6hBsyoUm Signed-off-by: Claude <noreply@anthropic.com>

…ns (FOU-555) A call inside a unit of dependency code goes to the definition, as go:example.com/dep@v1.0.0//dep.go//Vuln, and not to the external key example.com//dep//Vuln that a target names. So the search never met the target. A target that only the code of its unit calls read as no-such-target, or as not-found when an unreached call of the project named it. This is how most vulnerable symbols are called, as the methods of the HTTP/2 server of x/net. With dependency units, vet would say "not called" for code that runs. The link step now sets Node.External on each function, method and constructor of a unit: the key that an importer writes for it. reach matches a target against the external node of its key and against each definition with that external key, also for a wildcard target. The call sites of a target leave out the package edges, which join a key to its definition. The match showed a second gap. A Rust library crate with a build.rs had the build script as its only root, so the library-surface roots were off, and a call of its public API read as not-found. cookie calls rand::thread_rng from Key::generate this way. A build script, an example or a benchmark of a Rust crate is now a helper program: its root stays, and it does not turn off the library-surface roots. The cases go/dependency-internal-call, rust/dependency-internal-call and rust/library-build-script check both. The method measure now finds 331 of 1,298 Go method targets (30 before), 51 of 256 Go function targets (13) and 16 of 38 Rust method targets (0), and no target is not-found. projectgraph.Version is 15 and reach.Version is 3. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PFQbqPqd9xn1fT6hBsyoUm Signed-off-by: Claude <noreply@anthropic.com>

safedep · 2026-10-19T09:38:09Z

SafeDep Report Summary

Package Details

Package	Malware	Vulnerability	Risky License	Report
`example.com/markup @ 1.0.0` _{test/projectgraph/cases/go/dependency-result-types/project/go.mod}				🔗
`github.com/acme/kit @ v1.0.0` _{test/projectgraph/cases/go/dependency-build-files/project/go.mod} _{test/projectgraph/cases/go/dependency-platform-results/project/go.mod} _{test/projectgraph/cases/go/dependency-internal-call/project/go.mod} _{test/projectgraph/cases/go/dependency-platform-files/project/go.mod} _{test/projectgraph/cases/go/dependency-generated-code/project/go.mod}				🔗
`golang.org/x/net @ v0.61.0` _{test/projectgraph/cases/go/chained-external-call/project/go.mod}				🔗

View complete scan results →

_{This report is generated by SafeDep GitHub App}

chatgpt-codex-connector · 2026-10-19T09:38:17Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T09:42:42.359296Z	`7e0a52c`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

github-actions · 2026-10-19T09:38:33Z

vet Summary Report

This report is generated by vet

Policy Checks

✅ Vulnerability
✅ Malware
✅ License
✅ Popularity
✅ Maintenance
✅ Security Posture
✅ Threats

Malicious Package Analysis

Packages were checked against SafeDep's known malicious packages database

Malicious Package Analysis Report

Ecosystem	Package	Version	Status	Report

ℹ️ 0 packages have been checked against the known malicious packages database.
✅ No malicious packages found.

Note: Only known malicious packages were reported. Packages not yet present in the threat intelligence database are not flagged.

Changed Packages

✅ [Go] golang.org/x/net@0.61.0
✅ [Go] stdlib@1.22
✅ [Go] github.com/acme/kit@1.0.0
✅ [Go] example.com/markup@1.0.0
✅ [Go] stdlib@1.25

codecov-commenter · 2026-10-19T09:42:12Z

Codecov Report

❌ Patch coverage is 64.09396% with 214 lines in your changes missing coverage. Please review.
✅ Project coverage is 76.71%. Comparing base (400b25f) to head (5f6cd9f).

Files with missing lines	Patch %	Lines
projectgraph/results.go	45.31%	65 Missing and 5 partials ⚠️
projectgraph/rust.go	40.74%	62 Missing and 2 partials ⚠️
projectgraph/walk.go	26.92%	17 Missing and 2 partials ⚠️
projectgraph/declared.go	50.00%	16 Missing and 2 partials ⚠️
projectgraph/resolve.go	78.33%	11 Missing and 2 partials ⚠️
projectgraph/reach/reach.go	55.00%	7 Missing and 2 partials ⚠️
plugin/indexer/gounit.go	89.18%	4 Missing and 4 partials ⚠️
projectgraph/golang.go	50.00%	6 Missing and 1 partial ⚠️
plugin/indexer/golang.go	83.33%	2 Missing and 2 partials ⚠️
projectgraph/packages.go	75.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #53      +/-   ##
==========================================
+ Coverage   76.49%   76.71%   +0.22%     
==========================================
  Files         165      167       +2     
  Lines       15629    16126     +497     
==========================================
+ Hits        11955    12371     +416     
- Misses       2964     3020      +56     
- Partials      710      735      +25

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7e0a52c4dd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

coderabbitai · 2026-10-19T10:01:16Z

Important

Review skipped

Too many files!

This PR contains 237 files, which is 137 over the limit of 100.

To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch.

Upgrade to a paid plan to raise the limit.

This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry.

⚙️ Run configuration

Configuration used: Organization UI
Review profile: QUIET
Plan: Advanced
Run ID: e55333b5-808b-4b49-923e-c73aa5aa8669

📥 Commits

Reviewing files that changed from the base of the PR and between 400b25f and 5f6cd9f.

📒 Files selected for processing: 237

docs/projectgraph.md
examples/projectgraph/main.go
fileindex/index.go
fileindex/testdata/index.json
plugin/indexer/golang.go
plugin/indexer/golang_test.go
plugin/indexer/gounit.go
plugin/indexer/gounit_test.go
plugin/indexer/indexer.go
plugin/indexer/indexer_pool.go
plugin/indexer/plugin_test.go
plugin/indexer/rust.go
plugin/indexer/testdata/golden/App.cs.json
plugin/indexer/testdata/golden/App.java.json
plugin/indexer/testdata/golden/App.kt.json
plugin/indexer/testdata/golden/app.go.json
plugin/indexer/testdata/golden/app.js.json
plugin/indexer/testdata/golden/app.php.json
plugin/indexer/testdata/golden/app.py.json
plugin/indexer/testdata/golden/app.rb.json
plugin/indexer/testdata/golden/app.rs.json
plugin/indexer/testdata/golden/app.ts.json
plugin/indexer/testdata/golden/exports.js.json
plugin/indexer/testdata/golden/exports.py.json
plugin/indexer/testdata/golden/exports.ts.json
plugin/indexer/testdata/golden/flags.js.json
plugin/indexer/testdata/golden/flags.py.json
plugin/indexer/testdata/golden/flags.ts.json
projectgraph/cha.go
projectgraph/declared.go
projectgraph/golang.go
projectgraph/graph.go
projectgraph/imports.go
projectgraph/link.go
projectgraph/modules/cargo.go
projectgraph/modules/cargo_test.go
projectgraph/modules/golang.go
projectgraph/modules/golang_test.go
projectgraph/packages.go
projectgraph/profile.go
projectgraph/reach/reach.go
projectgraph/resolve.go
projectgraph/resolve_test.go
projectgraph/results.go
projectgraph/roots.go
projectgraph/rust.go
projectgraph/rust_test.go
projectgraph/testdata/javascript/barrel-chain/graph.golden.json
projectgraph/testdata/javascript/barrel-chain/indexes.json
projectgraph/testdata/javascript/commonjs-require/graph.golden.json
projectgraph/testdata/javascript/commonjs-require/indexes.json
projectgraph/testdata/javascript/default-import/graph.golden.json
projectgraph/testdata/javascript/default-import/indexes.json
projectgraph/testdata/javascript/esm-named-import/graph.golden.json
projectgraph/testdata/javascript/esm-named-import/indexes.json
projectgraph/testdata/javascript/export-star/graph.golden.json
projectgraph/testdata/javascript/export-star/indexes.json
projectgraph/testdata/javascript/exports-conditions/graph.golden.json
projectgraph/testdata/javascript/exports-conditions/indexes.json
projectgraph/testdata/javascript/unknown-receiver/graph.golden.json
projectgraph/testdata/javascript/unknown-receiver/indexes.json
projectgraph/testdata/javascript/workspaces/graph.golden.json
projectgraph/testdata/javascript/workspaces/indexes.json
projectgraph/testdata/python/all-hides/graph.golden.json
projectgraph/testdata/python/all-hides/indexes.json
projectgraph/testdata/python/assignment/graph.golden.json
projectgraph/testdata/python/assignment/indexes.json
projectgraph/testdata/python/class-body/graph.golden.json
projectgraph/testdata/python/class-body/indexes.json
projectgraph/testdata/python/decorators/graph.golden.json
projectgraph/testdata/python/decorators/indexes.json
projectgraph/testdata/python/external/graph.golden.json
projectgraph/testdata/python/external/indexes.json
projectgraph/testdata/python/local-receiver/graph.golden.json
projectgraph/testdata/python/local-receiver/indexes.json
projectgraph/testdata/python/member-call/graph.golden.json
projectgraph/testdata/python/member-call/indexes.json
projectgraph/testdata/python/missing-file/graph.golden.json
projectgraph/testdata/python/missing-file/indexes.json
projectgraph/testdata/python/package-init/graph.golden.json
projectgraph/testdata/python/package-init/indexes.json
projectgraph/testdata/python/reexport-cycle/graph.golden.json
projectgraph/testdata/python/reexport-cycle/indexes.json
projectgraph/testdata/python/relative-imports/graph.golden.json
projectgraph/testdata/python/relative-imports/indexes.json
projectgraph/testdata/python/sibling-import/graph.golden.json
projectgraph/testdata/python/sibling-import/indexes.json
projectgraph/testdata/python/src-layout/graph.golden.json
projectgraph/testdata/python/src-layout/indexes.json
projectgraph/testdata/python/sys-path/graph.golden.json
projectgraph/testdata/python/sys-path/indexes.json
projectgraph/testdata/python/wildcard/graph.golden.json
projectgraph/testdata/python/wildcard/indexes.json
projectgraph/testdata/roots/extra-rules/graph.golden.json
projectgraph/testdata/roots/extra-rules/indexes.json
projectgraph/testdata/roots/library-surface/graph.golden.json
projectgraph/testdata/roots/library-surface/indexes.json
projectgraph/testdata/roots/main-guard/graph.golden.json
projectgraph/testdata/roots/main-guard/indexes.json
projectgraph/testdata/roots/package-json-bin/graph.golden.json
projectgraph/testdata/roots/package-json-bin/indexes.json
projectgraph/testdata/roots/package-json-main/graph.golden.json
projectgraph/testdata/roots/package-json-main/indexes.json
projectgraph/testdata/roots/procfile-dockerfile/graph.golden.json
projectgraph/testdata/roots/procfile-dockerfile/indexes.json
projectgraph/testdata/roots/pyproject-scripts/graph.golden.json
projectgraph/testdata/roots/pyproject-scripts/indexes.json
projectgraph/testdata/roots/setup-py/graph.golden.json
projectgraph/testdata/roots/setup-py/indexes.json
projectgraph/testdata/roots/test-file/graph.golden.json
projectgraph/testdata/roots/test-file/indexes.json
projectgraph/testdata/typescript/js-specifier/graph.golden.json
projectgraph/testdata/typescript/js-specifier/indexes.json
projectgraph/testdata/typescript/tsconfig-paths/graph.golden.json
projectgraph/testdata/typescript/tsconfig-paths/indexes.json
projectgraph/testdata/typescript/type-only/graph.golden.json
projectgraph/testdata/typescript/type-only/indexes.json
projectgraph/walk.go
scripts/fetch_method_corpus.sh
test/projectgraph/README.md
test/projectgraph/cases/go/chained-external-call/expect.yaml
test/projectgraph/cases/go/chained-external-call/project/go.mod
test/projectgraph/cases/go/chained-external-call/project/main.go
test/projectgraph/cases/go/chained-external-call/project/tokens.go
test/projectgraph/cases/go/dependency-build-files/expect.yaml
test/projectgraph/cases/go/dependency-build-files/project/go.mod
test/projectgraph/cases/go/dependency-build-files/project/gomod/github.com/acme/kit@v1.0.0/gen.go
test/projectgraph/cases/go/dependency-build-files/project/gomod/github.com/acme/kit@v1.0.0/go.mod
test/projectgraph/cases/go/dependency-build-files/project/gomod/github.com/acme/kit@v1.0.0/kit.go
test/projectgraph/cases/go/dependency-build-files/project/gomod/github.com/acme/kit@v1.0.0/kit_test.go
test/projectgraph/cases/go/dependency-build-files/project/gomod/github.com/acme/kit@v1.0.0/kit_windows.go
test/projectgraph/cases/go/dependency-build-files/project/gomod/github.com/acme/kit@v1.0.0/tables.go
test/projectgraph/cases/go/dependency-build-files/project/main.go
test/projectgraph/cases/go/dependency-build-files/summaries/go_github.com_acme_kit_v1.0.0.json
test/projectgraph/cases/go/dependency-generated-code/expect.yaml
test/projectgraph/cases/go/dependency-generated-code/project/go.mod
test/projectgraph/cases/go/dependency-generated-code/project/gomod/github.com/acme/kit@v1.0.0/gen.go
test/projectgraph/cases/go/dependency-generated-code/project/gomod/github.com/acme/kit@v1.0.0/go.mod
test/projectgraph/cases/go/dependency-generated-code/project/gomod/github.com/acme/kit@v1.0.0/kit.go
test/projectgraph/cases/go/dependency-generated-code/project/main.go
test/projectgraph/cases/go/dependency-generated-code/summaries/go_github.com_acme_kit_v1.0.0.json
test/projectgraph/cases/go/dependency-implements-interface/expect.yaml
test/projectgraph/cases/go/dependency-implements-interface/summaries/go_github.com_acme_dep_v1.0.0.json
test/projectgraph/cases/go/dependency-internal-call/expect.yaml
test/projectgraph/cases/go/dependency-internal-call/project/go.mod
test/projectgraph/cases/go/dependency-internal-call/project/gomod/github.com/acme/kit@v1.0.0/go.mod
test/projectgraph/cases/go/dependency-internal-call/project/gomod/github.com/acme/kit@v1.0.0/kit.go
test/projectgraph/cases/go/dependency-internal-call/project/main.go
test/projectgraph/cases/go/dependency-internal-call/summaries/go_github.com_acme_kit_v1.0.0.json
test/projectgraph/cases/go/dependency-module/summaries/go_github.com_acme_yamlish_v1.2.0.json
test/projectgraph/cases/go/dependency-platform-files/expect.yaml
test/projectgraph/cases/go/dependency-platform-files/project/go.mod
test/projectgraph/cases/go/dependency-platform-files/project/gomod/github.com/acme/kit@v1.0.0/go.mod
test/projectgraph/cases/go/dependency-platform-files/project/gomod/github.com/acme/kit@v1.0.0/kit.go
test/projectgraph/cases/go/dependency-platform-files/project/gomod/github.com/acme/kit@v1.0.0/kit_darwin.go
test/projectgraph/cases/go/dependency-platform-files/project/gomod/github.com/acme/kit@v1.0.0/kit_linux.go
test/projectgraph/cases/go/dependency-platform-files/project/main.go
test/projectgraph/cases/go/dependency-platform-files/summaries/go_github.com_acme_kit_v1.0.0.json
test/projectgraph/cases/go/dependency-platform-results/expect.yaml
test/projectgraph/cases/go/dependency-platform-results/project/go.mod
test/projectgraph/cases/go/dependency-platform-results/project/gomod/github.com/acme/kit@v1.0.0/go.mod
test/projectgraph/cases/go/dependency-platform-results/project/gomod/github.com/acme/kit@v1.0.0/new_linux.go
test/projectgraph/cases/go/dependency-platform-results/project/gomod/github.com/acme/kit@v1.0.0/new_windows.go
test/projectgraph/cases/go/dependency-platform-results/project/main.go
test/projectgraph/cases/go/dependency-platform-results/summaries/go_github.com_acme_kit_v1.0.0.json
test/projectgraph/cases/go/dependency-result-types/expect.yaml
test/projectgraph/cases/go/dependency-result-types/project/go.mod
test/projectgraph/cases/go/dependency-result-types/project/gomod/example.com/markup@v1.0.0/go.mod
test/projectgraph/cases/go/dependency-result-types/project/gomod/example.com/markup@v1.0.0/node.go
test/projectgraph/cases/go/dependency-result-types/project/gomod/example.com/markup@v1.0.0/token.go
test/projectgraph/cases/go/dependency-result-types/project/goroot/src/go.mod
test/projectgraph/cases/go/dependency-result-types/project/goroot/src/io/io.go
test/projectgraph/cases/go/dependency-result-types/project/goroot/src/net/http/request.go
test/projectgraph/cases/go/dependency-result-types/project/goroot/src/os/exec/exec.go
test/projectgraph/cases/go/dependency-result-types/project/goroot/src/os/file.go
test/projectgraph/cases/go/dependency-result-types/project/main.go
test/projectgraph/cases/go/dependency-result-types/summaries/go_example.com_markup_v1.0.0.json
test/projectgraph/cases/go/dependency-result-types/summaries/go_std_go1.25.1.json
test/projectgraph/cases/go/interface-method-set/expect.yaml
test/projectgraph/cases/javascript/commander-action/expect.yaml
test/projectgraph/cases/javascript/dependency-candidates/summaries/npm_store-kit_1.0.0.json
test/projectgraph/cases/javascript/dependency-exports-import/summaries/npm_kit_1.0.0.json
test/projectgraph/cases/javascript/dependency-exports-require/summaries/npm_kit_1.0.0.json
test/projectgraph/cases/javascript/dependency-method-name/summaries/npm_plug_1.0.0.json
test/projectgraph/cases/javascript/dependency-same-path/summaries/npm_util-kit_1.0.0.json
test/projectgraph/cases/javascript/dependency-transitive/summaries/npm_lodash._reinterpolate_3.0.0.json
test/projectgraph/cases/javascript/dependency-transitive/summaries/npm_lodash_4.17.21.json
test/projectgraph/cases/javascript/references-argument/expect.yaml
test/projectgraph/cases/python/dependency-dark-unit/summaries/pypi_PyYAML_6.0.1.json
test/projectgraph/cases/python/dependency-failed-reached/summaries/pypi_badpkg_1.0.0.json
test/projectgraph/cases/python/dependency-failed-reached/summaries/pypi_okpkg_1.0.0.json
test/projectgraph/cases/python/dependency-failed-unreached/summaries/pypi_badpkg_1.0.0.json
test/projectgraph/cases/python/dependency-failed-unreached/summaries/pypi_okpkg_1.0.0.json
test/projectgraph/cases/python/dependency-package-dir/summaries/pypi_outer_1.0.0.json
test/projectgraph/cases/python/dependency-site-packages/summaries/pypi_requests_2.31.0.json
test/projectgraph/cases/python/dependency-site-packages/summaries/pypi_urllib3_2.0.7.json
test/projectgraph/cases/rust/dependency-crate/expect.yaml
test/projectgraph/cases/rust/dependency-crate/project/Cargo.toml
test/projectgraph/cases/rust/dependency-crate/project/src/flush.rs
test/projectgraph/cases/rust/dependency-crate/project/src/main.rs
test/projectgraph/cases/rust/dependency-crate/project/vendor/kit/Cargo.toml
test/projectgraph/cases/rust/dependency-crate/project/vendor/kit/src/lib.rs
test/projectgraph/cases/rust/dependency-crate/project/vendor/kit/src/store.rs
test/projectgraph/cases/rust/dependency-crate/summaries/cargo_kit_1.0.0.json
test/projectgraph/cases/rust/dependency-internal-call/expect.yaml
test/projectgraph/cases/rust/dependency-internal-call/project/Cargo.toml
test/projectgraph/cases/rust/dependency-internal-call/project/src/main.rs
test/projectgraph/cases/rust/dependency-internal-call/project/vendor/kit/Cargo.toml
test/projectgraph/cases/rust/dependency-internal-call/project/vendor/kit/src/lib.rs
test/projectgraph/cases/rust/dependency-internal-call/summaries/cargo_kit_1.0.0.json
test/projectgraph/cases/rust/dependency-renamed/expect.yaml
test/projectgraph/cases/rust/dependency-renamed/project/Cargo.toml
test/projectgraph/cases/rust/dependency-renamed/project/src/main.rs
test/projectgraph/cases/rust/dependency-renamed/project/vendor/kit/Cargo.toml
test/projectgraph/cases/rust/dependency-renamed/project/vendor/kit/src/lib.rs
test/projectgraph/cases/rust/dependency-renamed/summaries/cargo_kit_1.0.0.json
test/projectgraph/cases/rust/library-build-script/expect.yaml
test/projectgraph/cases/rust/library-build-script/project/Cargo.toml
test/projectgraph/cases/rust/library-build-script/project/build.rs
test/projectgraph/cases/rust/library-build-script/project/src/lib.rs
test/projectgraph/cases/rust/library-build-script/project/vendor/kit/Cargo.toml
test/projectgraph/cases/rust/library-build-script/project/vendor/kit/src/lib.rs
test/projectgraph/cases/rust/library-build-script/summaries/cargo_kit_1.0.0.json
test/projectgraph/cases/rust/use-crate-name/expect.yaml
test/projectgraph/cases/rust/use-crate-name/project/Cargo.toml
test/projectgraph/cases/rust/use-crate-name/project/src/main.rs
test/projectgraph/cases/rust/use-crate-name/project/src/store.rs
test/projectgraph/methods_test.go
test/projectgraph/public/methods/advisories.json
test/projectgraph/public/methods/corpus.txt
test/projectgraph/receivers_test.go
test/projectgraph/report.md
test/projectgraph/testdata/receivers/go/dep/dep.go
test/projectgraph/testdata/receivers/go/dep/go.mod
test/projectgraph/testdata/receivers/rust/dep/Cargo.toml
test/projectgraph/testdata/receivers/rust/dep/src/lib.rs
test/projectgraph/version_test.go

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

A Cargo.toml can rename a dependency, as helper = { package = "kit" }. A path of the crate writes helper, and the unit has the crate kit, so no package edge reached the unit and a target of kit was not-found. The link step now reads the renames and gives each origin the module of the package. Two platform files of a Go package can define one function with two result types. The walk took the type of the first file, so a method of the other type was not-found. A result is now known only when every definition and its twins give the same type. Else the call is a record with the reason unknown-receiver. projectgraph.Version is 16. New cases: rust/dependency-renamed and go/dependency-platform-results. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PFQbqPqd9xn1fT6hBsyoUm Signed-off-by: Claude <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PFQbqPqd9xn1fT6hBsyoUm Signed-off-by: Claude <noreply@anthropic.com>

claude added 7 commits October 19, 2026 09:11

chatgpt-codex-connector Bot reviewed Oct 19, 2026

View reviewed changes

Comment thread projectgraph/rust.go

Comment thread projectgraph/rust.go

Comment thread projectgraph/results.go Outdated

claude added 2 commits October 19, 2026 10:16

docs(report): record the measure after the review fixes of PR 53

5f6cd9f

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PFQbqPqd9xn1fT6hBsyoUm Signed-off-by: Claude <noreply@anthropic.com>

abhisek merged commit 16bd159 into main Oct 19, 2026
9 checks passed

abhisek deleted the claude/reach-receiver-types branch October 19, 2026 10:51

abhisek mentioned this pull request Oct 24, 2026

feat(projectgraph): link Python dependency code, read its type hints, and add the distribution graph #55

Open

Navigation Menu

Repository navigation

Reach for Go and Rust methods: receiver types from dependency code, and targets inside units - #53

Reach for Go and Rust methods: receiver types from dependency code, and targets inside units#53
abhisek merged 9 commits into
mainfrom
claude/reach-receiver-types

abhisek commented Oct 19, 2026

Uh oh!

safedep Bot commented Oct 19, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 19, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 19, 2026 •

edited

Loading

Changed Packages

Uh oh!

codecov-commenter commented Oct 19, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 19, 2026 •

edited

Loading

Review skipped

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

abhisek commented Oct 19, 2026

What this changes

Results on real projects

Review

Versions

Checks

Uh oh!

safedep Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

SafeDep Report Summary

Uh oh!

chatgpt-codex-connector Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

github-actions Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

vet Summary Report

Policy Checks

Malicious Package Analysis

Changed Packages

Uh oh!

codecov-commenter commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

safedep Bot commented Oct 19, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 19, 2026 •

edited

Loading

github-actions Bot commented Oct 19, 2026 •

edited

Loading

codecov-commenter commented Oct 19, 2026 •

edited

Loading

coderabbitai Bot commented Oct 19, 2026 •

edited

Loading