This release fixes issues for SREs watching stability and regressions.
✓ No known CVEs patched in this version
Topics
+5 more
Summary
AI summaryFixed false positives for _is_sensitive() causing legitimate files like tokenizer.py, password_verification.py, and SecretManager.java to be dropped.
Full changelog
Bug Fixes
- cluster-only
--graphflag (#724) —graphify cluster-onlynow accepts--graph <path>to specify a non-default graph.json location; positional path and flags can appear in any order _is_sensitive()false positives (#718) — word boundaries on the keyword pattern prevent legitimate source files liketokenizer.py,password_verification.py,SecretManager.javafrom being silently droppedmax_tokenstruncation cascade (#730) — headlessgraphify extract --backend claude/kiminow defaults to 16384 output tokens (was 8192), eliminating the recursive split cascade on dense doc corpora; override withGRAPHIFY_MAX_OUTPUT_TOKENSenv var- Prune message clarity (#539) —
--updatenow clearly distinguishes "N nodes pruned from M deleted files" from "M deletions detected but graph already clean" - Svelte stub node
source_file(#712) — stub nodes created for imported.sveltefiles now carry the resolved import path assource_fileinstead of the importer's path - Svelte static imports (#713) —
extract_svelte()now catches staticimport X from './foo.svelte'via a dedicated regex pass over<script>block content; previously tree-sitter's JS parser silently dropped all static imports - Manifest on full rebuild (#538) —
graphify extract(full rebuild path) now savesmanifest.jsonon every successful run; previously only--updatesaved it, causing stale-manifest drift - Antigravity install paths (#704) —
graphify antigravity installnow writes to.agent/(no trailing s) matching Antigravity's actual config paths - Pi skill YAML parse error (#737) — Pi skill frontmatter description simplified to avoid "nested mappings" error on Pi startup
--dedup-llmwiring — flag now correctly threads LLM backend through todeduplicate_entitiesin both fresh and incremental extract paths; fresh extract path now also runs dedup (previously bypassed it entirely)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About graphify
AI coding assistant skill (Claude Code, Codex, OpenCode, Cursor, Gemini CLI, OpenClaw, Factory Droid, Trae). Turn any folder of code, docs, papers, images, videos, or YouTube links into a queryable knowledge graph
Beta — feedback welcome: [email protected]