This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+5 more
Affected surfaces
Summary
AI summarySecurity fix merges .graphifyignore with .gitignore and fixes --update deleting changed file nodes.
Full changelog
Bug-fix release. pip install -U graphifyy / uv tool upgrade graphifyy.
Ships a live regression fix and a security fix from 0.8.41, plus two correctness/feature fixes.
Fixes
-
🔴
/graphify --updateno longer deletes a changed file's freshly re-extracted nodes. The 0.8.41root=fix (#1361) madebuild_merge's prune actually match relativesource_filevalues — which then matched the just-re-extracted nodes of changed files (still inprune_sources) and removed them, so--updateon a changed file could wipe its nodes. The update runbook now prunes only genuinely deleted files; changed files are reconciled bybuild_merge's replace-on-re-extract (#1344). The full build also passesroot=tobuild_from_json, and the extraction-specsource_fileis pinned to the verbatim path, so full build and incremental updates never drift. (#1366 — thanks @RelywOo) -
🔒 Security:
.graphifyignoreand.gitignoreare now merged per directory instead of.graphifyignoresilently replacing the dir's.gitignore. Previously, adding a.graphifyignoredisabled that directory's.gitignoreentirely, so a file excluded only by.gitignore— including neutrally-named secrets likeprod-dump.sqlorcustomer-data.json— got indexed into the graph (whose artifacts embed file contents and are routinely committed)..gitignoreis read first and.graphifyignorelast, so it still wins on conflict (including!negations); adding one can only ever exclude more. (#1363) -
Java
recorddeclarations are now first-class type nodes, andnew Foo(...)constructor calls produce acallsedge. Previously a record appeared only as its file node (degree 0). (#1373) -
Large text documents are no longer silently truncated during semantic extraction.
_read_filescapped every file at 20,000 chars and dropped the rest; oversized Markdown/text/rST docs are now sliced at heading/paragraph boundaries so the whole file is extracted (slices share the parentsource_file, so the graph isn't fragmented). Code files and PDFs are never sliced. (#1369)
Full changelog: https://github.com/safishamsi/graphify/blob/v8/CHANGELOG.md
Security Fixes
- .graphifyignore and .gitignore are now merged per directory, preventing secret files from being indexed (#1363)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About graphify
AI coding assistant skill (Claude Code, Codex, OpenCode, Cursor, Gemini CLI, OpenClaw, Factory Droid, Trae). Turn any folder of code, docs, papers, images, videos, or YouTube links into a queryable knowledge graph
Beta — feedback welcome: [email protected]