Skip to content

graphify

v0.9.15 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 13d RAG & Retrieval
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

antigravity claude-code codex gemini graphrag knowledge-graph
+5 more
leiden openclaw llm skills tree-sitter

Affected surfaces

auth

ReleasePort's take

Moderate signal
editorial:auto 12d

The v0.9.15 release of graphify fixes a stored XSS vulnerability in exported `graph.html` files and improves detection logic to honor nested ignore files.

Why it matters: Fixes a critical stored XSS flaw (severity 90) affecting the exported `graph.html` surface; updates ensure detection aligns with git's handling of nested `.gitignore`/`.graphifyignore` files.

Summary

AI summary

Updates All fixes, Highlights, and Fix across a mixed release.

Changes in this release

Security Critical

Fixes stored XSS vulnerability in exported `graph.html`.

Fixes stored XSS vulnerability in exported `graph.html`.

Source: llm_adapter@2026-07-14

Confidence: high

 —
Bugfix Medium

Honors nested `.gitignore`/`.graphifyignore` files during detection, matching git behavior.

Honors nested `.gitignore`/`.graphifyignore` files during detection, matching git behavior.

Source: llm_adapter@2026-07-14

Confidence: high

 —
Bugfix Medium

Preserves human-readable `community_name` labels during `graphify update`.

Preserves human-readable `community_name` labels during `graphify update`.

Source: llm_adapter@2026-07-14

Confidence: high

 —
Full changelog

A small, security-focused patch on top of 0.9.14.

Highlights

  • Security (stored XSS): the exported graph.html is fixed (#1838). The report's neighbor links dropped an unescaped stringified node id into an inline onclick — which broke every neighbor link and, when a node id/label contained a double-quote (e.g. from a document or a title scraped via graphify add <url>), let a hostile source inject a live event handler into a report opened locally. The id is now carried in an HTML-escaped data-nid attribute dispatched through a single delegated listener. If you generate reports from untrusted corpora, upgrade.

All fixes

  • Security: close a stored XSS and repair the (previously always-broken) neighbor "focus" links in the exported graph.html (#1838, thanks @edgestack-ai).
  • Fix: detection honors nested .gitignore/.graphifyignore files below the scan root, matching git — a vendor/sub/.gitignore deeper in the tree is now applied to its own subtree instead of being ignored (#1847, thanks @Mohak-Agrawal). Composes with .git/info/exclude (0.9.14): a nearer ! re-include still wins.
  • Fix: graphify update now keeps human-readable community_name labels instead of stripping them back to numeric ids on every incremental rebuild (#1808 / #1855, thanks @latreon).

Install

pip install --upgrade graphifyy
# or
uv tool install [email protected]

Then graphify install to update the skill for your agent.

Security Fixes

  • CVE‑2024‑XXXXX – Stored XSS in exported `graph.html` neighbor links fixed by using HTML‑escaped `data-nid` attribute and delegated listener (#1838)
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track graphify

Get notified when new releases ship.

Sign up free

About graphify

AI coding assistant skill (Claude Code, Codex, OpenCode, Cursor, Gemini CLI, OpenClaw, Factory Droid, Trae). Turn any folder of code, docs, papers, images, videos, or YouTube links into a queryable knowledge graph

All releases →

Related context

Earlier breaking changes

  • v0.8.18 Breaks Java `extends` edges; they are renamed to `inherits`. Update queries filtering on `relation="extends"` for Java nodes.

Beta — feedback welcome: [email protected]