Skip to content

graphify

v0.8.37 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo RAG & Retrieval
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

antigravity claude-code codex gemini graphrag knowledge-graph
+5 more
leiden openclaw llm skills tree-sitter

Affected surfaces

rce_ssrf deps

ReleasePort's take

Moderate signal
editorial:auto 1mo

The release fixes a thread‑safety TOCTOU vulnerability in the global socket.getaddrinfo monkey‑patch by replacing it with per‑connection SSRF guard classes, and adds XML delimiters plus prompt hardening to mitigate LLM prompt injection.

Why it matters: Addresses two high‑severity security issues (severities 90 and 85) that could enable remote code execution or malicious prompt manipulation; operators should upgrade immediately.

Summary

AI summary

SSRF guard thread‑safety fixed and prompt injection mitigation added.

Changes in this release

Security Critical

Replaced global socket.getaddrinfo monkey-patch with per-connection SSRF guard classes, fixing thread-safety TOCTOU vulnerability.

Replaced global socket.getaddrinfo monkey-patch with per-connection SSRF guard classes, fixing thread-safety TOCTOU vulnerability.

Source: llm_adapter@2026-06-10

Confidence: high

 —
Security High

Wrapped untrusted source files in XML delimiters and hardened system prompt to mitigate LLM prompt injection.

Wrapped untrusted source files in XML delimiters and hardened system prompt to mitigate LLM prompt injection.

Source: llm_adapter@2026-06-10

Confidence: high

 —
Feature Low

Introduce `GRAPHIFY_MAX_GRAPH_BYTES` env var to override the 512 MiB `graph.json` size cap (e.g., `700MB`, `2GB`).

Introduce `GRAPHIFY_MAX_GRAPH_BYTES` env var to override the 512 MiB `graph.json` size cap (e.g., `700MB`, `2GB`).

Source: llm_adapter@2026-06-10

Confidence: low

 —
Performance Medium

`detect()` is 34 % faster on large repositories via memoized ignore‑pattern checks.

`detect()` is 34 % faster on large repositories via memoized ignore‑pattern checks.

Source: llm_adapter@2026-06-10

Confidence: low

 —
Bugfix Medium

Gracefully skip nodes absent from the graph when exporting Obsidian/Canvas to avoid KeyError crashes.

Gracefully skip nodes absent from the graph when exporting Obsidian/Canvas to avoid KeyError crashes.

Source: llm_adapter@2026-06-10

Confidence: high

 —
Bugfix Medium

NFC-normalize Office sidecar filenames on macOS to prevent re‑extraction loops during `--update`.

NFC-normalize Office sidecar filenames on macOS to prevent re‑extraction loops during `--update`.

Source: llm_adapter@2026-06-10

Confidence: high

 —
Bugfix Medium

Skip generic data JSON files during extraction to eliminate orphan nodes.

Skip generic data JSON files during extraction to eliminate orphan nodes.

Source: llm_adapter@2026-06-10

Confidence: high

 —
Bugfix Medium

Auto‑omit `temperature=0` for OpenAI o1/o3/o4/gpt-5 series; allow override via `GRAPHIFY_LLM_TEMPERATURE`.

Auto‑omit `temperature=0` for OpenAI o1/o3/o4/gpt-5 series; allow override via `GRAPHIFY_LLM_TEMPERATURE`.

Source: llm_adapter@2026-06-10

Confidence: high

 —
Bugfix Medium

Removed `datasketch` and `scipy`; replaced with pure‑numpy MinHash/MinHashLSH to stop EDR‑triggered hangs on Windows.

Removed `datasketch` and `scipy`; replaced with pure‑numpy MinHash/MinHashLSH to stop EDR‑triggered hangs on Windows.

Source: llm_adapter@2026-06-10

Confidence: high

 —
Bugfix Medium

Deduplicate code nodes by ID only, preventing distinct same‑named symbols from merging.

Deduplicate code nodes by ID only, preventing distinct same‑named symbols from merging.

Source: llm_adapter@2026-06-10

Confidence: high

 —
Other Low

affected_surface

affected_surface

Source: granite4.1:30b@2026-06-10-audit

Confidence: low

 —
Full changelog

Security

  • SSRF guard thread-safety: Replaced the global socket.getaddrinfo monkey-patch with per-connection _SSRFGuardedHTTPConnection/_SSRFGuardedHTTPSConnection subclasses. DNS is resolved once, IP validated, connection made to that exact address — closes the concurrent-thread race and the underlying TOCTOU gap.
  • Prompt injection mitigation: Untrusted source files are now wrapped in <untrusted_source path="..." sha256="..."> XML delimiters during LLM extraction. Jailbreak sentinel tokens neutralised; system prompt hardened.

Fixes

  • Obsidian/Canvas export crash: KeyError when a community contains a node absent from the graph — dangling members now skipped gracefully.
  • macOS NFC/NFD re-extraction loop: Office sidecar filenames now NFC-normalised before hashing, fixing the bug where --update re-extracted all Office files on every run on HFS+/APFS.
  • Data JSON orphan nodes: The JSON extractor now only processes config/manifest JSON (package.json, tsconfig.json, etc.). Data JSON files (arrays, generic key/value) are skipped by the AST pass — eliminates 561+ orphan nodes on real repos.
  • OpenAI reasoning models temperature error: temperature=0 is now auto-omitted for o1/o3/o4/gpt-5 series. Override with GRAPHIFY_LLM_TEMPERATURE.
  • Corporate Windows / EDR hang: datasketch and scipy removed. Replaced with a self-contained pure-numpy MinHash/MinHashLSH implementation — eliminates the numpy.testing → platform.machine() subprocess spawn at import time that EDR software (CrowdStrike, SentinelOne) was intercepting.
  • Dedup merges distinct same-named symbols: Config class in app.py and Config class in db.py are no longer collapsed. Code nodes are now deduplicated by ID only.

Performance

  • detect() 34% faster on large repos: Ignore-pattern checks memoized per scan. Each ancestor directory evaluated once across all sibling files, eliminating ~42M redundant fnmatch calls on 2k+ file corpora.

Features

  • GRAPHIFY_MAX_GRAPH_BYTES: Override the 512 MiB graph.json size cap (e.g. 700MB, 2GB). The cap error message now cites this env var. graphify export html auto-falls back to community-aggregation view when over cap.
  • Stronger CLAUDE.md instructions: "MANDATORY: Before using Read/Grep/Glob/Bash you MUST run graphify first" — includes explicit instruction to forward the rule to every subagent prompt.
  • GRAPHIFY_LLM_TEMPERATURE: Override LLM temperature for any backend (none to omit entirely).

CI

  • Self-graph release asset: Every release now ships graphify-self-graph.tar.gz — graph.json + graph.html + GRAPH_REPORT.md from Graphify analysing its own source. Download and open graph.html locally to see what Graphify produces, no install required.

Upgrade

uv tool upgrade graphifyy
# or
pip install --upgrade graphifyy

Security Fixes

  • SSRF guard thread‑safety: replaced global monkey‑patch with per‑connection subclasses, closing concurrent‑thread race and TOCTOU gap
  • Prompt injection mitigation: untrusted source files wrapped in XML delimiters; jailbreak sentinel tokens neutralised; system prompt hardened
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track graphify

Get notified when new releases ship.

Sign up free

About graphify

AI coding assistant skill (Claude Code, Codex, OpenCode, Cursor, Gemini CLI, OpenClaw, Factory Droid, Trae). Turn any folder of code, docs, papers, images, videos, or YouTube links into a queryable knowledge graph

All releases →

Related context

Earlier breaking changes

  • v0.8.18 Breaks Java `extends` edges; they are renamed to `inherits`. Update queries filtering on `relation="extends"` for Java nodes.

Beta — feedback welcome: [email protected]