Skip to content

graphify

v0.8.42 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo RAG & Retrieval
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

antigravity claude-code codex gemini graphrag knowledge-graph
+5 more
leiden openclaw llm skills tree-sitter

Affected surfaces

auth

Summary

AI summary

Security fix merges .graphifyignore with .gitignore and fixes --update deleting changed file nodes.

Full changelog

Bug-fix release. pip install -U graphifyy / uv tool upgrade graphifyy.

Ships a live regression fix and a security fix from 0.8.41, plus two correctness/feature fixes.

Fixes

  • 🔴 /graphify --update no longer deletes a changed file's freshly re-extracted nodes. The 0.8.41 root= fix (#1361) made build_merge's prune actually match relative source_file values — which then matched the just-re-extracted nodes of changed files (still in prune_sources) and removed them, so --update on a changed file could wipe its nodes. The update runbook now prunes only genuinely deleted files; changed files are reconciled by build_merge's replace-on-re-extract (#1344). The full build also passes root= to build_from_json, and the extraction-spec source_file is pinned to the verbatim path, so full build and incremental updates never drift. (#1366 — thanks @RelywOo)

  • 🔒 Security: .graphifyignore and .gitignore are now merged per directory instead of .graphifyignore silently replacing the dir's .gitignore. Previously, adding a .graphifyignore disabled that directory's .gitignore entirely, so a file excluded only by .gitignore — including neutrally-named secrets like prod-dump.sql or customer-data.json — got indexed into the graph (whose artifacts embed file contents and are routinely committed). .gitignore is read first and .graphifyignore last, so it still wins on conflict (including ! negations); adding one can only ever exclude more. (#1363)

  • Java record declarations are now first-class type nodes, and new Foo(...) constructor calls produce a calls edge. Previously a record appeared only as its file node (degree 0). (#1373)

  • Large text documents are no longer silently truncated during semantic extraction. _read_files capped every file at 20,000 chars and dropped the rest; oversized Markdown/text/rST docs are now sliced at heading/paragraph boundaries so the whole file is extracted (slices share the parent source_file, so the graph isn't fragmented). Code files and PDFs are never sliced. (#1369)

Full changelog: https://github.com/safishamsi/graphify/blob/v8/CHANGELOG.md

Security Fixes

  • .graphifyignore and .gitignore are now merged per directory, preventing secret files from being indexed (#1363)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track graphify

Get notified when new releases ship.

Sign up free

About graphify

AI coding assistant skill (Claude Code, Codex, OpenCode, Cursor, Gemini CLI, OpenClaw, Factory Droid, Trae). Turn any folder of code, docs, papers, images, videos, or YouTube links into a queryable knowledge graph

All releases →

Related context

Earlier breaking changes

  • v0.8.18 Breaks Java `extends` edges; they are renamed to `inherits`. Update queries filtering on `relation="extends"` for Java nodes.

Beta — feedback welcome: [email protected]