This release adds 1 notable feature for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+5 more
Summary
AI summaryUpdates Fix, Refactor, and Feat across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Low |
Kotlin enum entries are extracted as nodes with `case_of` edges to their enum type. Kotlin enum entries are extracted as nodes with `case_of` edges to their enum type. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Low |
`graphify extract --code-only` indexes only code (local AST) and skips the doc/paper/image semantic pass, allowing operation without an LLM backend. `graphify extract --code-only` indexes only code (local AST) and skips the doc/paper/image semantic pass, allowing operation without an LLM backend. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
File enumeration records and warns about skipped directories instead of silently dropping them. File enumeration records and warns about skipped directories instead of silently dropping them. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
`to_json`'s anti-shrink guard now refuses to overwrite a non‑empty unreadable `graph.json` unless `force=True` is passed. `to_json`'s anti-shrink guard now refuses to overwrite a non‑empty unreadable `graph.json` unless `force=True` is passed. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Pascal/Delphi extractors deduplicate `method`, `contains`, and `inherits` edges to avoid doubled graph edges. Pascal/Delphi extractors deduplicate `method`, `contains`, and `inherits` edges to avoid doubled graph edges. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Pascal/Delphi call resolution is scoped to the caller's class and its inheritance chain, fixing cross‑file method collisions. Pascal/Delphi call resolution is scoped to the caller's class and its inheritance chain, fixing cross‑file method collisions. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Query ranking scales exact‑match scores by term coverage to prevent a single generic term from hijacking seed selection in multi‑term queries. Query ranking scales exact‑match scores by term coverage to prevent a single generic term from hijacking seed selection in multi‑term queries. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
SKILL.md's POSIX interpreter probe now correctly invokes the `graphify` executable instead of silently falling back to a non‑graphified Python. SKILL.md's POSIX interpreter probe now correctly invokes the `graphify` executable instead of silently falling back to a non‑graphified Python. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
`merge-graphs` assigns distinct repo tags to each input, preventing node collisions from graphs with same‑stem prefixes. `merge-graphs` assigns distinct repo tags to each input, preventing node collisions from graphs with same‑stem prefixes. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
`uninstall` now also removes Graphify hook/section entries from Claude's local‑only configuration files. `uninstall` now also removes Graphify hook/section entries from Claude's local‑only configuration files. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Refactor | Low |
Large modules `extract.py`, `__main__.py`, and `export.py` were decomposed into focused sub‑modules under `graphify/`; import paths preserved via re‑exports with no behavior change. Large modules `extract.py`, `__main__.py`, and `export.py` were decomposed into focused sub‑modules under `graphify/`; import paths preserved via re‑exports with no behavior change. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
Full changelog
-
Fix: file enumeration no longer silently drops a directory subtree.
detect()'sos.walkhad noonerrorhandler, so anos.scandirfailure (a permission error, or a directory created/deleted mid-walk by concurrent writes) was swallowed and that whole subtree vanished from the scan with no log, yielding a silently partialgraph.json. The walk now records every skipped directory (surfaced in the result'swalk_errors) and warns to stderr, while still enumerating the rest. Relatedly,to_json's anti-shrink guard (#479) now fails safe: a non-empty but unreadable existinggraph.jsonrefuses the overwrite (passforce=Trueto override) instead of silently clobbering a good graph; an empty file still proceeds. -
Fix: Pascal/Delphi extractors no longer emit duplicate
method/contains/inheritsedges. A class method declared in the interface section and defined in the implementation section each emitted an edge to the same node, so ~half of a Pascal graph's method edges were doubled (skewing degree/centrality and tripping the new cross-file resolver's god-node guard). Both extractors now dedup edges on (source, target, relation), mirroring the existing node dedup. -
Fix: Pascal/Delphi call resolution is scoped to the caller's class + inherits chain, and calls to methods inherited across file boundaries now resolve (#1739, thanks @richtext). Both extractors previously resolved every call via a single file-wide
{name: node_id}dict, so two unrelated classes with a same-named method (property accessors, generated COM/TLB wrappers) collapsed onto whichever was inserted last, producing wrong cross-classcallsedges. Resolution now walks own-class then ancestor chain then file-level free functions, emitting no edge when ambiguous (same god-node guard as the Ruby resolver). A new corpus-wide resolver (graphify/pascal_resolution.py) resolves calls from a descendant to a base-class method declared in a different file (the common generated-base/manual-descendant split). Also stops emitting a duplicate cross-file base-class stub carrying the wrongsource_file. -
Fix: query ranking no longer lets a lone generic term that exact-matches a short leaf label hijack seed selection in multi-term queries (#1602/#1724, thanks @fkhawajagh).
_score_nodesscales the per-term exact/prefix tiers by squared term coverage; single-term and full-coverage queries are unchanged. -
Fix: Kotlin enum entries are extracted as nodes with
case_ofedges to their enum (#1700, thanks @ivanzhilovich). Closes the Kotlin half of #1700 (the Java half shipped in 0.9.10 via #1719);enum class ChatType { NORMAL, GROUP, SYSTEM }now yields NORMAL/GROUP/SYSTEM nodes and "where is ChatType.X used" works for Kotlin. -
Fix: SKILL.md's POSIX interpreter probe no longer silently falls back to a graphify-less system python (#1735, thanks @mohammedMsgm). Step 1 ran
uv tool run graphifyy python -c ..., but thegraphifyypackage's executable isgraphify, so uv treatedpythonas a missinggraphifyycommand;2>/dev/nullhid uv's own--fromhint, leavingPYTHONon an interpreter without graphify. The probe now runsuv tool run --from graphifyy python -c .... The PowerShell path was already correct. -
Refactor: decomposed the two largest modules into focused, single-responsibility modules — verbatim moves only, every original import path preserved via re-exports, no behavior change (#1737, thanks @TPAteeq).
extract.py17,054 → 4,740 LOC (the tree-sitter engine, cross-file resolution, shared models, and 23 language extractors moved undergraphify/extractors/),__main__.py5,368 → 673 (install/uninstall + CLI dispatch split intographify/install.pyandgraphify/cli.py),export.py1,671 → 962 (HTML + graph-DB exporters undergraphify/exporters/). Full suite unchanged. -
Fix:
merge-graphsgives each input a distinct repo tag so same-stem nodes from different source graphs don't collapse (#1729). Two graphs under a same-named repo dir (src/graphify-outandfrontend/src/graphify-out, both →src) shared thesrc::prefix, so a backendsrc/app.jsand a frontendApp.jsx(both bareapp) merged into one node with edges from both — false cross-runtimepathresults. Colliding tags are now widened (frontend_src) with an index-suffix backstop, and the command prints a note when it disambiguates. -
Fix:
uninstallremoves the graphify hook/section from Claude's local-only files too (#1731, thanks @TPAteeq). It now cleans.claude/settings.local.jsonand bothCLAUDE.local.mdlocations in addition to the standard files, via bothgraphify uninstallandgraphify claude uninstall. -
Feat:
graphify extract --code-onlyindexes code (local AST, no API key) and skips the doc/paper/image semantic pass, so a mixed repo no longer hard-fails when no LLM backend is configured (#1734). Reports what it skipped; the no-key error now points users at the flag.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About graphify
AI coding assistant skill (Claude Code, Codex, OpenCode, Cursor, Gemini CLI, OpenClaw, Factory Droid, Trae). Turn any folder of code, docs, papers, images, videos, or YouTube links into a queryable knowledge graph
Beta — feedback welcome: [email protected]