From bc362cbb74d3eb6697e507ff72f0088ac7ba17bb Mon Sep 17 00:00:00 2001 From: safishamsi Date: Thu, 25 Jun 2026 09:17:21 +0100 Subject: [PATCH] Release 0.8.48 get_community shows the community name (#1448); starlette floored >=1.3.1 for CVE-2026-48818 / CVE-2026-54283 (#1391, #1396); begin per-language extractor split into graphify/extractors/ (#1212); parallel community labeling via --max-concurrency / --batch-size (#1390); reflect dedups dead-ends/corrections; and the work-memory loop no longer depends on the git hook (reflect --if-stale). Co-Authored-By: Claude Opus 4.8 (1M context) --- CHANGELOG.md | 2 ++ README.md | 2 ++ pyproject.toml | 2 +- uv.lock | 2 +- 4 files changed, 6 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2f2cdcf..3ebb91f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,8 @@ Full release notes with details on each version: [GitHub Releases](https://githu ## Unreleased +## 0.8.48 (2026-06-24) + - Fix: the `get_community` MCP tool now shows the community name in its header (`Community 12 — Auth & Sessions (8 nodes)`), matching `get_node` and the query-traversal output, which already read the `community_name` attribute `to_json` writes onto every node. `get_community` was the only graph tool still returning a bare numeric id. The name is read from the community's member nodes (they share it), sanitised like every other LLM-derived field, and skipped when it is just the `Community N` placeholder so the header never doubles to `Community 12 — Community 12` (#1448, thanks @rmart1308). - Security: floor `starlette` at `>=1.3.1` to pick up the fixes for CVE-2026-48818 and CVE-2026-54283 (both resolved by 1.3.1). starlette underpins the HTTP MCP transport (`graphify-mcp` over HTTP / `serve_http`); the stdio transport and CLI are unaffected. It was an undeclared transitive dependency (via `mcp`) that `graphify/serve.py` imports directly, so it is now declared in the `mcp` (and `all`) extras and floored, which protects end users installing `graphifyy[mcp]`, not just the locked dev/CI environment. Lockfile bumped 1.0.0 -> 1.3.1; serve/MCP/HTTP tests pass on the new version (#1391, #1396, thanks @orbisai0security). - Refactor: begin splitting the monolithic `extract.py` into per-language modules under `graphify/extractors/` (#1212). The `blade`, `elixir`, `razor`, and `zig` extractors plus the shared primitives (`_make_id`, `_file_stem`, `_read_text`, `_LANGUAGE_BUILTIN_GLOBALS`) move into their own files, with `graphify/extractors/base.py` holding the shared pieces and a strict one-way import direction (`extract.py` -> `extractors/`, never the reverse). `extract.py` re-exports the moved names, so every `from graphify.extract import ...` caller and the dispatch table are unchanged. Behavior-neutral lift-and-shift (verified byte-identical), groundwork for moving the remaining languages out. See `graphify/extractors/MIGRATION.md`. diff --git a/README.md b/README.md index 34c523f..52ce171 100644 --- a/README.md +++ b/README.md @@ -540,6 +540,7 @@ graphify install # overwrites the skill file graphify save-result --question "Q" --answer "A" --nodes Foo Bar --outcome useful # record how a Q&A turned out (work memory; outcome ∈ useful|dead_end|corrected) graphify reflect # aggregate graphify-out/memory/ outcomes into reflections/LESSONS.md +graphify reflect --if-stale # no-op when LESSONS.md is already newer than every input (cheap to run each session) graphify reflect --out docs/LESSONS.md # write the lessons doc somewhere else graphify reflect --graph graphify-out/graph.json # also group lessons by community @@ -645,6 +646,7 @@ graphify update ./src --no-cluster # skip reclustering, write raw AST graph onl graphify update ./src --force # overwrite even if new graph has fewer nodes graphify cluster-only ./my-project graphify cluster-only ./my-project --graph path/to/graph.json # custom graph location +graphify cluster-only ./my-project --max-concurrency 16 --batch-size 200 # parallel community labeling (large graphs) graphify cluster-only ./my-project --resolution 1.5 # more, smaller communities graphify cluster-only ./my-project --exclude-hubs 99 # exclude p99 degree nodes from partitioning graphify cluster-only ./my-project --no-label # keep "Community N" placeholders diff --git a/pyproject.toml b/pyproject.toml index fe1b63b..396ba84 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta" [project] name = "graphifyy" -version = "0.8.47" +version = "0.8.48" description = "AI coding assistant skill (Claude Code, CodeBuddy, Codex, OpenCode, Kilo Code, Cursor, Gemini CLI, Aider, OpenClaw, Factory Droid, Trae, Hermes, Kiro, Pi, Devin CLI, Google Antigravity) - turn any folder of code, docs, papers, images, or videos into a queryable knowledge graph" readme = "README.md" license = { file = "LICENSE" } diff --git a/uv.lock b/uv.lock index fc3be31..8603ee7 100644 --- a/uv.lock +++ b/uv.lock @@ -1150,7 +1150,7 @@ wheels = [ [[package]] name = "graphifyy" -version = "0.8.47" +version = "0.8.48" source = { editable = "." } dependencies = [ { name = "networkx", version = "3.4.2", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" },