[dependabot]

Bumps the python-minor-and-patch group with 3 updates: authlib, python-socketio and graphifyy.

Updates authlib from 1.9.1 to 1.9.5

Release notes

Sourced from authlib's releases.

v1.9.5

Changelog: https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-5

Full Changelog: authlib/authlib@v1.9.4...v1.9.5

v1.9.4

Changelog: https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-4

Full Changelog: authlib/authlib@v1.9.3...v1.9.4

v1.9.3

Changelog: https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-3

Full Changelog: authlib/authlib@v1.9.2...v1.9.3

v1.9.2

Changelog: https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-2

Full Changelog: authlib/authlib@v1.9.1...v1.9.2

Commits

• 42607cb chore: release 1.9.5
• ce5bb0d fix(jose): refuse SSH keys with a tab and SSH certificates as HMAC secrets
• 9dffddf chore: release 1.9.4
• 67db2aa fix(oauth): let IDJAGGrant resolve users by issuer and subject
• e90d1b1 chore: release 1.9.3
• ec4c7a1 Merge commit from fork
• d74dc90 chore: release 1.9.2
• 44c9617 fix(oauth): limit ID-JAG access tokens to the scope claim
• See full diff in compare view

Updates python-socketio from 5.17.0 to 5.18.1

Commits

• See full diff in compare view

Updates graphifyy from 0.9.97 to 0.9.103

Release notes

Sourced from graphifyy's releases.

graphify 0.9.103

A broad correctness, performance and robustness release across the extractors, resolution, hooks, the query and update paths, install and the skill runbook.

Extractors

• C#: preprocessor directives and #if branches that derail tree-sitter are blanked before parsing (byte-length preserving), so a directive no longer closes a class early and drops later members or calls.
• Solidity: library calls (Lib.f(), including aliased imports) and emit/revert/require naming a declared event or error now link to the member they name, gated to a unique visible type and member.
• YAML: a << merge sequence gives the earlier anchor precedence for a duplicated key, matching the spec and PyYAML.
• Markdown: a code span written as a backslash namespace (\Foo\Bar) or a type-qualified member (Type::member) resolves to the real node; a dotted mention whose method name is a language builtin is no longer dropped.
• Python: a bare builtin-named call (raise NotImplementedError(...)) no longer binds to a same-named class in another module unless imported.

Resolution

• A call inside a top-level def _main() is attributed to _main, not the public main it collides with after id normalization, without misattributing a class member's type reference.

Hooks

• A file unchanged in content is not re-flagged stale by mtime (the extraction hash is checked against the manifest).
• A dedicated Grep is held to the strict orientation gate; a Bash file read (cat/head/sed -n) of an in-project code file gets the read nudge; a search whose every target is outside the project emits no project hint; the nudge budget is restored after a Claude Code compaction; and the toplevel anchor keeps working when CDPATH is exported.

Performance

• Lower peak memory in load, resolution and extraction; a faster [#3252](https://github.com/Graphify-Labs/graphify/issues/3252) cross-file repoint; and the watch reconcile pass resolves AST ownership once per file instead of re-reading each header per node — all with identical graph output.

Update / build / cache

• graphify update re-extracts only the files whose content changed (identical to a full rebuild); a contended incremental request is recorded instead of dropped. The build write guard no longer counts intentional ghost/dedup folds as drops; cache keys keep their written case.

Query / tree

• Source nodes rank above tests and docs (a soft weight) with file-first answers; query reads query_budget/query_depth from .graphifyrc and gains --depth. export tree caps directory children while reporting full totals.

Install / thread-safety

• The Pi project skill is written to .pi/skills; uninstall removes the global skill registration it wrote. The ambient scan root is held in a ContextVar so concurrent library callers extracting different roots do not clobber each other.

The AST cache schema is bumped to 39; warm caches re-run the affected extractions.

Thanks to @​rohit-jsfreaky, @​Deepjyoti-Sarmah, @​xiongjianxu, @​nothariharan, @​andrebrait, @​ajbmachon, @​Shubham-Padkonde, @​madhusudanpatnaik, @​pei711, @​Mpasha17, @​ayushcodes10, @​gitmotion, @​briascoi, @​oleksii-tumanov, @​rohit-jsfreaky, @​viwe-monai, @​WyattAu, @​Vivek1898, @​wanjinhao1, @​PratikDhanave, @​HhH666-ux, @​sunhouy, @​mathewgeejo, @​jinsoo and @​AndresDiagoM.

graphify 0.9.102

A large correctness, performance and workflow release spanning the extractors, the query layer, incremental update, the hooks, the skill runbook and install.

Call-resolution (extractors)

• go: same-file member calls resolve through the receiver's type; cross-package pkg.T receivers bind only via the file's import; interface method calls dispatch to implicit implementers (#4966, #4853, #4934).
• rust: module-qualified calls (crate::b::helper()) resolve cross-file; calls inside expression-macro arguments are linked (#4944, #4945).
• kotlin: overloaded and init {}-block calls resolve; unreachable external-inherited calls are dropped (#4956).
• python: a module-level singleton's member calls resolve through its type; a bare method call no longer self-binds (#4972, #4933).
• js/ts: class extends through a CommonJS require resolves; a typed tagged template and an import("mod").T<X> annotation no longer half-parse or mint a false dynamic_import edge; default-exported object methods resolve (#4700, #4976, #4967).
• solidity: ../ imports resolve to the real file (#4985).
• cpp: receiver typing from params/fields, split-header owner binding, local-callable suppression, type-alias exact-spelling (#4946, #4920, #4921, #4951).

Query

• Source nodes rank above tests and docs (a soft weight, not exclusion), and answers are file-first (#4982).
• graphify query reads query_budget/query_depth from .graphifyrc and gains a --depth flag (#4760).

... (truncated)

Changelog

Sourced from graphifyy's changelog.

0.9.103 (2026-11-05)

• Fix: markdown a code span written as a backslash namespace (\Foo\Bar) or a type-qualified member (Type::member) is recognised as a symbol mention and resolves to the real node when one exists, instead of being silently dropped; an absent chain mints nothing (#4610, #4695, thanks @​viwe-monai).

• Fix: detect extract warns loudly when a large share of the corpus has no supported extractor (a 20-file floor and a 20% threshold), instead of only printing a bare unclassified count; a normal mixed project stays silent (#2942, #4646, thanks @​ayushcodes10).

• Fix: thread-safety the ambient scan root is held in a ContextVar instead of a module global, so concurrent library/async callers extracting different roots no longer clobber each other's root; the single-threaded CLI is unchanged (#4602, #4694, thanks @​WyattAu).

• Feat: tree graphify export tree caps how many children a directory lists (--max-children, default 200) while total_count still reports the full count, so a directory with thousands of entries no longer renders them all (#4766, #4768, thanks @​oleksii-tumanov).

• Fix: install the Pi project skill is written to .pi/skills, where Pi reads it, instead of a .pi/agent/skills path it never looks at; uninstall is symmetric (#5011, #5012, thanks @​Vivek1898).

• Internal: stage fake install bundles in a temp package root and fail loudly (not skip) on a wheel-build error, and serialise both wheel builders under a shared lock so concurrent runs on one checkout do not collide (#4603, #4664, thanks @​wanjinhao1); characterize _is_stale across changed/unchanged/vanished sources (#4996, thanks @​PratikDhanave); isolate the ambient venv/PATH in the _detect_run hook test (#4991, thanks @​HhH666-ux).

• Fix: solidity a library call (Lib.f(), including an aliased import) and an emit/revert/require naming a declared event or error now link to the member they name instead of producing no edge; resolution is gated to a single visible type whose unique name/arity member matches, so a builtin require or an ambiguous qualifier is left unresolved (#5001, #5005, thanks @​rohit-jsfreaky).

• Fix: csharp preprocessor directives and #if branches that derail tree-sitter are blanked before parsing (byte-length preserving, so line and column numbers do not move), so a directive no longer closes the enclosing class early and orphans later members or drops their calls; the first #if branch and distinct framework-fallback branches are kept (#5003, thanks @​rohit-jsfreaky).

• Fix: python a bare builtin-named call (raise NotImplementedError(...), list(...)) no longer binds to a same-named class in another module unless that caller imported the symbol; an imported homonym still resolves (#4989, #4999, thanks @​Deepjyoti-Sarmah).

• Fix: typescript a type-position import('mod') expression (a parameter/alias/typeof/generic-constraint annotation) no longer emits a spurious dynamic_import runtime edge; a real runtime import('mod') in the same file still does (#4992, #4998, thanks @​mathewgeejo).

• Fix: resolution a call inside a top-level def _main() is attributed to _main, not the public main it collides with after id normalization; the fix matches only the underscore-collision salt, so a class member's type reference is not misattributed to a sibling method (#4994, #4997, thanks @​sunhouy).

• Fix: yaml a << merge sequence gives the earlier anchor precedence for a duplicated key, matching the YAML merge spec and PyYAML, so the winning key carries its correct source line (#4995, thanks @​PratikDhanave).

• Fix: markdown a dotted mention whose method name is a language builtin (Repository.open) is no longer dropped; only a bare builtin name is skipped, and no spurious mention is minted (#4990, thanks @​PratikDhanave).

• Fix: hooks a Bash file read (cat, head, tail, sed -n, nl) of an in-project code file gets the same graph read-nudge a Read tool does (nudge-only, never a strict deny); writes, stdin, heredocs, docs and globs stay silent (#5010, thanks @​rohit-jsfreaky).

• Fix: hooks the once-per-session nudge budget is restored after a Claude Code compaction (a SessionStart with source=compact), so orientation can re-fire once the earlier nudges have left the model's context (#5008, thanks @​rohit-jsfreaky).

• Fix: hooks the toplevel-anchor logic keeps working when CDPATH is exported; an exported CDPATH was corrupting the relative .git capture and silently skipping the post-commit/checkout rebuild (#4977, #4988, thanks @​HhH666-ux).

• Perf: update the watch reconcile pass resolves AST ownership once per file instead of re-reading each header once per node, with identical graph output (#4978, #4986, thanks @​Deepjyoti-Sarmah).

• AST cache schema bumped to 39 for the C# (#5003), Solidity (#5001, #5005), YAML (#4995) and Markdown (#4695) extractor fixes; warm caches re-run the affected extractions.

0.9.102 (2026-11-03)

• Perf: update graphify update re-extracts only the files whose content changed since the last build (derived from the manifest inside the lock), instead of re-running the whole pipeline over the corpus for a single edit; the resulting graph is identical to a full rebuild, including cross-file edges from unchanged files into a changed one, and deletions (#4740, #4800, #4801, thanks @​Deepjyoti-Sarmah).
• Fix: watch a contended incremental rebuild request is recorded on its own queue marker instead of being dropped, so a derived-change request that loses the rebuild lock still runs on the next pass (#4800, #4802, thanks @​Deepjyoti-Sarmah).
• Fix: query source nodes are ranked above tests, docs and config in query results (a soft weight, not exclusion, so a term matched only by a test still seeds it and a question mentioning "tests" restores full weight), and the answer is rendered file-first (#4982, thanks @​rohit-jsfreaky).
• Feat: query graphify query reads project query_budget and query_depth defaults from .graphifyrc (explicit CLI flags still win), and gains a --depth N flag; a malformed setting warns and falls back to the built-in defaults (#1654, #4760, thanks @​oleksii-tumanov).
• Fix: install graphify uninstall removes the global # graphify skill registration it wrote into ~/.claude/CLAUDE.md, instead of leaving a dangling pointer to the deleted skill; a hand-written # graphify section or another tool's registration is preserved (#4975, thanks @​madhusudanpatnaik).
• Fix: js a class extends through a CommonJS require binding (const Base = require('./base'); class D extends Base {}) resolves the inherits edge to the required file's class, matching the ESM import path; an external/unresolved require is left alone (#4688, #4700, thanks @​Mpasha17).
• Fix: skill the --update runbook passes partial_source_files to the manifest write and clears a stale .graphify_partial.txt at the start of the run, so a doc whose chunk was only partly read is re-queued on the next update instead of being stamped done forever (#4807, #4814, #4816, thanks @​gitmotion).
• Fix: skill Step 4 threads force=IS_FORCE into to_json, so a --force rebuild actually overwrites past the #479 shrink guard the runbook told the user to use --force for (#4777, #4805, thanks @​pei711).
• Feat: skill for a hub/bridge question, the query workflow now tells the agent to grep the corpus for the hub's distinctive literals in edge-less files and report code that reimplements the hub instead of calling it (#4426, #4704, thanks @​ayushcodes10).
• Fix: hooks a file whose mtime is newer than graph.json but whose content is unchanged no longer weakens the strict read gate; the hook checks the file's extraction hash against the build manifest before declaring it stale, so a checkout that writes graph.json first does not force a re-read (#4974, thanks @​andrebrait).
• Fix: hooks a dedicated Grep call is held to the same once-per-session orientation gate as Read in strict mode; a directory Grep needs no index match, a single-file Grep is denied only when the graph indexes it, and external or graph-output targets stay silent without consuming the deny (#4973, thanks @​andrebrait).
• Fix: hooks a search whose every literal target is outside the project (a Bash grep/rg on a /tmp or sibling path) emits no project hint, so the graph nudge only fires for in-project searches (#4961, #4979, thanks @​Shubham-Padkonde).
• Perf: load graph.json rows are released as the graph is built (and repeated strings interned) so a load no longer holds both the parsed rows and the finished graph at peak, with identical output (#4960, thanks @​ajbmachon).
• Perf: resolve symbol resolution holds one parsed file at a time instead of retaining every parsed file across the JS and Python passes, collapsing them into a single per-file loop with unchanged edges (#4958, thanks @​ajbmachon).
• Perf: extract edge-dedup keys and per-file rows are released once consumed, cutting peak retention during extraction with identical output (#4959, thanks @​ajbmachon).
• Fix: typescript a typed tagged template (sql<{...}[]>`...`) and an import-qualified generic annotation (import("mod").T<X>) no longer leave the file half-parsed; the recovery runs only on files that already fail to parse, so a type-only import("mod").T stops minting a bogus module node and a false dynamic_import edge (#4976, thanks @​briascoi).
• Fix: go a same-file member call resolves through the receiver's type instead of a declaration-order-dependent same-named method; a bare package-function call no longer binds to a same-named method, and a package-level var fallback only applies to a genuinely unbound receiver (#4962, #4966, thanks @​xiongjianxu).
• Fix: go a member call on a receiver typed from another package (pkg.T, the usual shape of a dependency injected across packages) binds only to the T declared at the path the file imports pkg from, so two packages that both declare T are disambiguated by import evidence; an out-of-corpus qualifier stays unresolved (#3368, #4853, thanks @​nothariharan).
• Feat: go an interface method call additively dispatches to the interface's implicit implementers (method-set superset match, unexported methods scoped to the same directory, capped at 10 implementers and skipped past that), surfacing the concrete methods a call can reach while keeping the edge to the interface (#4934, thanks @​nothariharan).
• Fix: kotlin a call to an overloaded method resolves (Java gives every overload one node id, which the resolver mis-counted as ambiguous), calls inside an init {} block are attributed to the class, and a bare call no longer binds to a class the caller cannot reach through its type chain (#4935, #4956, thanks @​Deepjyoti-Sarmah).
• Fix: python a module-level singleton (g = Service() then g.method()) resolves its member calls through the instance's type, gated by an exact-spelling and lexical-shadow guard so rebinding, local shadowing or an ambiguous constructor leaves it unresolved (#4970, #4972, thanks @​Shubham-Padkonde).
• Fix: js a call through a default-exported object's method (import m from './x'; m.foo()) resolves to the static method, bound only on a single unambiguous target and suppressed by local shadowing, getters, spread or computed keys (#4963, #4967, thanks @​xiongjianxu).
• Fix: solidity an import "../x/Y.sol" resolves the .. to the real file instead of a dangling id that kept the importer's own folder (#4984, #4985, thanks @​rohit-jsfreaky).
• Fix: build the write guard no longer counts an intentional ghost fold (a #1145 same-file twin, #3344 doc-names-a-file, or #3705 method ghost folded into its surviving twin) as a dropped node on the build_merge path; a genuine drop whose survivor is also gone is still refused (#4955, #4957, thanks @​Deepjyoti-Sarmah).
• Fix: extract paths skipped by ignore rules are reported in the extract summary (bounded, sorted, root-relative, with a VCS-aware hint), surfacing the already-collected ignore list without changing the graph (#4965, #4969, thanks @​xiongjianxu).
• Perf: resolution the #3252 cross-file repoint indexes edges by source file instead of scanning every corpus edge per importing file, cutting resolution time on large graphs with no change to the resulting edges (#4980, #4981, thanks @​jinsoo).

... (truncated)

Commits

• 16218bf test(install): serialise the second wheel builder with an inline lock (#4603)
• c051a96 chore: bump AST cache schema to 39 for the markdown namespace/member mentions...
• 03838fe fix(markdown): recognise backslash namespaces and Type::member code-span ment...
• 17cf536 feat(tree): cap directory children while retaining full totals
• 79cfb37 test(install): serialise the second wheel builder under the shared lock (#4603)
• 63cf60d Fix #4603: stage fake install bundles in a temp package root, lock wheel builds
• 4c16a79 test(hooks): isolate ambient venv and PATH in _detect_run
• 892c452 test(reflect): characterize _is_stale across changed/unchanged/vanished sources
• d76b102 docs: note the context-local semantics for spawned workers
• e93821f fix: make the ambient scan root thread-isolated via ContextVar
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.