Skip to content

build(deps): bump the graph-dependencies group across 1 directory with 3 updates - #28

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/graph-dependencies-14c0922ffb
Open

build(deps): bump the graph-dependencies group across 1 directory with 3 updates#28
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/graph-dependencies-14c0922ffb

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 30, 2026

Copy link
Copy Markdown
Contributor

Bumps the graph-dependencies group with 3 updates in the / directory: graphifyy, tree-sitter-scala and tree-sitter-swift.

Updates graphifyy from 0.9.73 to 0.9.95

Release notes

Sourced from graphifyy's releases.

graphify 0.9.95

Twenty-one community pull requests. A security pass on install: the skill-install writes go through randomly-named temp files instead of predictable ones, so a pre-planted symlink can no longer redirect a write. Extraction: Python, Go, C++ and Rust explicit type aliases (and Rust union items) are extracted as type nodes so references resolve instead of minting sourceless stubs, each C# method overload gets its own node bound by argument count, and a package.json dependency's manifest entry links to the node that references it. Plus a one-root-per-repo tree on merged graphs, extended-length cache paths on Windows, and binary media no longer counted as text. The AST cache schema is bumped, so the first build after upgrading re-extracts.

  • Fix: security the skill install stages every write (version stamp, SKILL.md, references) through a randomly-named mkstemp/mkdtemp file created with O_EXCL and restrictive mode instead of a predictable *.tmp name, so a local attacker who pre-creates a symlink at that path can no longer redirect the write to clobber an arbitrary file; the final move stays atomic (#4513, thanks @​Mahdifotohi).
  • Fix: python an explicit module-level type alias (X: TypeAlias = ..., type X = ..., NewType) is extracted as a type node, so a field or parameter typed by the alias resolves to it instead of minting a sourceless stub; an implicit assignment, a local alias, or a re-export is left alone (#4578, thanks @​madhusudanpatnaik).
  • Fix: go a type A = B alias is extracted as a type node (tree-sitter parses it as a type_alias, not a type_spec), so references resolve to it; a re-export (type Field = pkg.Field) mints no node (#4579, thanks @​madhusudanpatnaik).
  • Fix: cpp a namespace-scope using A = B; or typedef B A; alias is extracted as a type node so references resolve; a member alias inside a class and a same-name re-export are excluded (#4580, thanks @​madhusudanpatnaik).
  • Fix: rust a type alias and a union item are extracted as type nodes (a union's fields reference their types like a struct), so references resolve instead of minting stubs; an impl-associated type is excluded (#4581, Refs #4285, thanks @​madhusudanpatnaik; reported by @​jonatasbcardio-boop).
  • Fix: csharp each method overload gets its own node and source location instead of collapsing to one, and a call binds to the overload matching its argument count, across in-file, receiver-typed, bare-name cross-file, partial-class, and interface-dispatch resolution; a non-overloaded method keeps its id (#4584, #4591, thanks @​Mpasha17; reported by @​TerraVenil).
  • Fix: tree graphify export tree on a merged multi-repo graph gives each repo its own root (keyed by the repo tag) instead of conflating same-path files from different repos; untagged nodes are not counted as a repo (#4524, #4525, thanks @​AromalBiju1).
  • Fix: cache AST cache entries are read and written through Windows extended-length (\\?\) paths, so a deep cache path over the 260-character limit no longer fails extraction with a FileNotFoundError; a no-op off Windows (#4542, thanks @​omsenjalia).
  • Fix: detect a binary media file (an image or audio/video) is no longer read and counted as text toward the corpus word total; an SVG stays counted as the XML text it is (#4548, thanks @​kalkaran).
  • Fix: json_config a package.json dependency's manifest entry links (declares) to the ref node that importing code resolves to, so the manifest entry and its importers share one node instead of being orphaned; the entry is relabelled name@range (#4569, #4572, thanks @​Deepjyoti-Sarmah; reported by @​BiSide).
  • Feature: yaml .yaml/.yml files are now extracted structurally (a file node plus contains edges to keys) and classified as code rather than documents, so Helm charts, Kubernetes manifests, and CI pipelines contribute nodes to a code-only or --update run instead of nothing, matching how .json is handled. Multi-document streams (--- separators) are walked per document; a data array, an OpenAPI/Swagger spec, a JSON-schema-in-YAML, and a flat data bundle are skipped so data-heavy YAML does not mint orphan nodes; parsing uses safe_load so a !!python/... tag never executes; output is bounded (1 MiB, 500 pairs, depth 6). The AST cache schema is bumped, so the first build after upgrading re-extracts (#2214, #4706, thanks @​nothariharan; reported by @​dchavezf).
  • Fix: extract a bare call that resolves to a same-named symbol only because the caller imported that symbol's module (from b import other, then a call to a _make_id defined in both a.py and b.py) is no longer promoted to EXTRACTED; the edge is still emitted for connectivity but stays INFERRED, so a symbol that was never imported is not falsely certified. A real symbol import (from a import _make_id) still resolves EXTRACTED (#2945, #4707, thanks @​nothariharan; reported by @​TotalUnitManagement).
  • Fix: security the SSRF guard blocks a host that resolves to a multicast address (224.0.0.0/4, ff00::/8), closing a gap alongside the existing private/reserved/loopback/link-local checks (#4708, thanks @​Dextheking1).
  • Fix: security the Obsidian export sanitizes a node's file-type and confidence before emitting them as frontmatter tags, so a crafted value cannot break out of the YAML list into a sibling key, matching how community tags are already sanitized (#4709, thanks @​Dextheking1).
  • Fix: security the Google Workspace shortcut sidecar escapes a file id or url through full YAML double-quoted-scalar escaping (tab, C0/DEL controls, and the Unicode line breaks U+2028/U+2029/U+0085), so a hostile shortcut file cannot inject frontmatter keys (#4710, thanks @​Dextheking1).
  • Fix: affected graphify affected <path> resolves a path whose file-node label was disambiguated by the shared-basename suffix pass (for example two hooks.py from different directories), reusing the canonical file-label predicate instead of a bare basename match (#4698, #4713, thanks @​Deepjyoti-Sarmah; reported by @​karsan8119).
  • Fix: build a raw (--no-cluster) build resolves an import endpoint through the same old-stem alias index the clustered build uses, and mints an external stub only after resolution, so the raw graph no longer freezes an import onto a stub when the clustered graph resolves it (#4670, #4676, thanks @​nothariharan; reported by @​xiongjianxu).
  • Fix: cross-repo an Objective-C class declared in one repo's header and implemented in another repo's .m binds a member call to the implementation, the cross-repo analog of the same-repo split-dir fix; two same-named classes that both define the selector stay ambiguous (#4690, #4691, thanks @​xiongjianxu).
  • Fix: hooks the rebuild hook runs from the checkout's top level (derived from the git common dir, falling back to --show-toplevel), so a stray graphify-out/ in a subdirectory can no longer root the rebuild at the wrong place and walk an enormous tree (#3258, #4689, thanks @​jaimemartinez; reported by @​dsfaccini).
  • Fix: objc NS_CLOSED_ENUM declarations are extracted as enums with their cases, the same as NS_ENUM/NS_OPTIONS; the AST cache schema is bumped so the first build after upgrading re-extracts (#4705, thanks @​Jvxoq).
  • Fix: sql a CREATE TABLE whose column default the SQL grammar cannot parse (for example MySQL/MariaDB DEFAULT current_timestamp()) is recovered from the ERROR node instead of being dropped, so the table and its foreign-key references still resolve; the AST cache schema is bumped (#4613, #4677, thanks @​08raviyadav; reported by @​AirRunner).

graphify 0.9.94

Nineteen community pull requests. A security pass on ingestion: a fetched URL with no hostname, with a malformed or zero port, or with embedded user:pass@ credentials is now rejected before the request leaves, on the first fetch and on every redirect, and a text capture no longer follows a dangling symlink out of the corpus. Extraction and resolution: a Maven POM contributes only its own dependencies, a JS/TS member call on an untyped receiver stops guessing a same-named method in the same file, a CommonJS require binding no longer shadows the class the required file exports, and Objective-C category node ids stay repo-relative instead of embedding the absolute checkout path. SQL gets its own pass: T-SQL bracketed names are unbracketed, a GO batch separator ends the statement, cross-file table stubs fold onto their real definition, and a procedure emits reads_from/writes_to edges. Plus a markdown bare method only links when its class is cited, the MCP node lookup refuses a substring near-miss instead of answering with an unrelated node, a cross-repo edge points at the call site, Objective-C calls resolve across a split header/impl, an incremental build stops re-queuing files an extractor declined by design, a quoted Codex hook command for install paths with spaces, an IPv6 bracketed-Host serve fix, and a complete, drift-guarded --platform list in --help. The AST cache schema is bumped, so the first build after upgrading re-extracts.

  • Fix: security validate_url rejects a fetched URL that has no hostname (http:///path), a non-numeric, out-of-range, or zero port, or embedded user:pass@ credentials, before the request is made and again on every redirect, so a malformed or credential-bearing URL is no longer fetched or persisted into the graph; a normal @ in a path or query and a valid high port still pass (#4643, #4644, #4645, thanks @​cellrishi-code).
  • Fix: manifest a Maven pom.xml contributes only its own <dependencies> (including those under <profiles>), not the version pins under <dependencyManagement> or a build plugin's own <dependencies>, so a parent or BOM POM no longer emits dependency edges it only manages (#4596, thanks @​jayhemnani9910).
  • Fix: js a member call on an untyped receiver (x.foo() where x has no known type) is deferred to receiver-typed resolution instead of binding to a same-named method elsewhere in the file, so a spurious self-loop or cross-call edge is no longer emitted; this.foo(), a typed receiver, and a locally instantiated receiver still resolve (#4598, #4605, thanks @​ayushcodes10; reported by @​SaschaAndresGrimm).
  • Fix: js a CommonJS const X = require('./m') binding no longer mints a module-scope node that shadows the class the required file exports, so new X() resolves to the required declaration; a real const x = factory() binding still keeps its node (#4621, #4634, thanks @​lab1207; reported by @​sub4biz).
  • Fix: extract an Objective-C category's class and method node ids stay repo-relative instead of embedding the absolute checkout path, so a category file like Foo+Cat.h yields portable ids that match across machines and merge cleanly; two same-named categories in different directories stay distinct (#4666, #4642, thanks @​madhusudanpatnaik; reported by @​xiongjianxu).
  • Fix: codex the generated Codex PreToolUse hook command quotes the graphify executable path, so an install under a path containing a space no longer builds a broken hook command, matching the existing Claude and Gemini hooks (#4662, thanks @​supercell02).
  • Fix: serve an IPv6 HTTP bind accepts its own bracketed Host header ([::1]:port), so a server bound to an IPv6 loopback no longer refuses every request with a 421 (#4656, thanks @​zydo).
  • Fix: ingest a text capture never writes through an existing entry: the free-path search uses lstat, so a name that is a dangling symlink is treated as occupied and the capture is diverted instead of following the link and writing outside the corpus (#4657, thanks @​zydo).
  • Fix: cli graphify --help lists every accepted --platform value (it had omitted amp, copilot, kilo, kimi, and antigravity-windows); the list is derived from the same source as the install usage so the two cannot drift, with a guard test (#4655, thanks @​zydo).
  • Fix: sql T-SQL bracketed identifiers ([dbo].[Orders]) are unbracketed so a name matches across styles, and a stored procedure's body emits reads_from/writes_to edges for the tables it reads and writes; aliases, variables, temp tables, strings, and comments never become targets (#4635, #4649, thanks @​Deepjyoti-Sarmah; reported by @​RuVl).
  • Fix: sql a GO batch separator (a client command, not a terminator) ends the statement, so a statement after a GO with no trailing ; parses on its own instead of merging into one malformed node; a GO inside a string, comment, or column name is left alone (#4651, #4652, thanks @​Deepjyoti-Sarmah).
  • Fix: sql a table referenced before its CREATE TABLE is seen folds onto the real definition instead of staying a separate stub, and a schema-qualified name binds correctly, while two genuinely different tables in different schemas (dbo.Orders vs sales.Orders) stay distinct and a SQL stub no longer binds to a same-named class in another language (#4653, #4654, thanks @​Deepjyoti-Sarmah).
  • Fix: markdown a bare method name in prose (for example redis where only Cache.redis exists) only links to the method when the owning class is cited in the same document, so a plain word is no longer turned into a false references edge; a qualified Class.method or Class::method mention still resolves (#4609, #4617, thanks @​nothariharan; reported by @​saad-siddique).
  • Fix: mcp the get_node and get_neighbors tools, and the explain command, refuse a substring-only near-miss with candidate suggestions instead of returning an unrelated node as the answer; an exact or prefix match still resolves (#3917, #4618, thanks @​nothariharan; reported by @​Alexandre-Aktisea).
  • Fix: cross-repo a cross-repo call edge points at the real call site rather than the caller's header declaration, so the edge's source_file and source_location name the line that makes the call (#4668, #4669, thanks @​xiongjianxu).
  • Fix: extract an incremental build no longer re-queues, on every run, a code file an extractor declined by design (for example a virtual-workspace manifest); the file is marked ast_empty and left alone, while a genuinely failed or transiently empty extraction is still retried (#2543, #4672, thanks @​xiongjianxu).
  • Fix: objc a member call resolves when a class is split across a header and an implementation in different directories, binding the selector to its single definition; two unrelated same-named classes that both define the selector stay ambiguous and get no edge (#4673, #4674, thanks @​xiongjianxu).

graphify 0.9.93

Twenty-two community pull requests. Extraction: a reference to a Kotlin type alias, C# delegate, Swift macro, Dart typedef, Python module function or Rust sibling-module use now resolves to its real declaration instead of minting a sourceless stub; Metal/CUDA GPU qualifiers no longer mint god nodes; extern "C" headers route to the C++ extractor; an extensionless script with a versioned-interpreter shebang is classified; and Obsidian vault-relative wikilinks resolve. Plus a credential-redaction pass on rationale labels, a node-confidence fold, a truncated-reply label decode, a .graphifyrc BOM fix, a GraphML multigraph export fix, two-repo file disambiguation in explain and path, a PDF-read warning, no skill writes on --version/--help, two PR-tooling fixes (slashed default branch, legacy CI statuses), and a skill partly-read-file recovery so a long file a subagent only skimmed is retried on the next --update instead of silently kept half-read. The AST cache schema is bumped, so the first build after upgrading re-extracts.

  • Fix: Kotlin a typealias declaration is extracted, so a field or parameter typed as the alias resolves to it instead of minting a sourceless cross-file stub (#4553, #4557, thanks @​rajatnagda45).

... (truncated)

Changelog

Sourced from graphifyy's changelog.

0.9.95 (2026-10-23)

Twenty-one community pull requests. A security pass on install: the skill-install writes go through randomly-named temp files instead of predictable ones, so a pre-planted symlink can no longer redirect a write. Extraction: Python, Go, C++ and Rust explicit type aliases (and Rust union items) are extracted as type nodes so references resolve instead of minting sourceless stubs, each C# method overload gets its own node bound by argument count, and a package.json dependency's manifest entry links to the node that references it. Plus a one-root-per-repo tree on merged graphs, extended-length cache paths on Windows, and binary media no longer counted as text. The AST cache schema is bumped, so the first build after upgrading re-extracts.

  • Fix: security the skill install stages every write (version stamp, SKILL.md, references) through a randomly-named mkstemp/mkdtemp file created with O_EXCL and restrictive mode instead of a predictable *.tmp name, so a local attacker who pre-creates a symlink at that path can no longer redirect the write to clobber an arbitrary file; the final move stays atomic (#4513, thanks @​Mahdifotohi).
  • Fix: python an explicit module-level type alias (X: TypeAlias = ..., type X = ..., NewType) is extracted as a type node, so a field or parameter typed by the alias resolves to it instead of minting a sourceless stub; an implicit assignment, a local alias, or a re-export is left alone (#4578, thanks @​madhusudanpatnaik).
  • Fix: go a type A = B alias is extracted as a type node (tree-sitter parses it as a type_alias, not a type_spec), so references resolve to it; a re-export (type Field = pkg.Field) mints no node (#4579, thanks @​madhusudanpatnaik).
  • Fix: cpp a namespace-scope using A = B; or typedef B A; alias is extracted as a type node so references resolve; a member alias inside a class and a same-name re-export are excluded (#4580, thanks @​madhusudanpatnaik).
  • Fix: rust a type alias and a union item are extracted as type nodes (a union's fields reference their types like a struct), so references resolve instead of minting stubs; an impl-associated type is excluded (#4581, Refs #4285, thanks @​madhusudanpatnaik; reported by @​jonatasbcardio-boop).
  • Fix: csharp each method overload gets its own node and source location instead of collapsing to one, and a call binds to the overload matching its argument count, across in-file, receiver-typed, bare-name cross-file, partial-class, and interface-dispatch resolution; a non-overloaded method keeps its id (#4584, #4591, thanks @​Mpasha17; reported by @​TerraVenil).
  • Fix: tree graphify export tree on a merged multi-repo graph gives each repo its own root (keyed by the repo tag) instead of conflating same-path files from different repos; untagged nodes are not counted as a repo (#4524, #4525, thanks @​AromalBiju1).
  • Fix: cache AST cache entries are read and written through Windows extended-length (\\?\) paths, so a deep cache path over the 260-character limit no longer fails extraction with a FileNotFoundError; a no-op off Windows (#4542, thanks @​omsenjalia).
  • Fix: detect a binary media file (an image or audio/video) is no longer read and counted as text toward the corpus word total; an SVG stays counted as the XML text it is (#4548, thanks @​kalkaran).
  • Fix: json_config a package.json dependency's manifest entry links (declares) to the ref node that importing code resolves to, so the manifest entry and its importers share one node instead of being orphaned; the entry is relabelled name@range (#4569, #4572, thanks @​Deepjyoti-Sarmah; reported by @​BiSide).
  • Feature: yaml .yaml/.yml files are now extracted structurally (a file node plus contains edges to keys) and classified as code rather than documents, so Helm charts, Kubernetes manifests, and CI pipelines contribute nodes to a code-only or --update run instead of nothing, matching how .json is handled. Multi-document streams (--- separators) are walked per document; a data array, an OpenAPI/Swagger spec, a JSON-schema-in-YAML, and a flat data bundle are skipped so data-heavy YAML does not mint orphan nodes; parsing uses safe_load so a !!python/... tag never executes; output is bounded (1 MiB, 500 pairs, depth 6). The AST cache schema is bumped, so the first build after upgrading re-extracts (#2214, #4706, thanks @​nothariharan; reported by @​dchavezf).
  • Fix: extract a bare call that resolves to a same-named symbol only because the caller imported that symbol's module (from b import other, then a call to a _make_id defined in both a.py and b.py) is no longer promoted to EXTRACTED; the edge is still emitted for connectivity but stays INFERRED, so a symbol that was never imported is not falsely certified. A real symbol import (from a import _make_id) still resolves EXTRACTED (#2945, #4707, thanks @​nothariharan; reported by @​TotalUnitManagement).
  • Fix: security the SSRF guard blocks a host that resolves to a multicast address (224.0.0.0/4, ff00::/8), closing a gap alongside the existing private/reserved/loopback/link-local checks (#4708, thanks @​Dextheking1).
  • Fix: security the Obsidian export sanitizes a node's file-type and confidence before emitting them as frontmatter tags, so a crafted value cannot break out of the YAML list into a sibling key, matching how community tags are already sanitized (#4709, thanks @​Dextheking1).
  • Fix: security the Google Workspace shortcut sidecar escapes a file id or url through full YAML double-quoted-scalar escaping (tab, C0/DEL controls, and the Unicode line breaks U+2028/U+2029/U+0085), so a hostile shortcut file cannot inject frontmatter keys (#4710, thanks @​Dextheking1).
  • Fix: affected graphify affected <path> resolves a path whose file-node label was disambiguated by the shared-basename suffix pass (for example two hooks.py from different directories), reusing the canonical file-label predicate instead of a bare basename match (#4698, #4713, thanks @​Deepjyoti-Sarmah; reported by @​karsan8119).
  • Fix: build a raw (--no-cluster) build resolves an import endpoint through the same old-stem alias index the clustered build uses, and mints an external stub only after resolution, so the raw graph no longer freezes an import onto a stub when the clustered graph resolves it (#4670, #4676, thanks @​nothariharan; reported by @​xiongjianxu).
  • Fix: cross-repo an Objective-C class declared in one repo's header and implemented in another repo's .m binds a member call to the implementation, the cross-repo analog of the same-repo split-dir fix; two same-named classes that both define the selector stay ambiguous (#4690, #4691, thanks @​xiongjianxu).
  • Fix: hooks the rebuild hook runs from the checkout's top level (derived from the git common dir, falling back to --show-toplevel), so a stray graphify-out/ in a subdirectory can no longer root the rebuild at the wrong place and walk an enormous tree (#3258, #4689, thanks @​jaimemartinez; reported by @​dsfaccini).
  • Fix: objc NS_CLOSED_ENUM declarations are extracted as enums with their cases, the same as NS_ENUM/NS_OPTIONS; the AST cache schema is bumped so the first build after upgrading re-extracts (#4705, thanks @​Jvxoq).
  • Fix: sql a CREATE TABLE whose column default the SQL grammar cannot parse (for example MySQL/MariaDB DEFAULT current_timestamp()) is recovered from the ERROR node instead of being dropped, so the table and its foreign-key references still resolve; the AST cache schema is bumped (#4613, #4677, thanks @​08raviyadav; reported by @​AirRunner).

0.9.94 (2026-10-22)

Nineteen community pull requests. A security pass on ingestion: a fetched URL with no hostname, with a malformed or zero port, or with embedded user:pass@ credentials is now rejected before the request leaves, on the first fetch and on every redirect, and a text capture no longer follows a dangling symlink out of the corpus. Extraction and resolution: a Maven POM contributes only its own dependencies, a JS/TS member call on an untyped receiver stops guessing a same-named method in the same file, a CommonJS require binding no longer shadows the class the required file exports, and Objective-C category node ids stay repo-relative instead of embedding the absolute checkout path. SQL gets its own pass: T-SQL bracketed names are unbracketed, a GO batch separator ends the statement, cross-file table stubs fold onto their real definition, and a procedure emits reads_from/writes_to edges. Plus a markdown bare method only links when its class is cited, the MCP node lookup refuses a substring near-miss instead of answering with an unrelated node, a cross-repo edge points at the call site, Objective-C calls resolve across a split header/impl, an incremental build stops re-queuing files an extractor declined by design, a quoted Codex hook command for install paths with spaces, an IPv6 bracketed-Host serve fix, and a complete, drift-guarded --platform list in --help. The AST cache schema is bumped, so the first build after upgrading re-extracts.

  • Fix: security validate_url rejects a fetched URL that has no hostname (http:///path), a non-numeric, out-of-range, or zero port, or embedded user:pass@ credentials, before the request is made and again on every redirect, so a malformed or credential-bearing URL is no longer fetched or persisted into the graph; a normal @ in a path or query and a valid high port still pass (#4643, #4644, #4645, thanks @​cellrishi-code).
  • Fix: manifest a Maven pom.xml contributes only its own <dependencies> (including those under <profiles>), not the version pins under <dependencyManagement> or a build plugin's own <dependencies>, so a parent or BOM POM no longer emits dependency edges it only manages (#4596, thanks @​jayhemnani9910).
  • Fix: js a member call on an untyped receiver (x.foo() where x has no known type) is deferred to receiver-typed resolution instead of binding to a same-named method elsewhere in the file, so a spurious self-loop or cross-call edge is no longer emitted; this.foo(), a typed receiver, and a locally instantiated receiver still resolve (#4598, #4605, thanks @​ayushcodes10; reported by @​SaschaAndresGrimm).
  • Fix: js a CommonJS const X = require('./m') binding no longer mints a module-scope node that shadows the class the required file exports, so new X() resolves to the required declaration; a real const x = factory() binding still keeps its node (#4621, #4634, thanks @​lab1207; reported by @​sub4biz).
  • Fix: extract an Objective-C category's class and method node ids stay repo-relative instead of embedding the absolute checkout path, so a category file like Foo+Cat.h yields portable ids that match across machines and merge cleanly; two same-named categories in different directories stay distinct (#4666, #4642, thanks @​madhusudanpatnaik; reported by @​xiongjianxu).
  • Fix: codex the generated Codex PreToolUse hook command quotes the graphify executable path, so an install under a path containing a space no longer builds a broken hook command, matching the existing Claude and Gemini hooks (#4662, thanks @​supercell02).
  • Fix: serve an IPv6 HTTP bind accepts its own bracketed Host header ([::1]:port), so a server bound to an IPv6 loopback no longer refuses every request with a 421 (#4656, thanks @​zydo).
  • Fix: ingest a text capture never writes through an existing entry: the free-path search uses lstat, so a name that is a dangling symlink is treated as occupied and the capture is diverted instead of following the link and writing outside the corpus (#4657, thanks @​zydo).
  • Fix: cli graphify --help lists every accepted --platform value (it had omitted amp, copilot, kilo, kimi, and antigravity-windows); the list is derived from the same source as the install usage so the two cannot drift, with a guard test (#4655, thanks @​zydo).
  • Fix: sql T-SQL bracketed identifiers ([dbo].[Orders]) are unbracketed so a name matches across styles, and a stored procedure's body emits reads_from/writes_to edges for the tables it reads and writes; aliases, variables, temp tables, strings, and comments never become targets (#4635, #4649, thanks @​Deepjyoti-Sarmah; reported by @​RuVl).
  • Fix: sql a GO batch separator (a client command, not a terminator) ends the statement, so a statement after a GO with no trailing ; parses on its own instead of merging into one malformed node; a GO inside a string, comment, or column name is left alone (#4651, #4652, thanks @​Deepjyoti-Sarmah).
  • Fix: sql a table referenced before its CREATE TABLE is seen folds onto the real definition instead of staying a separate stub, and a schema-qualified name binds correctly, while two genuinely different tables in different schemas (dbo.Orders vs sales.Orders) stay distinct and a SQL stub no longer binds to a same-named class in another language (#4653, #4654, thanks @​Deepjyoti-Sarmah).
  • Fix: markdown a bare method name in prose (for example redis where only Cache.redis exists) only links to the method when the owning class is cited in the same document, so a plain word is no longer turned into a false references edge; a qualified Class.method or Class::method mention still resolves (#4609, #4617, thanks @​nothariharan; reported by @​saad-siddique).
  • Fix: mcp the get_node and get_neighbors tools, and the explain command, refuse a substring-only near-miss with candidate suggestions instead of returning an unrelated node as the answer; an exact or prefix match still resolves (#3917, #4618, thanks @​nothariharan; reported by @​Alexandre-Aktisea).
  • Fix: cross-repo a cross-repo call edge points at the real call site rather than the caller's header declaration, so the edge's source_file and source_location name the line that makes the call (#4668, #4669, thanks @​xiongjianxu).
  • Fix: extract an incremental build no longer re-queues, on every run, a code file an extractor declined by design (for example a virtual-workspace manifest); the file is marked ast_empty and left alone, while a genuinely failed or transiently empty extraction is still retried (#2543, #4672, thanks @​xiongjianxu).
  • Fix: objc a member call resolves when a class is split across a header and an implementation in different directories, binding the selector to its single definition; two unrelated same-named classes that both define the selector stay ambiguous and get no edge (#4673, #4674, thanks @​xiongjianxu).

0.9.93 (2026-10-20)

... (truncated)

Commits
  • 92741d1 docs(security): refresh the threat-surface table (#4643-#4645, #4657, #4566, ...
  • 85567c9 docs(readme): list the antigravity-windows platform (#4655)
  • aa8ca73 docs: document GRAPHIFY_CLAUDE_CLI_MODEL (#2861)
  • e8b1bb5 docs(readme): list the optional [watch] extra (#1203)
  • 7174d3b docs(readme): document labeling batch limits, --missing-only, and html node l...
  • b111c5c docs(changelog): fold the batch into the still-unreleased 0.9.95 (now 21 PRs)
  • 2a0cacb docs(changelog): open 0.9.96 with the install-security, type-alias, csharp-ov...
  • 18e52c4 build(cache): bump schema to 25 for the type-alias, C# overload, and package....
  • e760194 fix(json_config): link a package.json dependency's manifest entry to its ref ...
  • 87151e4 fix(csharp): give each method overload its own node and bind calls by argumen...
  • Additional commits viewable in compare view

Updates tree-sitter-scala from 0.26.2 to 0.26.3

Release notes

Sourced from tree-sitter-scala's releases.

v0.26.3

bug fixes

behind the scenes

new contributors

Full Changelog: tree-sitter/tree-sitter-scala@v0.26.2...v0.26.3

Commits
  • 851032f Merge pull request #687 from eed3si9n/wip/bump-version
  • a941de4 Bump to 0.26.3
  • b924e51 Merge pull request #686 from tree-sitter/generation
  • 65d08af chore: generate and sync from 8b7250aa3e1edc25a84cdd87dfea849b668a2372
  • 8b7250a Merge pull request #683 from requaos/scala2-export-identifier
  • ec65f61 Merge branch 'master' into scala2-export-identifier
  • 8ba1d41 Merge pull request #685 from tree-sitter/generation
  • 25655cb chore: generate and sync from 37d5424b587e29ca95f5f6b09f448b1baf206c69
  • 37d5424 Merge pull request #684 from requaos/braced-for-dedent-enumerator
  • 05985b7 fix: read export as an identifier and a package segment in Scala 2 code
  • Additional commits viewable in compare view

Updates tree-sitter-swift from 0.7.3 to 0.7.4

Commits
  • 171fa3b 0.7.4 release
  • b42acc4 Updating top repository version
  • 5f435e2 Parse Swift 6 syntax: sending, isolated, copy, value generics, inline arrays,...
  • 35245fb fix: multi_agent.cwe-476 security vulnerability
  • 187fd4d Add strict memory safety syntax -- SE-0458
  • 4a0e502 Updating top repository version
  • 00bbb0a Fix npm publish never triggering after tag pushes
  • 048688b Include prebuilt .wasm in the npm package
  • f02fc0a Updating top repository version

@dependabot
build(deps): bump the graph-dependencies group across 1 directory wit…
12f9eff 
…h 3 updates

Bumps the graph-dependencies group with 3 updates in the / directory: [graphifyy](https://github.com/Graphify-Labs/graphify), [tree-sitter-scala](https://github.com/tree-sitter/tree-sitter-scala) and [tree-sitter-swift](https://github.com/alex-pinkus/tree-sitter-swift).


Updates `graphifyy` from 0.9.73 to 0.9.95
- [Release notes](https://github.com/Graphify-Labs/graphify/releases)
- [Changelog](https://github.com/Graphify-Labs/graphify/blob/v8/CHANGELOG.md)
- [Commits](Graphify-Labs/graphify@v0.9.73...v0.9.95)

Updates `tree-sitter-scala` from 0.26.2 to 0.26.3
- [Release notes](https://github.com/tree-sitter/tree-sitter-scala/releases)
- [Commits](tree-sitter/tree-sitter-scala@v0.26.2...v0.26.3)

Updates `tree-sitter-swift` from 0.7.3 to 0.7.4
- [Release notes](https://github.com/alex-pinkus/tree-sitter-swift/releases)
- [Commits](alex-pinkus/tree-sitter-swift@0.7.3...0.7.4)

---
updated-dependencies:
- dependency-name: graphifyy
  dependency-version: 0.9.95
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: graph-dependencies
- dependency-name: tree-sitter-scala
  dependency-version: 0.26.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: graph-dependencies
- dependency-name: tree-sitter-swift
  dependency-version: 0.7.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: graph-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 30, 2026
@vercel

vercel Bot commented Oct 30, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
opensrced Ready Ready Preview Oct 30, 2026 6:42pm UTC
opensrced-staging Ready Ready Preview Oct 30, 2026 6:42pm UTC

@dependabot dependabot Bot added the python Pull requests that update python code label Oct 30, 2026

This branch was successfully deployed

2 active deployments
Preview – opensrced-staging — 12f9eff0 Deployed Oct 30, 2026 by vercel[bot]
View deployment
Preview – opensrced — 12f9eff0 Deployed Oct 30, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants