Graphify-Labs/graphify v0.9.94

graphify 0.9.94

on GitHub

Nineteen community pull requests. A security pass on ingestion: a fetched URL with no hostname, with a malformed or zero port, or with embedded user:pass@ credentials is now rejected before the request leaves, on the first fetch and on every redirect, and a text capture no longer follows a dangling symlink out of the corpus. Extraction and resolution: a Maven POM contributes only its own dependencies, a JS/TS member call on an untyped receiver stops guessing a same-named method in the same file, a CommonJS require binding no longer shadows the class the required file exports, and Objective-C category node ids stay repo-relative instead of embedding the absolute checkout path. SQL gets its own pass: T-SQL bracketed names are unbracketed, a GO batch separator ends the statement, cross-file table stubs fold onto their real definition, and a procedure emits reads_from/writes_to edges. Plus a markdown bare method only links when its class is cited, the MCP node lookup refuses a substring near-miss instead of answering with an unrelated node, a cross-repo edge points at the call site, Objective-C calls resolve across a split header/impl, an incremental build stops re-queuing files an extractor declined by design, a quoted Codex hook command for install paths with spaces, an IPv6 bracketed-Host serve fix, and a complete, drift-guarded --platform list in --help. The AST cache schema is bumped, so the first build after upgrading re-extracts.

• Fix: security validate_url rejects a fetched URL that has no hostname (http:///path), a non-numeric, out-of-range, or zero port, or embedded user:pass@ credentials, before the request is made and again on every redirect, so a malformed or credential-bearing URL is no longer fetched or persisted into the graph; a normal @ in a path or query and a valid high port still pass (#4643, #4644, #4645, thanks @cellrishi-code).
• Fix: manifest a Maven pom.xml contributes only its own <dependencies> (including those under <profiles>), not the version pins under <dependencyManagement> or a build plugin's own <dependencies>, so a parent or BOM POM no longer emits dependency edges it only manages (#4596, thanks @jayhemnani9910).
• Fix: js a member call on an untyped receiver (x.foo() where x has no known type) is deferred to receiver-typed resolution instead of binding to a same-named method elsewhere in the file, so a spurious self-loop or cross-call edge is no longer emitted; this.foo(), a typed receiver, and a locally instantiated receiver still resolve (#4598, #4605, thanks @ayushcodes10; reported by @SaschaAndresGrimm).
• Fix: js a CommonJS const X = require('./m') binding no longer mints a module-scope node that shadows the class the required file exports, so new X() resolves to the required declaration; a real const x = factory() binding still keeps its node (#4621, #4634, thanks @lab1207; reported by @sub4biz).
• Fix: extract an Objective-C category's class and method node ids stay repo-relative instead of embedding the absolute checkout path, so a category file like Foo+Cat.h yields portable ids that match across machines and merge cleanly; two same-named categories in different directories stay distinct (#4666, #4642, thanks @madhusudanpatnaik; reported by @xiongjianxu).
• Fix: codex the generated Codex PreToolUse hook command quotes the graphify executable path, so an install under a path containing a space no longer builds a broken hook command, matching the existing Claude and Gemini hooks (#4662, thanks @supercell02).
• Fix: serve an IPv6 HTTP bind accepts its own bracketed Host header ([::1]:port), so a server bound to an IPv6 loopback no longer refuses every request with a 421 (#4656, thanks @zydo).
• Fix: ingest a text capture never writes through an existing entry: the free-path search uses lstat, so a name that is a dangling symlink is treated as occupied and the capture is diverted instead of following the link and writing outside the corpus (#4657, thanks @zydo).
• Fix: cli graphify --help lists every accepted --platform value (it had omitted amp, copilot, kilo, kimi, and antigravity-windows); the list is derived from the same source as the install usage so the two cannot drift, with a guard test (#4655, thanks @zydo).
• Fix: sql T-SQL bracketed identifiers ([dbo].[Orders]) are unbracketed so a name matches across styles, and a stored procedure's body emits reads_from/writes_to edges for the tables it reads and writes; aliases, variables, temp tables, strings, and comments never become targets (#4635, #4649, thanks @Deepjyoti-Sarmah; reported by @RuVl).
• Fix: sql a GO batch separator (a client command, not a terminator) ends the statement, so a statement after a GO with no trailing ; parses on its own instead of merging into one malformed node; a GO inside a string, comment, or column name is left alone (#4651, #4652, thanks @Deepjyoti-Sarmah).
• Fix: sql a table referenced before its CREATE TABLE is seen folds onto the real definition instead of staying a separate stub, and a schema-qualified name binds correctly, while two genuinely different tables in different schemas (dbo.Orders vs sales.Orders) stay distinct and a SQL stub no longer binds to a same-named class in another language (#4653, #4654, thanks @Deepjyoti-Sarmah).
• Fix: markdown a bare method name in prose (for example redis where only Cache.redis exists) only links to the method when the owning class is cited in the same document, so a plain word is no longer turned into a false references edge; a qualified Class.method or Class::method mention still resolves (#4609, #4617, thanks @nothariharan; reported by @saad-siddique).
• Fix: mcp the get_node and get_neighbors tools, and the explain command, refuse a substring-only near-miss with candidate suggestions instead of returning an unrelated node as the answer; an exact or prefix match still resolves (#3917, #4618, thanks @nothariharan; reported by @Alexandre-Aktisea).
• Fix: cross-repo a cross-repo call edge points at the real call site rather than the caller's header declaration, so the edge's source_file and source_location name the line that makes the call (#4668, #4669, thanks @xiongjianxu).
• Fix: extract an incremental build no longer re-queues, on every run, a code file an extractor declined by design (for example a virtual-workspace manifest); the file is marked ast_empty and left alone, while a genuinely failed or transiently empty extraction is still retried (#2543, #4672, thanks @xiongjianxu).
• Fix: objc a member call resolves when a class is split across a header and an implementation in different directories, binding the selector to its single definition; two unrelated same-named classes that both define the selector stay ambiguous and get no edge (#4673, #4674, thanks @xiongjianxu).