Graphify-Labs/graphify v0.9.97

graphify 0.9.97

on GitHub

0.9.97 (2026-10-27)

• Security: rationale redaction credential redaction for rationale labels moves to a single pre-cache choke point (_redact_rationale_labels inside _safe_extract), so no extractor can skip it, and it now covers more leak shapes: URL userinfo with an empty user or with //@ in the password, PEM private-key bodies, tokens glued to surrounding text by _ (for example ghp_...), Slack xoxe- refresh tokens, short JWTs, and Common Lisp docstrings that previously built labels without redacting. Benign strings (hashes, sk- prose, URLs without userinfo) are left alone (#4647, thanks @0xkaushik-ai).
• Security: deps anyio is floored to >=4.14.2 in the mcp extra, above CVE-2026-63374 (an IDNA 2003 vs 2008 hostname-validation bypass that let a MITM on a non-ASCII domain present a cert for a different ASCII host, CVSS 9.3). anyio is only a transitive dependency and the lockfile already resolves 4.15.1, so this is a floor to stop a future re-resolution from regressing.
• Fix: markdown ATX headings parse per CommonMark: a trailing run of # is not part of the heading text (## Setup ## is "Setup"), up to three spaces of indent are allowed (four is an indented code block), and a hash-only line like ## ## mints no node (#4790, #4791, thanks @jaimemartinez).
• Fix: markdown fenced code blocks are tracked by CommonMark rules (backtick and tilde fences, info strings, matching close length), so a line that looks like a heading inside a fence no longer leaks as structure, and a heading after a ~~~ block that contains a ``` line is no longer lost (#4787, #4788, thanks @jaimemartinez).
• Fix: yaml structural extraction reads the composed node tree, so keys carry their written spelling and their own source line instead of all landing on line 1, and YAML 1.1 bare keys like on/off/yes/no are no longer folded to booleans (a workflow on: block is extracted, not turned into a True node) (#4784, #4785, thanks @jaimemartinez).
• Fix: razor a component's @implements interfaces are extracted as implements edges instead of being silently dropped (#4820, thanks @ayushcodes10).
• Fix: terraform an aliased provider block gets its own alias-qualified node (so two provider "aws" blocks no longer collapse into one and lose attributes), and a provider = aws.west reference resolves to it instead of dangling; a local literally named provider is no longer misread (#4819, thanks @ayushcodes10).
• Fix: cobol paragraphs that follow a nested END PROGRAM reattach to the enclosing program instead of sticking to the nested one, via a program stack (#4824, thanks @ayushcodes10).
• Fix: blade a wire:click directive binds the bare method name: dotted modifiers (wire:click.prevent="submit") are matched, call arguments are trimmed from the name (deleteItem(5) binds deleteItem), and a $-prefixed magic action mints no fabricated edge (#4823, thanks @ayushcodes10).
• Fix: pascal a record is recognised as a type with its own methods in the regex fallback (the default path without the optional pascal extra), matching the tree-sitter path; operator members are extracted too (#4825, thanks @ayushcodes10).
• Fix: vbnet an Operator declaration is extracted as an operator-kind member of its class and its body is walked for calls, so a helper call inside an operator no longer vanishes (#4821, thanks @ayushcodes10).
• Fix: fortran a call resolves to the subroutine it actually names instead of a target salted with the calling file's name (which never resolved), using the extractor's own cross-file stub idiom (#4795, thanks @ayushcodes10).
• Fix: cli graphify query --help/-h (and now graphify explain --help/-h) with nothing else prints usage instead of running a literal query for the text "--help"; a longer question that merely contains "--help" as a substring still runs as a query (#4830, thanks @curl-man).
• Fix: js a nested (inner) function no longer leaks into the file-wide name map, so a call elsewhere in the file binds to the top-level function of that name rather than an inner one it cannot see; recursion, shadowing and sibling scopes resolve correctly (ports the Python scope scheme to JS/TS) (#4767, thanks @smngvlkz).
• Fix: ocaml every binding in an and-chained module ... and ... or class ... and ... is extracted, not just the first, so later bindings are no longer silently dropped; each carries its own source line (#4822, thanks @ayushcodes10).
• Fix: verilog a SystemVerilog class task method is modeled like a function one (its own node, method edge and parameter-type references), and a task-local variable no longer leaks as a false field reference on the class (#4774, thanks @ayushcodes10).
• Fix: build an edge with no relation is dropped instead of persisted, on both the build and the raw --no-cluster write paths, and alias folding (relationship to relation) runs before the check (#4810, thanks @legendteddy; reproducer also filed as #4826 by @sunhouy).
• Fix: build the shrink guard counts a saved document-mention node that folds into its AST file twin on reload as present, not lost, so a cluster-only write is no longer refused when nothing was actually lost (#4778, #4779, thanks @AndresDiagoM).
• Fix: detect a linked git worktree whose main checkout resolves inside the scan root is pruned, so a sibling worktree no longer gets indexed as a second full copy of the repo (#4683, #4833, thanks @barlowa124; duplicate work in #4685 by @AndresDiagoM).
• Fix: resolution an inline comment in a pnpm-workspace glob is stripped per YAML rules, and a glob that Path.glob rejects (a ** component or an absolute pattern) is skipped with a warning instead of crashing the whole extract run (#4681, #4687, thanks @Deepjyoti-Sarmah).
• Fix: report a community hub [[wikilink]] is slugged through the same export._obsidian_safe_stem the export uses, so the link matches the file the export actually writes instead of dangling (#4696, thanks @ayushcodes10).
• Fix: wiki a community relabelled only by letter case keeps its article instead of having the sweep delete the file the run just wrote; on a case-sensitive filesystem the stale lower-case twin is unlinked rather than renamed over the fresh file (which would silently restore the old body) (#4508, #4798, thanks @dupeisen).
• Fix: query filler verbs get/gets/got/getting are dropped from query terms (like the existing work/works), so a framework hub labelled "Get" is not pulled in as a BFS seed by an exact-match bonus; node lookups for a literal Get still resolve (#4686, thanks @AndresDiagoM).