graphify 0.8.49
Fixes
get_communityMCP tool now shows the community name in its header (Community 12 — Auth & Sessions (8 nodes)), matchingget_node/ query output; skipped when it is only theCommunity Nplaceholder so it never doubles (#1448, thanks @rmart1308).graphify reflectno longer duplicates "known dead ends" / "corrections" lines when the same Q&A is saved more than once (dedup by question, most recent wins).- Work-memory works without the git hook: the skill runs
graphify reflect --if-staleat the start of graph work, so a skill-only install still refreshesLESSONS.md.--if-staleno-ops when the file is already newer than every input, so the post-commit hook is an optimization rather than a requirement.
Security
- Floor
starletteat>=1.3.1for CVE-2026-48818 and CVE-2026-54283 (both resolved by 1.3.1). starlette underpins the HTTP MCP transport (graphify-mcpover HTTP); stdio and the CLI are unaffected. Now declared in themcp/allextras and floored so end users installinggraphifyy[mcp]are covered, not just the dev lock (#1391, #1396, thanks @orbisai0security).
Refactor / Performance
- Begin splitting
extract.pyinto per-language modules undergraphify/extractors/(blade, elixir, razor, zig + sharedbase.py), behavior-neutral, withextract.pyre-exporting the moved names so all callers and the dispatch table are unchanged (#1212, thanks @TheFedaikin). - Parallel community labeling:
cluster-only/labeltake--max-concurrencyand--batch-size;ollama/claude-clistay serial unless opted in (#1390).
Install: uv tool install graphifyy==0.8.49