deps(python): bump graphifyy from 0.9.39 to 0.9.42 in the python-minor-and-patch group by dependabot[bot] · Pull Request #112 · bifrost0x/webssh

dependabot · 2026-08-17T04:22:56Z

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Bumps the python-minor-and-patch group with 1 update: graphifyy.

Updates graphifyy from 0.9.39 to 0.9.42

Release notes

v0.9.42

A large correctness, determinism, and portability release with fixes from many community contributors.

Extraction / resolution

JS/TS for...of / for...in loop bindings are shadowed, so they no longer fabricate indirect_call edges (#2685, @ousamabenyounes) — completes the loop/closure/catch shadow family (#2568/#2569/#2517).

Python relative subpackage imports (from ..pkg.sub import x) resolve to the package __init__ (#2688, @ousamabenyounes).

A non-regular file (FIFO/device) in the tree no longer hangs extraction; non-regular files are skipped (#2463, @itskaism).

A .sql file that fails to parse with tree-sitter-sql installed-but-broken now reports the real error instead of "not installed" (#2602, @ousamabenyounes).

Determinism / data integrity

graphify update incremental runs re-queue a file rewritten to the same length within one mtime tick (#2466, @itskaism), complementing the 0.9.40 file-hash guard (#2612).

Graph provenance (built_at_commit) is stamped from the analysed repo, not the shell cwd (#2699, @C0KERNEL).

Corrupt semantic-cache entries are surfaced and re-extracted instead of silently missed (#2683, @ousamabenyounes).

graph_has_legacy_ids no longer false-positives on a global MCP node id (#2408, @aryanbonigala).

Paths / Windows portability

source_file and the model-facing paths are canonicalized to POSIX; atomic writes and installs are hardened for Windows, incl. a read-only packaged bundle (#2620/#2622, @rajarshidattapy; #2453, @bensleveritt).

GRAPH_REPORT.md uses a portable basename, not an absolute host path (#2682, @ousamabenyounes).

The apm.yml fallback parser captures the package version (#2465, @itskaism).

CLI / export

affected resolves a ./-relative seed instead of silently returning nothing (#2707, @phudayyy).

Hyperedge regions in graph.html are traced in convex-hull order, so the shaded polygon no longer self-intersects (#2449, @ysys143).

Test / docs

Windows-portability test fixes, a refreshed ARCHITECTURE.md module table with a doc-parity test, and README notes on CI parity + Windows prerequisites (#2620/#2622/#2126/#2642/#2646/#2647/#2648/#2651, @rajarshidattapy/@redzwanmutalib/@nelsondeleonc-source).

v0.9.41

Correctness, determinism, and data-integrity release — a large batch of community-contributed fixes.

Fix: graphify update refuses to overwrite the graph with a shrunken one when the shrink was caused by an extractor failure this run, instead of silently replacing good data (#2663, thanks @ousamabenyounes); a genuine deletion still shrinks the graph.

Fix: a JS/TS catch binding passed as a call argument no longer fabricates an indirect_call edge to an unrelated same-named callable (thanks @imagineers-tyler); completes the 0.9.38/0.9.40 arrow-parameter fixes (#2568).

Fix: Cargo.toml is recognized as a package manifest (#2434, thanks @ousamabenyounes), minting a canonical package node plus depends_on edges.

Fix: an explicitly-passed scan root is no longer excluded by an unanchored pattern in a parent-directory .gitignore (#2468, thanks @hopstreax).

Fix: the API extraction prompt now instructs backends to capture the per-node rationale attribute, matching the skill path (#2482, thanks @hopstreax). Invalidates cached semantic chunks, which re-extract on the next run.

Fix: source_file is canonicalized to POSIX separators, so relative inputs on Windows no longer produce non-portable node ids (#2627, thanks @rajarshidattapy).

Fix: a warm cache hit no longer re-anchors a CWD-relative source_file to a ghost path when the working directory differs from the graph root (#2632, thanks @rajarshidattapy).

Fix: the wiki/obsidian audit trail counts each incident edge once instead of double-counting intra-community edges (#2635, thanks @rajarshidattapy).

Fix: C# members inside a #if ... #endif preprocessor block are extracted and attached to their class (#2634, thanks @rohit-jsfreaky).

Fix: query no longer prints the truncation banner when no nodes were actually cut (#2601, thanks @ousamabenyounes); a genuine node truncation still warns.

Fix: a PHP use import written with a leading-backslash / fully-qualified prefix now resolves to its target definition (#2661, thanks @ousamabenyounes).

Fix: an unresolved local JS/TS import (to a file absent from the scan) emits a stable, portable ref target id instead of a per-checkout absolute-path slug (#2457, thanks @rohit-jsfreaky).

Fix: graphify benchmark no longer crashes on a node whose label is None (#2674, thanks @Arthuro0103).

v0.9.40

Correctness and determinism release: fixes a TypeScript false-warning regression, several node-id / path / cache determinism bugs, a Python crash, a Go phantom-reference, and more — with fixes from many community contributors.

Fix: the 0.9.37 partial-parse warning no longer fires on valid TypeScript/TSX (#2610, #2599, thanks @Sid-AutoWisdom and @atlasplatformu-ai). The warning now fires only when recovery plausibly cost symbols, so valid TS with a & in a JSX string attribute or a semicolon-less in_* interface member is silent, while the genuine Kotlin one-line-body and Luau cases still warn.

Fix: file_hash()'s stat fastpath no longer serves a stale digest when a file is rewritten to the same size within one mtime tick (#2612, thanks @rajarshidattapy).

Fix: stored-path absoluteness is detected cross-platform, so a POSIX-absolute source_file from a Linux/CI-built graph no longer leaks into node ids on Windows (#2618, thanks @rajarshidattapy).

... (truncated)

Changelog

Sourced from graphifyy's changelog.

0.9.42 (2026-08-13)

Fix: a JS/TS for...of / for...in loop binding is now shadowed, so passing it as a call argument no longer fabricates an indirect_call edge to an unrelated same-named callable (#2685, thanks @ousamabenyounes); completes the loop/closure/catch shadow family (#2568/#2569/#2517).

Fix: graph provenance (built_at_commit) is stamped from the analysed repository rather than the shell's working directory, so graphify extract run from elsewhere records the target's commit, not the caller's (#2534 family; #2699, thanks @C0KERNEL).

Fix: affected resolves a seed passed as a ./-relative path (or an absolute path when run from the repo root) instead of silently returning nothing (#2707, thanks @phudayyy). Note: an absolute-path seed still requires the working directory to be the analysed repo root.

Fix: a Python relative import of a subpackage (from ..pkg.sub import x) now resolves to the package's __init__ instead of a nonexistent .py slug (#2688, thanks @ousamabenyounes).

Fix: a .sql file that fails to parse because tree-sitter-sql is installed but broken (e.g. an ABI mismatch) now reports the real load failure instead of the misleading "not installed" message (#2602, thanks @ousamabenyounes).

Fix: a corrupt semantic-cache entry is now surfaced with a warning and re-extracted, instead of being a silent cache miss that re-bills the LLM every run; a valid cache is not discarded (#2683, thanks @ousamabenyounes).

Fix: the GRAPH_REPORT.md header uses a portable basename instead of embedding the generator's absolute host path (#2682, thanks @ousamabenyounes).

Fix: graphify update / _read_files hand the model a POSIX source_file, and several path/atomic-write behaviors are hardened for Windows (#2620/#2622, thanks @rajarshidattapy).

Fix: a failed atomic write no longer leaks a read-only .tmp file in the output directory on Windows (#2622, thanks @rajarshidattapy).

Test/docs: Windows-portability test fixes (probe-and-skip symlink tests, separator-agnostic path assertions, shell-arg verdict test), a refreshed ARCHITECTURE.md module table with a doc-parity test, and README notes on CI parity checks and Windows test prerequisites (#2620/#2622/#2126/#2642/#2646/#2647/#2648/#2651, thanks @rajarshidattapy, @redzwanmutalib, @nelsondeleonc-source).

Fix: a non-regular file (FIFO/named pipe, device) in the scanned tree no longer hangs extraction on a blocking read; non-regular files are skipped during collection (#2463, thanks @itskaism).

Fix: an incremental run now re-queues a file rewritten to the same length within one mtime tick, instead of skipping it as unchanged (#2466, thanks @itskaism); complements the 0.9.40 file-hash guard (#2612).

Fix: the apm.yml fallback parser (used when PyYAML is absent) now captures the package version instead of dropping it (#2465, thanks @itskaism).

Fix: graphify install no longer fails when the packaged bundle is read-only (e.g. a Nix store or root-owned site-packages); the staged skill references are made writable before the atomic rename (#2453, thanks @bensleveritt).

Fix: hyperedge regions in graph.html are traced in convex-hull order instead of member-array order, so the shaded polygon no longer self-intersects (#2449, thanks @ysys143).

Fix: graph_has_legacy_ids no longer false-positives on a global MCP node id (e.g. from a nested .mcp.json), which wrongly flagged a modern graph as legacy (#2408, thanks @aryanbonigala).

0.9.41 (2026-08-12)

Fix: a JS/TS catch binding passed as a call argument (catch (handler) { pool.submit(handler) }) no longer fabricates an indirect_call edge to an unrelated same-named callable (thanks @imagineers-tyler); the catch binding is now shadowed within its clause, completing the 0.9.38/0.9.40 arrow-parameter fixes (#2568).

Fix: Cargo.toml is now recognized as a package manifest (#2434, thanks @ousamabenyounes), minting one canonical package node by name plus depends_on edges (dependencies, plus target-specific deps; virtual-workspace roots and workspace-inherited versions are handled).

Fix: an explicitly-passed scan root is no longer excluded by an unanchored pattern in a parent-directory .gitignore that happens to match the root's own name (#2468, thanks @hopstreax); the match path is re-relativized to the scan root (and NFC-normalized) so a genuinely-ignored subdirectory is still skipped.

Fix: the API extraction prompt now instructs backends to capture the per-node rationale attribute (design intent / trade-offs), matching the skill path, so API-backed extraction no longer silently drops it (#2482, thanks @hopstreax). This invalidates cached semantic chunks, which re-extract on the next run.

Fix: source_file is canonicalized to POSIX separators, so a run given relative inputs on Windows no longer produces non-portable node ids with backslashes (#2627, thanks @rajarshidattapy).

Fix: a warm cache hit no longer re-anchors a CWD-relative source_file to a ghost path when the run's working directory differs from the graph root, keeping incremental and cold-build node ids identical (#2632, thanks @rajarshidattapy).

Fix: the wiki/obsidian audit trail counts each incident edge once instead of double-counting intra-community edges, so the confidence breakdown is accurate (#2635, thanks @rajarshidattapy).

Fix: C# members declared inside a #if ... #endif preprocessor block are now extracted and attached to their class instead of being dropped (#2634, thanks @rohit-jsfreaky).

Fix: graphify update refuses to overwrite the graph with a shrunken one when the shrink was caused by an extractor failure this run, instead of silently replacing good data (#2663, thanks @ousamabenyounes); a genuine deletion still shrinks the graph.

Fix: query no longer prints the truncation banner when no nodes were actually cut (only trailing edges overflowed the budget) (#2601, thanks @ousamabenyounes); a genuine node truncation still warns.

Fix: a PHP use import written with a leading-backslash / fully-qualified prefix now resolves to its target definition instead of being dropped (#2661, thanks @ousamabenyounes).

Fix: an unresolved local JS/TS import (to a file absent from the scan) now emits a stable, portable ref target id instead of leaking a per-checkout absolute-path slug (#2457, thanks @rohit-jsfreaky).

Fix: graphify benchmark no longer crashes on a node whose label is None (#2674, thanks @Arthuro0103).

0.9.40 (2026-08-11)

Fix: the 0.9.37 partial-parse warning no longer fires on valid TypeScript/TSX (#2610, #2599, thanks @Sid-AutoWisdom and @atlasplatformu-ai). tree-sitter-typescript sets an error flag on tiny fully-recovered constructs (a & in a JSX string attribute, a semicolon-less in_* interface member) that still extract completely; the warning now fires only when recovery plausibly cost symbols (the file yielded at most the file node, or an error region spans multiple lines), so the genuine Kotlin one-line-body and Luau cases still warn.

Fix: file_hash()'s stat fastpath no longer serves a stale digest when a file is rewritten to the same size within one mtime tick (#2612, thanks @rajarshidattapy); a racily-clean guard falls back to a content hash for recently-modified files.

Fix: stored-path absoluteness is now detected cross-platform, so a POSIX-absolute source_file from a Linux/CI-built graph no longer leaks into node ids on Windows (#2618, thanks @rajarshidattapy).

Fix: normalize_id() is now idempotent for Turkish İ and similar codepoints by casefolding before the non-word filter; no ASCII identifier ids change (#2614, thanks @rajarshidattapy).

Fix: graph.json collection order is now deterministic across runs (#2582, thanks @hjotha).

Fix: explain/_find_node resolve node ids containing punctuation or non-ASCII characters (#2467, thanks @sean-soomgo).

Fix: .graphifyignore patterns match paths regardless of Unicode NFC/NFD normalization, so an accented ignore rule works on macOS (#2544, thanks @bruno-growthsales).

Fix: Obsidian vault metadata directories (.obsidian, .smart-env) are skipped during detection (#2493, thanks @rohit-jsfreaky).

Fix: a single unparenthesised arrow parameter (x => f(x)) is now shadowed, so it no longer fabricates an indirect_call edge to an unrelated same-named callable (thanks @imagineers-tyler); follows the 0.9.38 sibling-closure fix (#2568).

Fix: Python extraction no longer crashes resolving an over-deep relative import (from ....x import y above the package root) (#2605, thanks @SinghAman21).

Fix: a Go qualified type (pkg.Type) resolves by import path instead of losing the qualifier and binding by bare name to an unrelated same-named symbol (#2608, thanks @gnukeno).

Fix: graph.html's document title no longer embeds the generator's absolute host path (#2598, thanks @michaelxer); it keeps the path from the output-dir marker onward.

Commits

7fe58b0 docs(changelog): add #2463/#2466/#2465/#2453/#2449/#2408 to the 0.9.42 section
40316d1 docs(detect): cross-link _MTIME_COARSE_S to cache.py's granularity constant (...
a2a9137 fix(detect): re-queue a same-tick same-length rewrite in incremental runs (#2...
c1f3995 fix(detect): skip non-regular files so a FIFO can't hang extraction (#2463)
48fbe30 fix(build): exclude global MCP ids from legacy-id detection (#2408)
a4e8446 fix(html): trace hyperedge perimeter in convex-hull order (#2449)
613c45c fix(install): make the staged skill bundle writable so a read-only package in...
5e4ab1d fix(manifest): capture package version in the apm.yml fallback parser (#2465)
ded1feb chore: bump to 0.9.42
b3ca490 fix(report): use a portable basename in the GRAPH_REPORT header (#2682)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the python-minor-and-patch group with 1 update: [graphifyy](https://github.com/Graphify-Labs/graphify). Updates `graphifyy` from 0.9.39 to 0.9.42 - [Release notes](https://github.com/Graphify-Labs/graphify/releases) - [Changelog](https://github.com/Graphify-Labs/graphify/blob/v8/CHANGELOG.md) - [Commits](Graphify-Labs/graphify@v0.9.39...v0.9.42) --- updated-dependencies: - dependency-name: graphifyy dependency-version: 0.9.42 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-08-17T11:20:09Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Aug 17, 2026

bifrost0x mentioned this pull request Aug 17, 2026

Refresh Graphify and Highlight.js dependencies #114

Merged

bifrost0x closed this Aug 17, 2026

dependabot Bot deleted the dependabot/pip/python-minor-and-patch-c142dda2de branch August 17, 2026 11:20

Navigation Menu

Uh oh!

deps(python): bump graphifyy from 0.9.39 to 0.9.42 in the python-minor-and-patch group - #112

deps(python): bump graphifyy from 0.9.39 to 0.9.42 in the python-minor-and-patch group#112
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-minor-and-patch-c142dda2de

dependabot Bot commented on behalf of github Aug 17, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Aug 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.9.42

v0.9.41

v0.9.40

0.9.42 (2026-08-13)

0.9.41 (2026-08-12)

0.9.40 (2026-08-11)

Uh oh!

dependabot Bot commented on behalf of github Aug 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Aug 17, 2026 •

edited

Loading