From 4000de15466588ec3ee32f9e10a587ca97d3b8a5 Mon Sep 17 00:00:00 2001 From: safishamsi Date: Fri, 25 Sep 2026 16:33:01 +0100 Subject: [PATCH] release: consolidate unreleased 0.9.69 into 0.9.68 0.9.68 was bumped locally but never published to PyPI (latest published is 0.9.67), so fold the second triage round's five PRs into a single contiguous 0.9.68 release rather than skipping the number. No PyPI gap. Co-Authored-By: Claude Opus 4.8 (1M context) --- CHANGELOG.md | 5 +---- pyproject.toml | 2 +- uv.lock | 2 +- 3 files changed, 3 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index cd6cb21a0..79064b5d2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,16 +2,13 @@ Full release notes with details on each version: [GitHub Releases](https://github.com/Graphify-Labs/graphify/releases) -## 0.9.69 (2026-09-25) +## 0.9.68 (2026-09-25) - Security: the `/graphify add ... --watch` reference no longer passes the raw, agent-substituted `INPUT_PATH` placeholder unquoted into a shell command (`… -m graphify.watch INPUT_PATH`), where a scan root containing `$(…)`, backticks, or `;` could execute — a follow-on to the Step 1 fix. The watcher now reads the trusted `graphify-out/.graphify_root` that Step 1 resolves, so there is no path to substitute (#3742, #3642, thanks @ayushcodes10). The identical placeholder still appears in the Aider/Devin monolith `--watch` snippet and is tracked separately. - Fix: incremental updates (`update`/`extract --code-only`/`watch`) now preserve a cross-file `imports`/`calls`/`uses` edge whose target symbol lives in an unchanged file — the symbol-resolution facts pass widens its target index with the read-only resolution context, so re-extracting one file no longer silently drops its edges into the rest of the graph; a genuinely removed edge is still pruned (#3812, #3776, thanks @hopstreax). - Fix: C# type references (`inherits`/`implements`/parameter/return/base types) no longer resolve to a same-named non-type node — an enum member, property, field, or method sharing a type's name is excluded from the type-definition index, so a class inherits from the real base rather than a stray member; resolution of partial classes without a `contains` edge is restored (#3815, #3795, thanks @hopstreax). - Fix: dedup now keeps the node with a real source location over a richer but source-less one when merging duplicates, so a merged entity points at real code instead of an inferred/external stub; the loser's attributes are still folded onto the survivor (#3786, #3775, thanks @ayushcodes10). - Fix: Maven `pom.xml` ingestion resolves a dependency's inherited `groupId`/`version` from the local `` block and substitutes `${property}` / `${project.*}` placeholders (offline, one level), so previously-dangling `depends_on` edges now connect (#3823, #3806, thanks @chiliec). - -## 0.9.68 (2026-09-25) - - Fix: the PYTHONHASHSEED re-exec (0.9.67) now waits for and propagates the child's exit code on Windows instead of returning early — `os.execvpe` is a true process replacement only on POSIX; on Windows it spawned a new process and let the parent race ahead unpinned, crashing `update`/`extract`/`cluster-only`/`label`. The Windows path now spawns via `subprocess.run` and exits with the child's status; the POSIX path is unchanged (#3816, #3799, thanks @sinangumuskabak-sys). - Fix: Terraform secret redaction now also covers a secret-named `variable` default and `output` value — the secret's name lives in the block label, so the literal sat under the generic `default`/`value` key that the key-name check never flagged (`variable "db_password" { default = "…" }` reached `graph.json` verbatim). Redacted when the label names a secret or the block sets `sensitive = true` (#3817, #3644/#3762 follow-up, thanks @breken-ai). - Fix: fixed-format COBOL that carries a sequence NUMBER in columns 1-6 (not blanks) is now detected as fixed-format — previously it was misread as free-format, the sequence digits stayed in the code, and every paragraph and `PERFORM` edge was silently dropped, leaving only the file and program nodes (#3813, thanks @abhay-codes07). diff --git a/pyproject.toml b/pyproject.toml index d6c7cdabf..fa5aad775 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta" [project] name = "graphifyy" -version = "0.9.69" +version = "0.9.68" description = "AI coding assistant skill (Claude Code, CodeBuddy, Codex, OpenCode, Kilo Code, Cursor, Gemini CLI, Aider, OpenClaw, Factory Droid, Trae, Hermes, Kiro, Pi, Devin CLI, Google Antigravity) - turn any folder of code, docs, papers, images, or videos into a queryable knowledge graph" readme = "README.md" license = "Apache-2.0" diff --git a/uv.lock b/uv.lock index baff3c51e..386c20433 100644 --- a/uv.lock +++ b/uv.lock @@ -1096,7 +1096,7 @@ wheels = [ [[package]] name = "graphifyy" -version = "0.9.69" +version = "0.9.68" source = { editable = "." } dependencies = [ { name = "networkx", version = "3.4.2", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" },