lee/graphify
1
0
Fork 0
mirror of https://github.com/safishamsi/graphify.git synced 2026-08-28 17:26:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

security: floor starlette >=1.3.1 (CVE-2026-48818, CVE-2026-54283)

Browse Source 
starlette underpins the HTTP MCP transport (serve_http); graphify/serve.py
imports it directly (Starlette/Middleware/Route) but it was only present
transitively via mcp, with no version floor — so end users installing
graphifyy[mcp] could resolve a vulnerable starlette even after a lockfile bump.
Declare it in the mcp (and all) extras and floor at >=1.3.1, which carries the
fixes for both CVEs (1.3.1 >= the 1.1.0 fix for CVE-2026-48818 and is the fix
for CVE-2026-54283). Lock regenerated 1.0.0 -> 1.3.1.

Supersedes the lock-only bumps in #1391 and #1396 (both targeted 1.3.1 from a
stale base) with a pyproject floor that also protects end users. stdio MCP and
CLI are unaffected. serve/MCP/HTTP tests pass on 1.3.1; full suite 2393 passed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
safishamsi
2026-06-24 20:59:20 +01:00
co-authored by Claude Opus 4.8
parent a95a8339ca
commit ec6b397ee8
3 changed files with 14 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+1
View File
@@ -4,6 +4,7 @@ Full release notes with details on each version: [GitHub Releases](https://githu
## Unreleased
- Security: floor `starlette` at `>=1.3.1` to pick up the fixes for CVE-2026-48818 and CVE-2026-54283 (both resolved by 1.3.1). starlette underpins the HTTP MCP transport (`graphify-mcp` over HTTP / `serve_http`); the stdio transport and CLI are unaffected. It was an undeclared transitive dependency (via `mcp`) that `graphify/serve.py` imports directly, so it is now declared in the `mcp` (and `all`) extras and floored, which protects end users installing `graphifyy[mcp]`, not just the locked dev/CI environment. Lockfile bumped 1.0.0 -> 1.3.1; serve/MCP/HTTP tests pass on the new version (#1391, #1396, thanks @orbisai0security).
- Refactor: begin splitting the monolithic `extract.py` into per-language modules under `graphify/extractors/` (#1212). The `blade`, `elixir`, `razor`, and `zig` extractors plus the shared primitives (`_make_id`, `_file_stem`, `_read_text`, `_LANGUAGE_BUILTIN_GLOBALS`) move into their own files, with `graphify/extractors/base.py` holding the shared pieces and a strict one-way import direction (`extract.py` -> `extractors/`, never the reverse). `extract.py` re-exports the moved names, so every `from graphify.extract import ...` caller and the dispatch table are unchanged. Behavior-neutral lift-and-shift (verified byte-identical), groundwork for moving the remaining languages out. See `graphify/extractors/MIGRATION.md`.
- Feat: community labeling can now run in parallel (#1390). `graphify cluster-only` and `graphify label` accept `--max-concurrency N` (default 4) to fan labeling batches out across a thread pool, and `--batch-size N` (default 100) to tune communities per LLM call. A large graph that previously needed hundreds of sequential calls now runs them in rounds. Mirrors the existing `extract` parallelism, including the safety guards: `ollama` and `claude-cli` are forced serial (set `GRAPHIFY_OLLAMA_PARALLEL=1` / `GRAPHIFY_CLAUDE_CLI_PARALLEL=1` to override). Output is unchanged and deterministic regardless of concurrency, since results are keyed by community id and merged on the main thread.
- Fix: `graphify reflect` no longer duplicates lines in the "known dead ends" and "corrections" sections when the same Q&A is saved more than once. Those lists were appended per memory doc with no key (node scoring already dedups by node, but these two did not); they now collapse by question, keeping the most recent entry — so a re-corrected question shows its latest correction. Output stays deterministic (ordered by date then question).
pyproject.toml
+5 -2
View File
@@ -48,7 +48,10 @@ Repository = "https://github.com/safishamsi/graphify"
Issues = "https://github.com/safishamsi/graphify/issues"
[project.optional-dependencies]
mcp = ["mcp"]
# starlette is pulled in transitively by mcp, but graphify/serve.py imports it
# directly for the HTTP transport, so declare it here and floor it above the
# CVE-2026-48818 / CVE-2026-54283 fixes (both resolved by 1.3.1) (#1391, #1396).
mcp = ["mcp", "starlette>=1.3.1"]
neo4j = ["neo4j"]
falkordb = ["falkordb"]
pdf = ["pypdf>=6.12.0", "markdownify"]
@@ -72,7 +75,7 @@ sql = ["tree-sitter-sql"]
# avoids breaking the default `uv tool install graphifyy` for everyone (#1104).
dm = ["tree-sitter-dm"]
terraform = ["tree-sitter-hcl"]
all = ["mcp", "neo4j", "falkordb", "pypdf>=6.12.0", "markdownify", "watchdog", "graspologic; python_version < '3.13'", "python-docx", "openpyxl", "faster-whisper; python_version >= '3.11'", "yt-dlp>=2026.6.9", "matplotlib", "numpy>=2.0; python_version >= '3.13'", "openai", "tiktoken", "boto3", "anthropic", "tree-sitter-sql", "jieba", "tree-sitter-dm", "tree-sitter-hcl"]
all = ["mcp", "starlette>=1.3.1", "neo4j", "falkordb", "pypdf>=6.12.0", "markdownify", "watchdog", "graspologic; python_version < '3.13'", "python-docx", "openpyxl", "faster-whisper; python_version >= '3.11'", "yt-dlp>=2026.6.9", "matplotlib", "numpy>=2.0; python_version >= '3.13'", "openai", "tiktoken", "boto3", "anthropic", "tree-sitter-sql", "jieba", "tree-sitter-dm", "tree-sitter-hcl"]
[project.scripts]
graphify = "graphify.__main__:main"
uv.lock
Generated
+8 -4
View File
@@ -1150,7 +1150,7 @@ wheels = [
[[package]]
name = "graphifyy"
version = "0.8.45"
version = "0.8.47"
source = { editable = "." }
dependencies = [
{ name = "networkx", version = "3.4.2", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" },
@@ -1203,6 +1203,7 @@ all = [
{ name = "openpyxl" },
{ name = "pypdf" },
{ name = "python-docx" },
{ name = "starlette" },
{ name = "tiktoken" },
{ name = "tree-sitter-dm" },
{ name = "tree-sitter-hcl" },
@@ -1241,6 +1242,7 @@ leiden = [
]
mcp = [
{ name = "mcp" },
{ name = "starlette" },
]
neo4j = [
{ name = "neo4j" },
@@ -1341,6 +1343,8 @@ requires-dist = [
{ name = "python-docx", marker = "extra == 'all'" },
{ name = "python-docx", marker = "extra == 'office'" },
{ name = "rapidfuzz", specifier = ">=3.0" },
{ name = "starlette", marker = "extra == 'all'", specifier = ">=1.3.1" },
{ name = "starlette", marker = "extra == 'mcp'", specifier = ">=1.3.1" },
{ name = "tiktoken", marker = "extra == 'all'" },
{ name = "tiktoken", marker = "extra == 'gemini'" },
{ name = "tiktoken", marker = "extra == 'kimi'" },
@@ -4426,15 +4430,15 @@ wheels = [
[[package]]
name = "starlette"
version = "1.0.0"
version = "1.3.1"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "anyio" },
{ name = "typing-extensions", marker = "python_full_version < '3.13'" },
]
sdist = { url = "https://files.pythonhosted.org/packages/81/69/17425771797c36cded50b7fe44e850315d039f28b15901ab44839e70b593/starlette-1.0.0.tar.gz", hash = "sha256:6a4beaf1f81bb472fd19ea9b918b50dc3a77a6f2e190a12954b25e6ed5eea149", size = 2655289, upload-time = "2026-03-22T18:29:46.779Z" }
sdist = { url = "https://files.pythonhosted.org/packages/eb/e3/7c1dc7381d9f8ab7d854328ebfa884e62cb3f3d8549ddfd37c7814f42afa/starlette-1.3.1.tar.gz", hash = "sha256:05d0213193f2fbaae60e2ecb593b4add4262ad4e46536b54abe36f11a71724e0", size = 2703240, upload-time = "2026-06-12T09:23:11.602Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/0b/c9/584bc9651441b4ba60cc4d557d8a547b5aff901af35bda3a4ee30c819b82/starlette-1.0.0-py3-none-any.whl", hash = "sha256:d3ec55e0bb321692d275455ddfd3df75fff145d009685eb40dc91fc66b03d38b", size = 72651, upload-time = "2026-03-22T18:29:45.111Z" },
{ url = "https://files.pythonhosted.org/packages/ec/bb/2799cc2ede3ed41131f8975621e7213dfc7ef4acbbaadfa440f32500c370/starlette-1.3.1-py3-none-any.whl", hash = "sha256:c7372aae11c3c3f26a42df7bd626cec2f47d03483d261d369516a615a53714c6", size = 73632, upload-time = "2026-06-12T09:23:10.017Z" },
]
[[package]]