SafiandClaude Sonnet 4.6 ad3f3b2d9e harden XML parsing against billion-laughs DoS in extract_csproj and extract_lpk ...

stdlib ET does not cap entity expansion — a crafted .csproj or .lpk with nested
internal entities can exhaust memory. Pre-screen input bytes for <!DOCTYPE and
<!ENTITY before parsing (legitimate MSBuild/Lazarus files never contain these).
Also adds the missing 2 MiB size cap to extract_lpk (csproj already had one).
No new dependencies required.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-26 20:32:14 +01:00

..

__init__.py

Add --wiki export: agent-crawlable knowledge wiki from graph

2026-04-06 16:06:31 +01:00

__main__.py

fix(cli): apply remap_communities_to_previous in cluster-only path (#1028)

2026-05-26 20:12:02 +01:00

affected.py

feat: add v8 affected and import-resolution support

2026-05-22 13:24:54 +01:00

analyze.py

perf(analyze): reuse degrees for surprise scoring (#914)

2026-05-18 12:05:21 +01:00

benchmark.py

feat(multigraph): add runtime compatibility probe (#956)

2026-05-22 13:22:51 +01:00

build.py

improve #1007 fix: use _norm_source_file with resolve() for symlink safety

2026-05-26 14:59:13 +01:00

cache.py

fix node ID collisions, cache fastpath, absolute source_file paths, and failed-chunk manifest freeze

2026-05-18 20:31:59 +01:00

callflow_html.py

feat(multigraph): add runtime compatibility probe (#956)

2026-05-22 13:22:51 +01:00

cluster.py

fix hooks phantom dir on git < 2.31, save_manifest incremental data loss, cohesion rounding, C++ inheritance; add --resolution and --exclude-hubs

2026-05-17 23:05:48 +01:00

dedup.py

fix: CJK/Unicode labels silently skipped in _norm/_norm_label dedup (follow-up to #811) (#937)

2026-05-22 14:26:27 +01:00

detect.py

add .NET project file support (.sln, .csproj, .fsproj, .vbproj, .razor, .cshtml)

2026-05-26 12:27:28 +01:00

diagnostics.py

feat(multigraph): add runtime compatibility probe (#956)

2026-05-22 13:22:51 +01:00

export.py

Rate-limit backup_if_protected to one folder per day via content hash

2026-05-25 09:14:20 +01:00

extract.py

harden XML parsing against billion-laughs DoS in extract_csproj and extract_lpk

2026-05-26 20:32:14 +01:00

global_graph.py

feat(multigraph): add runtime compatibility probe (#956)

2026-05-22 13:22:51 +01:00

google_workspace.py

Harden Google Workspace gws exports (#772)

2026-05-07 20:07:57 +01:00

hooks.py

fix Husky 9 hook path, skill.md INPUT_PATH literal, per-worker exception isolation

2026-05-23 23:17:40 +01:00

ingest.py

security hardening: F-002/F-005/F-007/F-008/F-009/F-010/F-016/F-031/F-035/F-038/PR747-NEW-2

2026-05-07 16:32:26 +01:00

llm.py

fix(llm): honor GRAPHIFY_MAX_OUTPUT_TOKENS for OpenAI-compatible backends (#973)

2026-05-22 13:22:27 +01:00

manifest.py

perf+fix: parallel extraction, faster imports, bug fixes

2026-04-04 18:56:38 +01:00

mcp_ingest.py

feat: MCP config extractor (.mcp.json, claude_desktop_config.json, mcp.json)

2026-05-26 20:16:41 +01:00

multigraph_compat.py

feat(multigraph): add runtime compatibility probe (#956)

2026-05-22 13:22:51 +01:00

prs.py

feat(multigraph): add runtime compatibility probe (#956)

2026-05-22 13:22:51 +01:00

report.py

fix hooks phantom dir on git < 2.31, save_manifest incremental data loss, cohesion rounding, C++ inheritance; add --resolution and --exclude-hubs

2026-05-17 23:05:48 +01:00

scip_ingest.py

feat(multigraph): add runtime compatibility probe (#956)

2026-05-22 13:22:51 +01:00

security.py

feat(multigraph): add runtime compatibility probe (#956)

2026-05-22 13:22:51 +01:00

semantic_cleanup.py

feat(multigraph): add runtime compatibility probe (#956)

2026-05-22 13:22:51 +01:00

serve.py

Clarify Chinese query segmentation scope (#1026)

2026-05-26 12:24:04 +01:00

skill-aider.md

v0.8.4: SQL FK/trigger extraction, deletion pruning fixes, community label normalization

2026-05-15 15:31:22 +01:00

skill-claw.md

v0.8.4: SQL FK/trigger extraction, deletion pruning fixes, community label normalization

2026-05-15 15:31:22 +01:00

skill-codex.md

feat(multigraph): add runtime compatibility probe (#956)

2026-05-22 13:22:51 +01:00

skill-copilot.md

v0.8.4: SQL FK/trigger extraction, deletion pruning fixes, community label normalization

2026-05-15 15:31:22 +01:00

skill-devin.md

feat: add Devin CLI support (graphify devin install/uninstall) (#1020)

2026-05-26 09:17:18 +01:00

skill-droid.md

v0.8.4: SQL FK/trigger extraction, deletion pruning fixes, community label normalization

2026-05-15 15:31:22 +01:00

skill-kiro.md

v0.8.4: SQL FK/trigger extraction, deletion pruning fixes, community label normalization

2026-05-15 15:31:22 +01:00

skill-opencode.md

feat(multigraph): add runtime compatibility probe (#956)

2026-05-22 13:22:51 +01:00

skill-pi.md

v0.8.4: SQL FK/trigger extraction, deletion pruning fixes, community label normalization

2026-05-15 15:31:22 +01:00

skill-trae.md

v0.8.4: SQL FK/trigger extraction, deletion pruning fixes, community label normalization

2026-05-15 15:31:22 +01:00

skill-vscode.md

fix MultiGraph crash, hollow LLM response retry, and skill --help (#796, #795, #792)

2026-05-09 21:17:25 +01:00

skill-windows.md

feat: add v8 affected and import-resolution support

2026-05-22 13:24:54 +01:00

skill.md

Fix Ukrainian README typo, Unicode vocab regex, add migration note for Java extends->inherits

2026-05-24 20:40:49 +01:00

symbol_resolution.py

feat(multigraph): add runtime compatibility probe (#956)

2026-05-22 13:22:51 +01:00

transcribe.py

security: add usedforsecurity=False to MD5/SHA1 hashes used for file diffing and filename generation

2026-05-02 14:32:16 +01:00

tree_html.py

feat(multigraph): add runtime compatibility probe (#956)

2026-05-22 13:22:51 +01:00

validate.py

Add Kimi K2.6 backend, fix phantom god nodes (#598), fix concept file_type (#601)

2026-04-29 08:51:53 +01:00

watch.py

fix graphify update ghost nodes: as_posix() and relativize existing graph before eviction

2026-05-26 20:05:31 +01:00

wiki.py

Fix wiki TypeError on null source_file and skip nested worktrees/ dirs (#1016, #1023)

2026-05-26 09:06:43 +01:00