v0.9.93 v0.9.94
Graphify-Labs/graphifyOct 20, 2026 → Oct 22, 20262 days between releases
What's New
v0.9.94 adds URL-ingestion security hardening plus SQL, MCP, and cross-language resolution fixes, with another AST cache schema bump.
Breaking Changes
- AST cache schema is bumped again, so the first build after upgrading forces a full re-extraction.
- URL fetching now rejects hosts with no hostname, malformed or zero ports, and embedded user:pass@ credentials, so previously accepted ingestion sources may fail.
- MCP get_node/get_neighbors and explain now refuse substring near-misses and return suggestions instead of an unrelated node, changing response behavior for loose lookups.
New Features
- Fetched URLs are validated for hostname, port, and embedded credentials before the request and on every redirect.
- SQL stored procedures now emit reads_from/writes_to edges for the tables they reference.
- MCP node lookup and explain return candidate suggestions when a query is a substring near-miss.
- Objective-C category node IDs are repo-relative, making graphs portable across machines.
- Cross-repo call edges now record the actual call site as source_file and source_location.
Improvements
- Text capture no longer follows dangling symlinks out of the corpus, closing a path-escape hole.
- Maven POM extraction contributes only the project's own dependencies.
- JS/TS member calls on untyped receivers are deferred instead of guessing a same-named method in the same file.
- Incremental builds stop re-queuing files an extractor declined by design, and --help now lists all --platform values behind a drift guard.
- Serve handles IPv6 bracketed Host headers, and Codex hook commands quote install paths containing spaces.
Bug Fixes
- T-SQL bracketed names are unbracketed and GO batch separators correctly terminate statements.
- Cross-file SQL table stubs now fold onto their real definitions.
- CommonJS require bindings no longer shadow the class exported by the required file.
- Markdown bare methods link only when their class is cited, and Objective-C calls resolve across split header/impl files.
- Cross-repo edges now point at the call site rather than an incorrect location.
Upgrade Notes
Expect a one-time full re-extraction on the first build after upgrading because the AST cache schema changed again. Audit any ingestion configuration that relies on URLs with embedded credentials, unusual or zero ports, or hostless forms, since those are now rejected outright. If you have MCP clients that depend on fuzzy substring node lookups, update them to handle suggestion responses instead of a resolved node.
The Two Releases
graphify 0.9.93
Oct 20, 2026· 8 days ago
This release focuses on refining extraction logic across multiple programming languages (Kotlin, C#, Swift, Rust, Dart, Python, and C++) and improving the robustness of the tooling, including GraphML export and credential redaction. It also introduces a recovery mechanism for partially read files and fixes configuration parsing issues.
Full release notesgraphify 0.9.94
Oct 22, 2026· 6 days ago
Graphify 0.9.94 incorporates nineteen community pull requests, with a security-focused ingestion pass and a broad set of extraction/resolution correctness fixes. URL fetching now rejects malformed hosts, invalid ports, and embedded credentials before requests and on redirects, while text capture avoids dangling-symlink escapes. The release also improves Maven, JS/TS, CommonJS, Objective-C, SQL, Markdown, MCP, cross-repo, CLI, and serve behavior; the AST cache schema is bumped so the first build after upgrade re-extracts.
Full release notes