Starstruk Logo MarkStarstruk

v0.8.48

Graphify-Labs/graphifyv0.8.48Jun 25, 2026by safishamsi

AI Summary

This release focuses on stability and performance improvements for the Graphify CLI and MCP tools, including a security patch for Starlette, fixes for reflection and community labeling, and a refactor of the extraction module.

Key Highlights

  • MCP tool `get_community` now displays the correct community name header.
  • Work-memory now runs `graphify reflect` automatically without requiring the git hook.
  • Security update floors Starlette to >=1.3.1 to address CVEs.
  • Refactored monolithic `extract.py` into per-language modules.
  • Parallel community labeling supports concurrency and batch sizing.

New Features

  • Parallel community labeling with `--max-concurrency` and `--batch-size` options.

Full Release Notes

## graphify 0.8.48

### Fixes
- **`get_community` MCP tool shows the community name** in its header (`Community 12 — Auth & Sessions (8 nodes)`), matching `get_node` and the query output. Read from the community's member nodes, sanitised, and skipped when it is only the `Community N` placeholder so it never doubles (#1448, thanks @rmart1308).
- **`graphify reflect` no longer duplicates** "known dead ends" / "corrections" lines when the same Q&A is saved more than once. They collapse by question, keeping the most recent (a re-corrected question shows its latest correction). Deterministic, ordered by date then question.
- **Work-memory works without the git hook.** The skill now runs `graphify reflect --if-stale` at the start of graph work, so a skill-only install still refreshes `LESSONS.md`. `--if-stale` no-ops when the file is already newer than every input, so the post-commit hook becomes an optimization rather than a requirement.

### Security
- **Floor `starlette` at `>=1.3.1`** for CVE-2026-48818 and CVE-2026-54283 (both resolved by 1.3.1). starlette underpins the HTTP MCP transport (`graphify-mcp` over HTTP); stdio and the CLI are unaffected. It was an undeclared transitive dependency that `serve.py` imports directly, so it is now declared in the `mcp`/`all` extras and floored, protecting end users installing `graphifyy[mcp]`, not just the locked dev environment (#1391, #1396, thanks @orbisai0security).

### Refactor
- **Begin splitting the monolithic `extract.py`** into per-language modules under `graphify/extractors/` (blade, elixir, razor, zig + a shared `base.py`), with a strict one-way import direction and `extract.py` re-exporting the moved names so all callers and the dispatch table are unchanged. Behavior-neutral, verified byte-identical. Groundwork for moving the rest (#1212, thanks @TheFedaikin).

### Performance
- **Parallel community labeling.** `graphify cluster-only` and `graphify label` accept `--max-concurrency N` (default 4) and `--batch-size N` (default 100), fanning labeling batches across a thread pool. `ollama`/`claude-cli` stay serial unless opted in. Output is unchanged and deterministic (#1390).

**Install:** `uv tool install graphifyy==0.8.48`