v0.9.15
Graphify-Labs/graphifyv0.9.15Jul 13, 2026by safishamsi
AI Summary
A security-focused patch addressing stored XSS vulnerabilities in exported reports and fixing neighbor link functionality, alongside improvements to `.gitignore` handling and label preservation.
Key Highlights
- Fixed stored XSS vulnerability in `graph.html` neighbor links by escaping node IDs into `data-nid` attributes.
- Detection now honors nested `.gitignore` files matching git's behavior.
- `graphify update` preserves human-readable `community_name` labels instead of stripping them to numeric IDs.
New Features
- Security patch for stored XSS in exported reports.
- Support for nested `.gitignore` files.
- Preservation of community labels in incremental rebuilds.
Full Release Notes
A small, security-focused patch on top of 0.9.14. ## Highlights - **Security (stored XSS): the exported `graph.html` is fixed (#1838).** The report's neighbor links dropped an unescaped stringified node id into an inline `onclick` — which broke every neighbor link *and*, when a node id/label contained a double-quote (e.g. from a document or a title scraped via `graphify add <url>`), let a hostile source inject a live event handler into a report opened locally. The id is now carried in an HTML-escaped `data-nid` attribute dispatched through a single delegated listener. If you generate reports from untrusted corpora, upgrade. ## All fixes - Security: close a stored XSS and repair the (previously always-broken) neighbor "focus" links in the exported `graph.html` (#1838, thanks @edgestack-ai). - Fix: detection honors nested `.gitignore`/`.graphifyignore` files below the scan root, matching git — a `vendor/sub/.gitignore` deeper in the tree is now applied to its own subtree instead of being ignored (#1847, thanks @Mohak-Agrawal). Composes with `.git/info/exclude` (0.9.14): a nearer `!` re-include still wins. - Fix: `graphify update` now keeps human-readable `community_name` labels instead of stripping them back to numeric ids on every incremental rebuild (#1808 / #1855, thanks @latreon). ## Install ``` pip install --upgrade graphifyy # or uv tool install graphifyy@0.9.15 ``` Then `graphify install` to update the skill for your agent.