v0.9.65
Graphify-Labs/graphifyv0.9.65Sep 20, 2026by safishamsi
Upgrading?
AI Summary
This release addresses a security vulnerability by pinning Pillow to version 12.3.0 and improves call graph resolution for Go interfaces and Swift protocols. It also includes fixes for JavaScript/TypeScript scoping, incremental rebuild stability, and visualization crashes in large graphs.
Key Highlights
- Security: Floors Pillow at >=12.3.0 to patch CVE-2026-54058.
- Go & Swift: Method requirements now correctly attach to interface and protocol nodes.
- JS/TS: Fixed `let`/`const` scoping to prevent incorrect `indirect_call` suppression.
- Visualization: Fixed stack overflow crash in `graph.html` caused by overlap-avoidance.
- Docs: Updated repository links and added GitHub issue/PR templates.
New Features
- Go interface method requirements now attach to the interface node.
- Swift protocol method requirements now attach to the protocol node.
Full Release Notes
- Security: the `svg`/`all` extras now floor Pillow at `>=12.3.0` for CVE-2026-54058 (Pillow was pulled in transitively via matplotlib). Note: Pillow 12.3.0 dropped its glibc<2.27 cp310 Linux wheel, so a very old-glibc Python 3.10 host with the `svg`/`all` extra builds Pillow from sdist (#3698, thanks @viral-antuit).
- Feature: a Go interface's method requirements (`type Foo interface { Bar() }`) now attach to the interface node, so calls resolve to them (#3672, thanks @rajatnagda45).
- Feature: a Swift protocol's method requirements (`protocol P { func f() }`) now attach to the protocol node (#3673, thanks @rajatnagda45).
- Fix: Java enum body members (methods/constructor/fields after the constants) now attach to the enum, not the file, and intra-enum calls resolve (#3674, thanks @rajatnagda45).
- Fix: a Verilog module instantiation now links to the module's local definition instead of a phantom duplicate; a genuinely external module stays a sourceless stub (#3675, thanks @rajatnagda45).
- Fix: JS/TS `let`/`const` bindings are now scoped to their own block rather than the whole function, so a block-local binding no longer suppresses a genuine `indirect_call` edge elsewhere in the function; `var` stays function-scoped (#3688, thanks @ayushcodes10).
- Fix: the incremental rebuild no longer purges AST nodes it just reported as fail-closed "kept" — the eviction pass re-checks the kept set, so a moved-file/symlink layout can't deadlock the shrink guard into refusing every update (#3697, #3695, thanks @hopstreax).
- Fix: `graph.html` no longer crashes vis-network with a stack overflow on large graphs — nodes are seeded on a spiral before physics runs so overlap-avoidance can't blow the layout recursion (#3699, thanks @sanjaiyan-dev).
- Fix: node and edge tooltips now show special characters literally (C++ templates like `vector<int>`, generics, `&`, quotes) instead of raw HTML entities, while the HTML sinks that need escaping keep it (#3686, #3664, thanks @hopstreax).
- Docs: repository links now point at `Graphify-Labs/graphify` instead of the old account (including in generated wiki output), translated READMEs use the current logo, GitHub issue/PR templates were added, and the Enterprise link was corrected (#3692, #3694, #3693, thanks @Abdul535).
Related Repositories
public-apis/public-apis★ 491,123
A collective list of free APIs
NousResearch/hermes-agent★ 255,883
The agent that grows with you
yt-dlp/yt-dlp★ 199,986
A feature-rich command-line audio/video downloader
microsoft/markitdown★ 191,478
Python tool for converting files and office documents to Markdown.
Significant-Gravitas/AutoGPT★ 187,698
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.