Starstruk Logo MarkStarstruk

v0.8.49

OpenBMB/UltraRAGv0.8.49Jun 25, 2026by safishamsi

AI Summary

This release focuses on security patches, performance enhancements, and architectural refactoring. It addresses CVE vulnerabilities in Starlette, introduces parallel processing for community labeling, and modularizes the extraction logic.

Key Highlights

  • Security updates for Starlette (CVE-2026-48818 and CVE-2026-54283) for HTTP MCP transport.
  • Parallel community labeling with `--max-concurrency` and `--batch-size` flags.
  • Refactored extraction module into per-language submodules under `graphify/extractors/`.
  • Improved work-memory deduplication and removal of git hook requirement.

New Features

  • Parallel community labeling
  • Per-language extraction modules
  • Starlette security updates

Full Release Notes

## graphify 0.8.49

### Fixes
- `get_community` MCP tool now shows the community name in its header (`Community 12 — Auth & Sessions (8 nodes)`), matching `get_node` / query output; skipped when it is only the `Community N` placeholder so it never doubles (#1448, thanks @rmart1308).
- `graphify reflect` no longer duplicates "known dead ends" / "corrections" lines when the same Q&A is saved more than once (dedup by question, most recent wins).
- Work-memory works without the git hook: the skill runs `graphify reflect --if-stale` at the start of graph work, so a skill-only install still refreshes `LESSONS.md`. `--if-stale` no-ops when the file is already newer than every input, so the post-commit hook is an optimization rather than a requirement.

### Security
- Floor `starlette` at `>=1.3.1` for CVE-2026-48818 and CVE-2026-54283 (both resolved by 1.3.1). starlette underpins the HTTP MCP transport (`graphify-mcp` over HTTP); stdio and the CLI are unaffected. Now declared in the `mcp`/`all` extras and floored so end users installing `graphifyy[mcp]` are covered, not just the dev lock (#1391, #1396, thanks @orbisai0security).

### Refactor / Performance
- Begin splitting `extract.py` into per-language modules under `graphify/extractors/` (blade, elixir, razor, zig + shared `base.py`), behavior-neutral, with `extract.py` re-exporting the moved names so all callers and the dispatch table are unchanged (#1212, thanks @TheFedaikin).
- Parallel community labeling: `cluster-only` / `label` take `--max-concurrency` and `--batch-size`; `ollama`/`claude-cli` stay serial unless opted in (#1390).

**Install:** `uv tool install graphifyy==0.8.49`