Starstruk Logo MarkStarstruk

v0.8.49

chatboxai/chatboxv0.8.49Jun 25, 2026by safishamsi

AI Summary

This release focuses on fixes for MCP tools, work-memory deduplication, and security patches for Starlette. It also introduces refactoring of extractors and performance improvements for parallel community labeling.

Key Highlights

  • MCP tool header now displays community names correctly
  • Work-memory deduplication for 'known dead ends'
  • Security floor on Starlette for CVE-2026-48818 and CVE-2026-54283
  • Extraction modules split into per-language directories
  • Parallel community labeling with concurrency controls

New Features

  • Work-memory runs without git hook via --if-stale flag
  • Parallel community labeling for ollama and claude-cli

Full Release Notes

## graphify 0.8.49

### Fixes
- `get_community` MCP tool now shows the community name in its header (`Community 12 — Auth & Sessions (8 nodes)`), matching `get_node` / query output; skipped when it is only the `Community N` placeholder so it never doubles (#1448, thanks @rmart1308).
- `graphify reflect` no longer duplicates "known dead ends" / "corrections" lines when the same Q&A is saved more than once (dedup by question, most recent wins).
- Work-memory works without the git hook: the skill runs `graphify reflect --if-stale` at the start of graph work, so a skill-only install still refreshes `LESSONS.md`. `--if-stale` no-ops when the file is already newer than every input, so the post-commit hook is an optimization rather than a requirement.

### Security
- Floor `starlette` at `>=1.3.1` for CVE-2026-48818 and CVE-2026-54283 (both resolved by 1.3.1). starlette underpins the HTTP MCP transport (`graphify-mcp` over HTTP); stdio and the CLI are unaffected. Now declared in the `mcp`/`all` extras and floored so end users installing `graphifyy[mcp]` are covered, not just the dev lock (#1391, #1396, thanks @orbisai0security).

### Refactor / Performance
- Begin splitting `extract.py` into per-language modules under `graphify/extractors/` (blade, elixir, razor, zig + shared `base.py`), behavior-neutral, with `extract.py` re-exporting the moved names so all callers and the dispatch table are unchanged (#1212, thanks @TheFedaikin).
- Parallel community labeling: `cluster-only` / `label` take `--max-concurrency` and `--batch-size`; `ollama`/`claude-cli` stay serial unless opted in (#1390).

**Install:** `uv tool install graphifyy==0.8.49`