Starstruk Logo MarkStarstruk

v0.8.42

deepseek-ai/DeepSeek-Coder-V2v0.8.42Jun 18, 2026by safishamsi

AI Summary

Bug-fix release addressing a critical regression in the update process, a security vulnerability regarding file exclusions, and improvements to Java record handling and text extraction limits.

Key Highlights

  • Live regression fix: `/graphify --update` no longer deletes newly extracted nodes from changed files.
  • Security fix: `.graphifyignore` and `.gitignore` are now merged per directory to prevent secret exposure.
  • Java `record` declarations are now first-class type nodes with constructor call edges.
  • Large text documents are no longer silently truncated during semantic extraction.

New Features

  • Java record support
  • Improved text extraction for large files

Full Release Notes

Bug-fix release. `pip install -U graphifyy` / `uv tool upgrade graphifyy`.

Ships a **live regression fix** and a **security fix** from 0.8.41, plus two correctness/feature fixes.

### Fixes

- 🔴 **`/graphify --update` no longer deletes a changed file's freshly re-extracted nodes.** The 0.8.41 `root=` fix (#1361) made `build_merge`'s prune actually match relative `source_file` values — which then matched the just-re-extracted nodes of *changed* files (still in `prune_sources`) and removed them, so `--update` on a changed file could wipe its nodes. The update runbook now prunes only genuinely deleted files; changed files are reconciled by `build_merge`'s replace-on-re-extract (#1344). The full build also passes `root=` to `build_from_json`, and the extraction-spec `source_file` is pinned to the verbatim path, so full build and incremental updates never drift. (#1366 — thanks @RelywOo)

- 🔒 **Security: `.graphifyignore` and `.gitignore` are now merged per directory** instead of `.graphifyignore` silently replacing the dir's `.gitignore`. Previously, adding a `.graphifyignore` disabled that directory's `.gitignore` entirely, so a file excluded only by `.gitignore` — including neutrally-named secrets like `prod-dump.sql` or `customer-data.json` — got indexed into the graph (whose artifacts embed file contents and are routinely committed). `.gitignore` is read first and `.graphifyignore` last, so it still wins on conflict (including `!` negations); adding one can only ever exclude more. (#1363)

- **Java `record` declarations are now first-class type nodes**, and `new Foo(...)` constructor calls produce a `calls` edge. Previously a record appeared only as its file node (degree 0). (#1373)

- **Large text documents are no longer silently truncated** during semantic extraction. `_read_files` capped every file at 20,000 chars and dropped the rest; oversized Markdown/text/rST docs are now sliced at heading/paragraph boundaries so the whole file is extracted (slices share the parent `source_file`, so the graph isn't fragmented). Code files and PDFs are never sliced. (#1369)

**Full changelog:** https://github.com/safishamsi/graphify/blob/v8/CHANGELOG.md