v0.8.37

## Security

- **SSRF guard thread-safety**: Replaced the global `socket.getaddrinfo` monkey-patch with per-connection `_SSRFGuardedHTTPConnection`/`_SSRFGuardedHTTPSConnection` subclasses. DNS is resolved once, IP validated, connection made to that exact address — closes the concurrent-thread race and the underlying TOCTOU gap.
- **Prompt injection mitigation**: Untrusted source files are now wrapped in `<untrusted_source path="..." sha256="...">` XML delimiters during LLM extraction. Jailbreak sentinel tokens neutralised; system prompt hardened.

## Fixes

- **Obsidian/Canvas export crash**: `KeyError` when a community contains a node absent from the graph — dangling members now skipped gracefully.
- **macOS NFC/NFD re-extraction loop**: Office sidecar filenames now NFC-normalised before hashing, fixing the bug where `--update` re-extracted all Office files on every run on HFS+/APFS.
- **Data JSON orphan nodes**: The JSON extractor now only processes config/manifest JSON (`package.json`, `tsconfig.json`, etc.). Data JSON files (arrays, generic key/value) are skipped by the AST pass — eliminates 561+ orphan nodes on real repos.
- **OpenAI reasoning models temperature error**: `temperature=0` is now auto-omitted for o1/o3/o4/gpt-5 series. Override with `GRAPHIFY_LLM_TEMPERATURE`.
- **Corporate Windows / EDR hang**: `datasketch` and `scipy` removed. Replaced with a self-contained pure-numpy MinHash/MinHashLSH implementation — eliminates the `numpy.testing → platform.machine()` subprocess spawn at import time that EDR software (CrowdStrike, SentinelOne) was intercepting.
- **Dedup merges distinct same-named symbols**: `Config` class in `app.py` and `Config` class in `db.py` are no longer collapsed. Code nodes are now deduplicated by ID only.

## Performance

- **detect() 34% faster on large repos**: Ignore-pattern checks memoized per scan. Each ancestor directory evaluated once across all sibling files, eliminating ~42M redundant `fnmatch` calls on 2k+ file corpora.

## Features

- **`GRAPHIFY_MAX_GRAPH_BYTES`**: Override the 512 MiB `graph.json` size cap (e.g. `700MB`, `2GB`). The cap error message now cites this env var. `graphify export html` auto-falls back to community-aggregation view when over cap.
- **Stronger `CLAUDE.md` instructions**: "MANDATORY: Before using Read/Grep/Glob/Bash you MUST run graphify first" — includes explicit instruction to forward the rule to every subagent prompt.
- **`GRAPHIFY_LLM_TEMPERATURE`**: Override LLM temperature for any backend (`none` to omit entirely).

## CI

- **Self-graph release asset**: Every release now ships `graphify-self-graph.tar.gz` — `graph.json` + `graph.html` + `GRAPH_REPORT.md` from Graphify analysing its own source. Download and open `graph.html` locally to see what Graphify produces, no install required.

## Upgrade

```bash
uv tool upgrade graphifyy
# or
pip install --upgrade graphifyy
```