deps(python): bump graphifyy from 0.9.53 to 0.9.58 in the python-minor-and-patch group by dependabot[bot] · Pull Request #213 · bifrost0x/webssh

dependabot · 2026-09-14T04:22:20Z

Superseded by #215, which combines both dependency updates, repairs the Graphify lock and policy test, and records validation and the remaining container-scan blocker.

Bumps the python-minor-and-patch group with 1 update: graphifyy.

Updates graphifyy from 0.9.53 to 0.9.58

Release notes

Sourced from graphifyy's releases.

v0.9.58

Fix: a call to a Python function defined nested inside another function now resolves to that inner definition per lexical scope, instead of leaking to a same-named function elsewhere; direct recursion is preserved as a self-loop (#3410, thanks @hopstreax).

Fix: submodule imports inside a PEP 420 namespace package (a directory with no __init__.py) now resolve to the target module instead of being dropped (#3429, thanks @flaukowski).

Fix: a bare-name import of a module sitting next to the importing file (a flat script dir with no package) now resolves to that sibling — matching CPython's sys.path[0] behavior — without over-resolving a genuine third-party name (#3430, thanks @hopstreax).

Fix: a PHP use Foo\Bar as Baz; import keys its local binding on the alias, so later Baz references resolve to the real class, and distinct aliased same-named classes stay separate (#3421, thanks @ayushcodes10).

Fix: a directory literally named out is skipped as build output only when there is build-output evidence, so a real source out/ is no longer silently dropped (#3347, thanks @abhay-codes07).

Fix: a shell script invoked in exec position through a variable path ("$SCRIPT_DIR/foo.sh") now resolves to the target when the variable holds a constant, matching the existing source handling (#3416, thanks @edwardselby).

Fix: added the missing Iterable import in build.py so its type annotations resolve (they were an undefined name) (#3462, thanks @xiongjianxu).

Fix: graphify global add no longer infers an empty repo tag for a path like /tmp/graph.json; it degrades to a sensible non-empty tag via the same helper merge-graphs uses (#3464, thanks @xiongjianxu).

Feature: SQL extraction now emits index nodes for CREATE [UNIQUE] INDEX, linked to the table they index (#3467, thanks @L4XB).

Fix: a TypeScript export * re-export no longer resolves a name to a same-named interface method — only module-level exports are candidates (#3436, thanks @L4XB).

Feature: Rust module-level static and const declarations are now extracted as nodes (#3471, thanks @L4XB).

Fix: an incremental rebuild no longer drops a node's rationale/summary when a semantic node's absolute source_file collides with its AST twin's relative path during dedup — source paths are normalized first (#3472, thanks @hopstreax).

Fix: graphify install no longer aborts when the always-on registration target is unwritable (read-only or symlinked config); it skips that step with an actionable warning and still installs the skill (#3474, thanks @dajiaohuang).

Fix: community labelling falls back to an installed claude CLI resolved at run time instead of pinning a path that expires (e.g. under snap/nvm), so labelling keeps working across updates (#3475, thanks @ktsang622).

Fix: the all extra now includes psycopg[binary], so pip install 'graphifyy[all]' provides the postgres driver (#3482, thanks @L4XB).

v0.9.57

Fix: an incremental rebuild no longer wipes cross-file project AST nodes — re-extracting one .csproj/.sln was dropping package/framework nodes of a referenced project (whose stub carried the referenced file's source_file); the AST-replacement set is now derived from the files actually extracted (#3411, thanks @hopstreax).

Fix: when duplicate nodes merge, the richer (more complete) node is now kept as the survivor and the losers' non-empty fields are folded in, instead of a shorter-id passing mention winning and dropping content (#3372, thanks @abhay-codes07).

Fix: a C# generic call site with explicit type arguments — Get<int>(...), unqualified or through this — now resolves to the method definition instead of capturing Get<int> as the callee and failing to match (#3406, thanks @abhay-codes07).

Fix: this.X = function / this.X = () => … members are now captured in every enclosing-function form (function expressions, arrows, IIFEs, callbacks), not just function declarations (#3408, thanks @abhay-codes07).

v0.9.56

Fix: Rust trait method declarations (signature-only, and default-bodied) are now extracted as nodes — trait bodies were never walked, so both were silently dropped; a trait-declared method stays a distinct node from its impl definition (#3366, thanks @santoshpy).

Fix: the atomic-write temp filename is now bounded, so exporting to a path near the Windows MAX_PATH / 255-char component limit no longer fails with a temp-file FileNotFoundError (#3351, thanks @hopstreax).

Fix: when graphify's git hook decides to skip (no graph, rebase/merge/worktree, GRAPHIFY_SKIP_HOOK), it no longer terminates the whole hook — the block runs in a subshell so chained hooks and later steps still execute (#2986, thanks @abhay-codes07).

Fix: JS/TS @/ project-root alias imports now resolve when no tsconfig paths mapping exists — an explicit mapping still wins, @scope/pkg packages are untouched, and only existing files are linked (#3357, thanks @hopstreax).

Fix: an MCP query_graph seeded on a node with only incoming edges (e.g. a leaf function that is called but calls nothing) now traverses undirected, so it reaches that node's callers — matching the CLI's behavior (#3373, thanks @kuchtgpt-svg).

Fix: a member call whose method name collides with a language builtin (e.g. .open, .get, .map) is now handed to cross-file resolution instead of being short-circuited, so a genuine user-defined method with that name links — without fabricating an edge to an actual builtin (#3381, thanks @ayushcodes10).

Fix: when the rebuild watchdog times out, spawned extraction workers are now killed before it exits (both the SIGALRM and the os._exit fallback paths) instead of being orphaned (#3396, thanks @ayushcodes10).

Fix: Node subpath imports (#services/foo via a package.json imports map, including * wildcards and condition objects) now resolve to the mapped file — previously every #-specifier resolved to nothing (#3382, thanks @julien-e).

Fix: TS import-type normalization no longer scans every type-argument range per match (an O(matches × ranges) blowup that pinned extraction at 100% CPU on large mixed files); the filter is now a sorted-index lookup with byte-identical output (#3359, thanks @Sagexd08).

Fix: Dart extraction now stamps source_location (1-based L{line}) on nodes and edges, matching every other extractor, instead of leaving it null (#3365, thanks @ayushcodes10).

v0.9.55

Fix: a module docstring preceded by a leading comment (shebang, # -*- coding -*-, or a license header) is now extracted instead of silently dropped — comments are skipped when locating the first statement, across module/class/function bodies (#3312, thanks @ayushcodes10).

Fix: two Python definitions whose ids differ only by leading underscores (e.g. _get_connection and get_connection) no longer collide and silently drop one — private/dunder members are salted while a unique public member keeps its plain id, so existing graphs are unaffected (#3302, thanks @ayushcodes10).

Fix: a ghost node whose source_file was set to the doc that merely mentions a file is now merged onto the real file node via a conservative unique-label fallback, so it stops surviving every rebuild (#3344, thanks @leninherrera94).

Fix: type-use edges (inherits/implements/references) are no longer fabricated from a symbol that owns no node — e.g. a class nested in a named function, or an abstract method signature — closing a path that leaked phantom ext_*-sourced edges (#3356, thanks @VasuBansal7576).

Fix: graphify watch/update in no-cluster mode now disambiguates same-basename file labels (e.g. two errors.ts) the same way the clustered build does, instead of collapsing them to a bare basename (#3363, thanks @VasuBansal7576).

Fix: a named re-export that forwards an imported binding — import { x } from './a'; export { x }, export { x } from './a' barrels, alias renames, and export * chains — now resolves to the original definition instead of dangling on a fabricated barrel symbol; ambiguous or unresolved origins are left untouched (#3358, thanks @VasuBansal7576).

Fix: cross-file entity nodes typed only by their file extension (e.g. the same handle mentioned across several docs) now merge like concept nodes, gated by an entropy + provenance guard and an own-file-node exclusion so distinct entities stay separate (partially addresses #296, thanks @yotamleo).

Fix: a runtime dynamic import(...) is no longer blanked by the TS type-argument normalizer — masking parses first and only rewrites import(...) inside genuine call type-argument positions adjacent to a grammar error, and the whitespace form import (...) is recovered, so real module dependencies survive (#3210, thanks @zfaustk).

Fix: JSON-config extraction no longer turns every array value into an extends (inheritance) edge or emits a label-level self-loop dependency — only a real top-level extends yields an inheritance edge, and dependency edges are sourced from the manifest node with a namespaced target (#3330, thanks @pranavshipit).

Fix: the claude-cli backend now tolerates a diagnostic line printed before the JSON envelope (e.g. an MCP client notice), recovering the response instead of discarding already-generated output; genuine non-JSON still errors (#3330, thanks @pranavshipit).

Fix: a code-only graphify watch rebuild no longer clears the pending semantic-update flag, so a queued re-extraction of changed docs/papers/images is not silently dropped (#3294, thanks @theSatvik).

Fix: the MCP prs tools no longer hang the stdio transport on Windows — the PR subprocesses run with stdin detached, and an explicit --repo is passed positionally to gh repo view (#3318, thanks @hopstreax).

v0.9.54

... (truncated)

Changelog

Sourced from graphifyy's changelog.

0.9.58 (2026-09-10)

Fix: a call to a Python function defined nested inside another function now resolves to that inner definition per lexical scope, instead of leaking to a same-named function elsewhere; direct recursion is preserved as a self-loop (#3410, thanks @hopstreax).

Fix: submodule imports inside a PEP 420 namespace package (a directory with no __init__.py) now resolve to the target module instead of being dropped (#3429, thanks @flaukowski).

Fix: a bare-name import of a module sitting next to the importing file (a flat script dir with no package) now resolves to that sibling — matching CPython's sys.path[0] behavior — without over-resolving a genuine third-party name (#3430, thanks @hopstreax).

Fix: a PHP use Foo\Bar as Baz; import keys its local binding on the alias, so later Baz references resolve to the real class, and distinct aliased same-named classes stay separate (#3421, thanks @ayushcodes10).

Fix: a directory literally named out is skipped as build output only when there is build-output evidence, so a real source out/ is no longer silently dropped (#3347, thanks @abhay-codes07).

Fix: a shell script invoked in exec position through a variable path ("$SCRIPT_DIR/foo.sh") now resolves to the target when the variable holds a constant, matching the existing source handling (#3416, thanks @edwardselby).

Fix: added the missing Iterable import in build.py so its type annotations resolve (they were an undefined name) (#3462, thanks @xiongjianxu).

Fix: graphify global add no longer infers an empty repo tag for a path like /tmp/graph.json; it degrades to a sensible non-empty tag via the same helper merge-graphs uses (#3464, thanks @xiongjianxu).

Feature: SQL extraction now emits index nodes for CREATE [UNIQUE] INDEX, linked to the table they index (#3467, thanks @L4XB).

Fix: a TypeScript export * re-export no longer resolves a name to a same-named interface method — only module-level exports are candidates (#3436, thanks @L4XB).

Feature: Rust module-level static and const declarations are now extracted as nodes (#3471, thanks @L4XB).

Fix: an incremental rebuild no longer drops a node's rationale/summary when a semantic node's absolute source_file collides with its AST twin's relative path during dedup — source paths are normalized first (#3472, thanks @hopstreax).

Fix: graphify install no longer aborts when the always-on registration target is unwritable (read-only or symlinked config); it skips that step with an actionable warning and still installs the skill (#3474, thanks @dajiaohuang).

Fix: community labelling falls back to an installed claude CLI resolved at run time instead of pinning a path that expires (e.g. under snap/nvm), so labelling keeps working across updates (#3475, thanks @ktsang622).

Fix: the all extra now includes psycopg[binary], so pip install 'graphifyy[all]' provides the postgres driver (#3482, thanks @L4XB).

0.9.57 (2026-09-09)

Fix: Rust module-level static and const declarations (and associated consts inside an impl) are now extracted as nodes with a contains edge and a reference to their declared type — neither node type had a branch, so a constant only ever reached the graph through files that referenced it (#3471, thanks @sortakool).

Fix: an incremental rebuild no longer wipes cross-file project AST nodes — re-extracting one .csproj/.sln was dropping package/framework nodes of a referenced project (whose stub carried the referenced file's source_file); the AST-replacement set is now derived from the files actually extracted (#3411, thanks @hopstreax).

Fix: when duplicate nodes merge, the richer (more complete) node is now kept as the survivor and the losers' non-empty fields are folded in, instead of a shorter-id passing mention winning and dropping content (#3372, thanks @abhay-codes07).

Fix: a C# generic call site with explicit type arguments — Get<int>(...), unqualified or through this — now resolves to the method definition instead of capturing Get<int> as the callee and failing to match (#3406, thanks @abhay-codes07).

Fix: this.X = function / this.X = () => … members are now captured in every enclosing-function form (function expressions, arrows, IIFEs, callbacks), not just function declarations (#3408, thanks @abhay-codes07).

0.9.56 (2026-09-07)

Fix: Rust trait method declarations (signature-only, and default-bodied) are now extracted as nodes — trait bodies were never walked, so both were silently dropped; a trait-declared method stays a distinct node from its impl definition (#3366, thanks @santoshpy).

Fix: the atomic-write temp filename is now bounded, so exporting to a path near the Windows MAX_PATH / 255-char component limit no longer fails with a temp-file FileNotFoundError (#3351, thanks @hopstreax).

Fix: when graphify's git hook decides to skip (no graph, rebase/merge/worktree, GRAPHIFY_SKIP_HOOK), it no longer terminates the whole hook — the block runs in a subshell so chained hooks and later steps still execute (#2986, thanks @abhay-codes07).

Fix: JS/TS @/ project-root alias imports now resolve when no tsconfig paths mapping exists — an explicit mapping still wins, @scope/pkg packages are untouched, and only existing files are linked (#3357, thanks @hopstreax).

Fix: an MCP query_graph seeded on a node with only incoming edges (e.g. a leaf function that is called but calls nothing) now traverses undirected, so it reaches that node's callers — matching the CLI's behavior (#3373, thanks @kuchtgpt-svg).

Fix: a member call whose method name collides with a language builtin (e.g. .open, .get, .map) is now handed to cross-file resolution instead of being short-circuited, so a genuine user-defined method with that name links — without fabricating an edge to an actual builtin (#3381, thanks @ayushcodes10).

Fix: when the rebuild watchdog times out, spawned extraction workers are now killed before it exits (both the SIGALRM and the os._exit fallback paths) instead of being orphaned (#3396, thanks @ayushcodes10).

Fix: Node subpath imports (#services/foo via a package.json imports map, including * wildcards and condition objects) now resolve to the mapped file — previously every #-specifier resolved to nothing (#3382, thanks @julien-e).

Fix: TS import-type normalization no longer scans every type-argument range per match (an O(matches × ranges) blowup that pinned extraction at 100% CPU on large mixed files); the filter is now a sorted-index lookup with byte-identical output (#3359, thanks @Sagexd08).

Fix: Dart extraction now stamps source_location (1-based L{line}) on nodes and edges, matching every other extractor, instead of leaving it null (#3365, thanks @ayushcodes10).

0.9.55 (2026-09-05)

Fix: a module docstring preceded by a leading comment (shebang, # -*- coding -*-, or a license header) is now extracted instead of silently dropped — comments are skipped when locating the first statement, across module/class/function bodies (#3312, thanks @ayushcodes10).

Fix: two Python definitions whose ids differ only by leading underscores (e.g. _get_connection and get_connection) no longer collide and silently drop one — private/dunder members are salted while a unique public member keeps its plain id, so existing graphs are unaffected (#3302, thanks @ayushcodes10).

Fix: a ghost node whose source_file was set to the doc that merely mentions a file is now merged onto the real file node via a conservative unique-label fallback, so it stops surviving every rebuild (#3344, thanks @leninherrera94).

Fix: type-use edges (inherits/implements/references) are no longer fabricated from a symbol that owns no node — e.g. a class nested in a named function, or an abstract method signature — closing a path that leaked phantom ext_*-sourced edges (#3356, thanks @VasuBansal7576).

Fix: graphify watch/update in no-cluster mode now disambiguates same-basename file labels (e.g. two errors.ts) the same way the clustered build does, instead of collapsing them to a bare basename (#3363, thanks @VasuBansal7576).

Fix: a named re-export that forwards an imported binding — import { x } from './a'; export { x }, export { x } from './a' barrels, alias renames, and export * chains — now resolves to the original definition instead of dangling on a fabricated barrel symbol; ambiguous or unresolved origins are left untouched (#3358, thanks @VasuBansal7576).

Fix: cross-file entity nodes typed only by their file extension (e.g. the same handle mentioned across several docs) now merge like concept nodes, gated by an entropy + provenance guard and an own-file-node exclusion so distinct entities stay separate (partially addresses #296, thanks @yotamleo).

Fix: a runtime dynamic import(...) is no longer blanked by the TS type-argument normalizer — masking parses first and only rewrites import(...) inside genuine call type-argument positions adjacent to a grammar error, and the whitespace form import (...) is recovered, so real module dependencies survive (#3210, thanks @zfaustk).

Fix: JSON-config extraction no longer turns every array value into an extends (inheritance) edge or emits a label-level self-loop dependency — only a real top-level extends yields an inheritance edge, and dependency edges are sourced from the manifest node with a namespaced target (#3330, thanks @pranavshipit).

... (truncated)

Commits

23f2ffa release: 0.9.58 — python/php/bash import resolution, dedup source-path normal...
519f322 chore(lock): sync uv.lock for the psycopg[binary] all-extra (#3483)
fc179f3 fix(packaging): include psycopg[binary] in the all extra
ec12e5e test: isolate backend-detection tests from the developer's environment
2f9279f test(labeling): keep the no-backend test hermetic against the claude-cli fall...
d9e094c fix: label via an installed claude CLI, and stop pinning a path that expires
496112d fix(install): do not abort the install when always-on registration is unwritable
437c962 Fix same-file source path collision during merge
ab80fa7 fix(rust): extract module-level static and const declarations
adf814f docs(readme): replace the header card with the graphify logo (png)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the python-minor-and-patch group with 1 update: [graphifyy](https://github.com/Graphify-Labs/graphify). Updates `graphifyy` from 0.9.53 to 0.9.58 - [Release notes](https://github.com/Graphify-Labs/graphify/releases) - [Changelog](https://github.com/Graphify-Labs/graphify/blob/v8/CHANGELOG.md) - [Commits](Graphify-Labs/graphify@v0.9.53...v0.9.58) --- updated-dependencies: - dependency-name: graphifyy dependency-version: 0.9.58 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-09-14T07:00:09Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

Combine bifrost0x#213 and bifrost0x#214, regenerate the universal hashed graph lock and update the Graphify version policy test.

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Sep 14, 2026

github-project-automation Bot added this to WebSSH Roadmap Sep 14, 2026

github-project-automation Bot moved this to Backlog in WebSSH Roadmap Sep 14, 2026

bifrost0x mentioned this pull request Sep 14, 2026

deps: consolidate tool updates and refresh container security packages #215

Merged

bifrost0x closed this Sep 14, 2026

github-project-automation Bot moved this from Backlog to Done in WebSSH Roadmap Sep 14, 2026

dependabot Bot deleted the dependabot/pip/python-minor-and-patch-b8d5de763e branch September 14, 2026 07:00

GalaxyFour pushed a commit to GalaxyFour/webssh that referenced this pull request Sep 17, 2026

deps: consolidate Graphify, ESLint and Playwright updates

7db05d1

Combine bifrost0x#213 and bifrost0x#214, regenerate the universal hashed graph lock and update the Graphify version policy test.

Navigation Menu

Uh oh!

deps(python): bump graphifyy from 0.9.53 to 0.9.58 in the python-minor-and-patch group - #213

deps(python): bump graphifyy from 0.9.53 to 0.9.58 in the python-minor-and-patch group#213
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-minor-and-patch-b8d5de763e

dependabot Bot commented on behalf of github Sep 14, 2026 •

edited by bifrost0x

Loading

Uh oh!

dependabot Bot commented on behalf of github Sep 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 14, 2026 • edited by bifrost0x Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.9.58

v0.9.57

v0.9.56

v0.9.55

v0.9.54

0.9.58 (2026-09-10)

0.9.57 (2026-09-09)

0.9.56 (2026-09-07)

0.9.55 (2026-09-05)

Uh oh!

dependabot Bot commented on behalf of github Sep 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Sep 14, 2026 •

edited by bifrost0x

Loading