[dependabot]

Bumps the pip group with 1 update in the /benchmarks/results/competition/20260912-expanded directory: graphifyy.
Bumps the pip group with 1 update in the /benchmarks/results/competition/20260913-48cd3c7 directory: graphifyy.
Bumps the pip group with 1 update in the /benchmarks/results/competition/20260913-v0.2.1 directory: graphifyy.

Updates graphifyy from 0.9.59 to 0.9.70

Release notes

Sourced from graphifyy's releases.

v0.9.70

• Security: the Fortran capital-F cpp step no longer allows an untrusted .F/.F90 source to read arbitrary host files. -nostdinc -I /dev/null did not stop cpp from resolving absolute (#include "/etc/passwd") or traversing (#include "../../../secret") includes, which inlined host-file contents into graph.json/GRAPH_REPORT.md and the LLM context on the default offline path. Every #include directive is now stripped before preprocessing and the source is fed to cpp on stdin; macro expansion is preserved (GHSA-pcc4-rvhr-2pr8, CWE-22/73/200).
• Security: the Aider/Devin monolith --watch snippet no longer interpolates the agent-substituted INPUT_PATH into a shell command — it now reads the trusted graphify-out/.graphify_root written in Step 1, closing the last instance of the shell-injection class from #3642 (#3852, #3844, thanks @​hopstreax).
• Security: Terraform secret redaction now also covers a value paired with a secret-named name in name/value pair lists (environment = [{ name = "DB_PASSWORD", value = "…" }], ECS valueFrom included), where the sensitive signal is the sibling name literal rather than a key (#3870, #3787, thanks @​breken-ai).
• Fix: graphify watch now serializes concurrent rebuilds on Windows via msvcrt byte-range locking instead of a no-op lock, closing a WinError 32 race between overlapping rebuilds; the POSIX fcntl path is unchanged (#3883, #3881, thanks @​harshaygadekar).
• Fix: C# type references no longer collect a named tuple's element names as type references ((int Count, string Name) recorded a bogus ref to Count/Name); only the element types are referenced (#3877, #3796, thanks @​KaiyiQuan).
• Feature: JSX component usage now produces calls edges — <MyButton/> and <_Row/> link to the component, while lowercase DOM tags (<div>) and member tags (<Nav.Item>) are conservatively skipped, so React component graphs capture render relationships (#3855, #3854, thanks @​sinangumuskabak-sys).
• Fix: absolute Python imports that spell the scan root's own nested namespace (from Company.Apps.Team.lib import x when the scan root is Team/) now resolve to the local module by projecting the namespace prefix onto the scan-root layout (#3867, #3843, thanks @​nikhilsaxena04).

v0.9.69

• Feature: five language extractors gained structural depth — OCaml classes now emit their methods (via the method relation) and instance variables (#3838, thanks @​rajatnagda45); Elixir defprotocol/defimpl are extracted as containers holding their functions, with a same-file implements link (#3839, thanks @​rajatnagda45); Fortran derived-type contains blocks link type-bound procedures to the type, resolving the => impl target (#3840, thanks @​rajatnagda45); Julia macro definitions and @enum types are extracted, including valued (red = 1) and typed (Color::UInt8) enum forms, with members using the case_of relation (#3841, thanks @​rajatnagda45); Kotlin annotations (class/function/property, use-site targets) and val/var primary-constructor properties now produce edges (#3848, #3842, thanks @​nikhilsaxena04).
• Fix: a TypeScript "solution" tsconfig.json that only carries references (no paths of its own) now resolves path aliases declared in the referenced project configs, so alias imports in a tsc -b layout no longer dangle (#3753, #3745, thanks @​abhay-codes07).
• Fix: extraction now skips the process pool up front when the spawn start method can't re-import __main__ (stdin, python -c, REPL, embedded callers), falling back to a correct sequential run instead of a wall of BrokenProcessPool tracebacks (#3754, #3669, thanks @​abhay-codes07).
• Fix: entity deduplication preserves a genuine pre-existing self-loop (a recursive call, a self-referential FK) while still dropping a self-loop newly created by a merge (#3825, thanks @​Abhirup0).
• Fix: ingest classifies a URL by its parsed host, not by text anywhere in the URL, so example.com/article-about-youtube is no longer mistaken for a YouTube link; subdomains and youtu.be still match, path-based extension detection is unchanged (#3831, thanks @​L4XB).
• Fix: graphify update on a destination outside the scan root no longer leaks a stat-index cache into the corpus — the incremental detection path now forwards cache_root like the fresh-scan path (#3850, #3847, thanks @​ayushcodes10).
• Fix: manifest duplicate-key collapse breaks ties by last-seen time instead of arbitrary iteration order, so a stale duplicate can no longer win and under-report changed files; also re-anchors foreign-platform absolute keys and normalizes ../. segments so more duplicates actually collapse (#3781, #1964, thanks @​ayushcodes10).
• Docs: a community-health and contributor-guide overhaul — new CONTRIBUTING.md, CODE_OF_CONDUCT.md, and RELEASING.md, refreshed issue/PR templates, and corrected factual drift in SECURITY.md (supported version, network/XSS boundaries), ARCHITECTURE.md (shared-state), and AGENTS.md (scoped-query workflow) (#3845, thanks @​nikhilsaxena04).

v0.9.68

• Security: the /graphify add ... --watch reference no longer passes the raw, agent-substituted INPUT_PATH placeholder unquoted into a shell command (… -m graphify.watch INPUT_PATH), where a scan root containing $(…), backticks, or ; could execute — a follow-on to the Step 1 fix. The watcher now reads the trusted graphify-out/.graphify_root that Step 1 resolves, so there is no path to substitute (#3742, #3642, thanks @​ayushcodes10). The identical placeholder still appears in the Aider/Devin monolith --watch snippet and is tracked separately.
• Fix: incremental updates (update/extract --code-only/watch) now preserve a cross-file imports/calls/uses edge whose target symbol lives in an unchanged file — the symbol-resolution facts pass widens its target index with the read-only resolution context, so re-extracting one file no longer silently drops its edges into the rest of the graph; a genuinely removed edge is still pruned (#3812, #3776, thanks @​hopstreax).
• Fix: C# type references (inherits/implements/parameter/return/base types) no longer resolve to a same-named non-type node — an enum member, property, field, or method sharing a type's name is excluded from the type-definition index, so a class inherits from the real base rather than a stray member; resolution of partial classes without a contains edge is restored (#3815, #3795, thanks @​hopstreax).
• Fix: dedup now keeps the node with a real source location over a richer but source-less one when merging duplicates, so a merged entity points at real code instead of an inferred/external stub; the loser's attributes are still folded onto the survivor (#3786, #3775, thanks @​ayushcodes10).
• Fix: Maven pom.xml ingestion resolves a dependency's inherited groupId/version from the local <parent> block and substitutes ${property} / ${project.*} placeholders (offline, one level), so previously-dangling depends_on edges now connect (#3823, #3806, thanks @​chiliec).
• Fix: the PYTHONHASHSEED re-exec (0.9.67) now waits for and propagates the child's exit code on Windows instead of returning early — os.execvpe is a true process replacement only on POSIX; on Windows it spawned a new process and let the parent race ahead unpinned, crashing update/extract/cluster-only/label. The Windows path now spawns via subprocess.run and exits with the child's status; the POSIX path is unchanged (#3816, #3799, thanks @​sinangumuskabak-sys).
• Fix: Terraform secret redaction now also covers a secret-named variable default and output value — the secret's name lives in the block label, so the literal sat under the generic default/value key that the key-name check never flagged (variable "db_password" { default = "…" } reached graph.json verbatim). Redacted when the label names a secret or the block sets sensitive = true (#3817, #3644/#3762 follow-up, thanks @​breken-ai).
• Fix: fixed-format COBOL that carries a sequence NUMBER in columns 1-6 (not blanks) is now detected as fixed-format — previously it was misread as free-format, the sequence digits stayed in the code, and every paragraph and PERFORM edge was silently dropped, leaving only the file and program nodes (#3813, thanks @​abhay-codes07).
• Fix: PERFORM A THRU/THROUGH Z now links both endpoints of the range, not just the entry paragraph, so the range-end no longer lacks an inbound calls edge; a dangling THRU target is skipped rather than fabricated (#3814, thanks @​abhay-codes07).
• Fix: GRAPH_REPORT.md's Knowledge Gaps section only offers "undocumented components" as an explanation for an isolated node when the graph actually has a semantic layer (a document/paper/image node an LLM extracted meaning from) — a code-only graph no longer lists a possibility it can never have (#3828, #3801, thanks @​ayushcodes10).

v0.9.67

• Fix: the PYTHONHASHSEED determinism pin (0.9.66) now re-execs via python -m graphify instead of replaying argv[0], fixing a Windows regression where update/extract/cluster-only/label failed to re-launch through the console-script .exe launcher (#3780, thanks @​ayushcodes10).
• Feature: PHP closures are now extracted — an anonymous function(){…}, an arrow fn()=>…, or a closure passed as an argument now produces a node and its inner calls are captured, in all positions including file scope. Route-definition closures get a semantic VERB /path name (composing nested group() prefixes); other closures get a stable per-scope ordinal (#3461, #3409, thanks @​nikhilsaxena04).
• Fix: absolute Python package imports (import pkg.sub, from pkg.sub import x) now resolve to the local package/module node within the scan root, reusing the canonical resolver (bounded walk, PEP 420 namespace handling); an ambiguous module name across scanned trees fails closed rather than binding arbitrarily (#3729, thanks @​Ha1baraA11).
• Fix: a package/module name collision (pkg/ package alongside a pkg.py module) no longer produces a phantom import cycle — the spurious provisional edge is retracted while genuine package-init and submodule edges are preserved (#3784, #3777, thanks @​hopstreax).
• Fix: Terraform secret redaction now also covers secrets nested inside list values (configs = [{ password = "…" }]), not just maps (#3762, #3644 follow-up, thanks @​abhay-codes07).
• Fix: export no longer rewrites unchanged wiki/Obsidian pages on every run — a page whose content is identical is left untouched (stable mtimes, clean git/Obsidian sync), while changed and new pages still write and orphaned pages are still swept (#3760, #3060, thanks @​abhay-codes07).

v0.9.66

• Feature: five new language extractors — COBOL (.cbl/.cob/.cobol/.cpy; programs, paragraphs, PERFORM/CALL/COPY, pure-regex, no new dependency) (#3713, thanks @​Abdul535), VB.NET (.vb; case-insensitive types/methods, Inherits/Implements/Handles) (#3717, thanks @​Abdul535), R (.r/.R; assignment-form function defs, library/source, S4/R6 classes) (#3715, thanks @​Abdul535), Solidity (.sol; contracts/interfaces/libraries, is inheritance, imports, modifiers) (#3716, thanks @​Abdul535), and Erlang (.erl/.hrl/.escript; modules, functions by arity, behaviours, local + remote foo:bar() calls) (#3714, thanks @​Abdul535). The R and Erlang grammars ship via the r/erlang extras (they have no standalone PyPI wheel); Solidity and VB.NET have their own extras.
• Feature: Go interface method requirements now resolve to the interface, and their parameter/return types emit references edges (#3672, #3737, thanks @​rajatnagda45, @​oleksii-tumanov).
• Feature: a Rust self.method() call resolves across files for simple generic impls (impl<T> Foo<T>) (#3653, thanks @​oleksii-tumanov).
• Fix: graph.json is now deterministic across runs — update/extract/cluster-only/label pin PYTHONHASHSEED via a one-time re-exec, so hash-seed-sensitive community detection (Leiden/Louvain) produces identical output run-to-run and matches hook-triggered rebuilds (#3743, #3641, thanks @​ayushcodes10).
• Fix: a same-relation edge collision now keeps the higher-confidence edge (EXTRACTED over INFERRED) instead of resolving by arrival order (#3711, thanks @​shobhitagnihotri69).

... (truncated)

Changelog

Sourced from graphifyy's changelog.

0.9.70 (2026-09-27)

• Security: the Fortran capital-F cpp step no longer allows an untrusted .F/.F90 source to read arbitrary host files. -nostdinc -I /dev/null did not stop cpp from resolving absolute (#include "/etc/passwd") or traversing (#include "../../../secret") includes, which inlined host-file contents into graph.json/GRAPH_REPORT.md and the LLM context on the default offline path. Every #include directive is now stripped before preprocessing and the source is fed to cpp on stdin; macro expansion is preserved (GHSA-pcc4-rvhr-2pr8, CWE-22/73/200).
• Security: the Aider/Devin monolith --watch snippet no longer interpolates the agent-substituted INPUT_PATH into a shell command — it now reads the trusted graphify-out/.graphify_root written in Step 1, closing the last instance of the shell-injection class from #3642 (#3852, #3844, thanks @​hopstreax).
• Security: Terraform secret redaction now also covers a value paired with a secret-named name in name/value pair lists (environment = [{ name = "DB_PASSWORD", value = "…" }], ECS valueFrom included), where the sensitive signal is the sibling name literal rather than a key (#3870, #3787, thanks @​breken-ai).
• Fix: graphify watch now serializes concurrent rebuilds on Windows via msvcrt byte-range locking instead of a no-op lock, closing a WinError 32 race between overlapping rebuilds; the POSIX fcntl path is unchanged (#3883, #3881, thanks @​harshaygadekar).
• Fix: C# type references no longer collect a named tuple's element names as type references ((int Count, string Name) recorded a bogus ref to Count/Name); only the element types are referenced (#3877, #3796, thanks @​KaiyiQuan).
• Feature: JSX component usage now produces calls edges — <MyButton/> and <_Row/> link to the component, while lowercase DOM tags (<div>) and member tags (<Nav.Item>) are conservatively skipped, so React component graphs capture render relationships (#3855, #3854, thanks @​sinangumuskabak-sys).
• Fix: absolute Python imports that spell the scan root's own nested namespace (from Company.Apps.Team.lib import x when the scan root is Team/) now resolve to the local module by projecting the namespace prefix onto the scan-root layout (#3867, #3843, thanks @​nikhilsaxena04).

0.9.69 (2026-09-26)

• Feature: five language extractors gained structural depth — OCaml classes now emit their methods (via the method relation) and instance variables (#3838, thanks @​rajatnagda45); Elixir defprotocol/defimpl are extracted as containers holding their functions, with a same-file implements link (#3839, thanks @​rajatnagda45); Fortran derived-type contains blocks link type-bound procedures to the type, resolving the => impl target (#3840, thanks @​rajatnagda45); Julia macro definitions and @enum types are extracted, including valued (red = 1) and typed (Color::UInt8) enum forms, with members using the case_of relation (#3841, thanks @​rajatnagda45); Kotlin annotations (class/function/property, use-site targets) and val/var primary-constructor properties now produce edges (#3848, #3842, thanks @​nikhilsaxena04).
• Fix: a TypeScript "solution" tsconfig.json that only carries references (no paths of its own) now resolves path aliases declared in the referenced project configs, so alias imports in a tsc -b layout no longer dangle (#3753, #3745, thanks @​abhay-codes07).
• Fix: extraction now skips the process pool up front when the spawn start method can't re-import __main__ (stdin, python -c, REPL, embedded callers), falling back to a correct sequential run instead of a wall of BrokenProcessPool tracebacks (#3754, #3669, thanks @​abhay-codes07).
• Fix: entity deduplication preserves a genuine pre-existing self-loop (a recursive call, a self-referential FK) while still dropping a self-loop newly created by a merge (#3825, thanks @​Abhirup0).
• Fix: ingest classifies a URL by its parsed host, not by text anywhere in the URL, so example.com/article-about-youtube is no longer mistaken for a YouTube link; subdomains and youtu.be still match, path-based extension detection is unchanged (#3831, thanks @​L4XB).
• Fix: graphify update on a destination outside the scan root no longer leaks a stat-index cache into the corpus — the incremental detection path now forwards cache_root like the fresh-scan path (#3850, #3847, thanks @​ayushcodes10).
• Fix: manifest duplicate-key collapse breaks ties by last-seen time instead of arbitrary iteration order, so a stale duplicate can no longer win and under-report changed files; also re-anchors foreign-platform absolute keys and normalizes ../. segments so more duplicates actually collapse (#3781, #1964, thanks @​ayushcodes10).
• Docs: a community-health and contributor-guide overhaul — new CONTRIBUTING.md, CODE_OF_CONDUCT.md, and RELEASING.md, refreshed issue/PR templates, and corrected factual drift in SECURITY.md (supported version, network/XSS boundaries), ARCHITECTURE.md (shared-state), and AGENTS.md (scoped-query workflow) (#3845, thanks @​nikhilsaxena04).

0.9.68 (2026-09-25)

• Security: the /graphify add ... --watch reference no longer passes the raw, agent-substituted INPUT_PATH placeholder unquoted into a shell command (… -m graphify.watch INPUT_PATH), where a scan root containing $(…), backticks, or ; could execute — a follow-on to the Step 1 fix. The watcher now reads the trusted graphify-out/.graphify_root that Step 1 resolves, so there is no path to substitute (#3742, #3642, thanks @​ayushcodes10). The identical placeholder still appears in the Aider/Devin monolith --watch snippet and is tracked separately.
• Fix: incremental updates (update/extract --code-only/watch) now preserve a cross-file imports/calls/uses edge whose target symbol lives in an unchanged file — the symbol-resolution facts pass widens its target index with the read-only resolution context, so re-extracting one file no longer silently drops its edges into the rest of the graph; a genuinely removed edge is still pruned (#3812, #3776, thanks @​hopstreax).
• Fix: C# type references (inherits/implements/parameter/return/base types) no longer resolve to a same-named non-type node — an enum member, property, field, or method sharing a type's name is excluded from the type-definition index, so a class inherits from the real base rather than a stray member; resolution of partial classes without a contains edge is restored (#3815, #3795, thanks @​hopstreax).
• Fix: dedup now keeps the node with a real source location over a richer but source-less one when merging duplicates, so a merged entity points at real code instead of an inferred/external stub; the loser's attributes are still folded onto the survivor (#3786, #3775, thanks @​ayushcodes10).
• Fix: Maven pom.xml ingestion resolves a dependency's inherited groupId/version from the local <parent> block and substitutes ${property} / ${project.*} placeholders (offline, one level), so previously-dangling depends_on edges now connect (#3823, #3806, thanks @​chiliec).
• Fix: the PYTHONHASHSEED re-exec (0.9.67) now waits for and propagates the child's exit code on Windows instead of returning early — os.execvpe is a true process replacement only on POSIX; on Windows it spawned a new process and let the parent race ahead unpinned, crashing update/extract/cluster-only/label. The Windows path now spawns via subprocess.run and exits with the child's status; the POSIX path is unchanged (#3816, #3799, thanks @​sinangumuskabak-sys).
• Fix: Terraform secret redaction now also covers a secret-named variable default and output value — the secret's name lives in the block label, so the literal sat under the generic default/value key that the key-name check never flagged (variable "db_password" { default = "…" } reached graph.json verbatim). Redacted when the label names a secret or the block sets sensitive = true (#3817, #3644/#3762 follow-up, thanks @​breken-ai).
• Fix: fixed-format COBOL that carries a sequence NUMBER in columns 1-6 (not blanks) is now detected as fixed-format — previously it was misread as free-format, the sequence digits stayed in the code, and every paragraph and PERFORM edge was silently dropped, leaving only the file and program nodes (#3813, thanks @​abhay-codes07).
• Fix: PERFORM A THRU/THROUGH Z now links both endpoints of the range, not just the entry paragraph, so the range-end no longer lacks an inbound calls edge; a dangling THRU target is skipped rather than fabricated (#3814, thanks @​abhay-codes07).
• Fix: GRAPH_REPORT.md's Knowledge Gaps section only offers "undocumented components" as an explanation for an isolated node when the graph actually has a semantic layer (a document/paper/image node an LLM extracted meaning from) — a code-only graph no longer lists a possibility it can never have (#3828, #3801, thanks @​ayushcodes10).

0.9.67 (2026-09-23)

• Fix: the PYTHONHASHSEED determinism pin (0.9.66) now re-execs via python -m graphify instead of replaying argv[0], fixing a Windows regression where update/extract/cluster-only/label failed to re-launch through the console-script .exe launcher (#3780, thanks @​ayushcodes10).
• Feature: PHP closures are now extracted — an anonymous function(){…}, an arrow fn()=>…, or a closure passed as an argument now produces a node and its inner calls are captured, in all positions including file scope. Route-definition closures get a semantic VERB /path name (composing nested group() prefixes); other closures get a stable per-scope ordinal (#3461, #3409, thanks @​nikhilsaxena04).
• Fix: absolute Python package imports (import pkg.sub, from pkg.sub import x) now resolve to the local package/module node within the scan root, reusing the canonical resolver (bounded walk, PEP 420 namespace handling); an ambiguous module name across scanned trees fails closed rather than binding arbitrarily (#3729, thanks @​Ha1baraA11).
• Fix: a package/module name collision (pkg/ package alongside a pkg.py module) no longer produces a phantom import cycle — the spurious provisional edge is retracted while genuine package-init and submodule edges are preserved (#3784, #3777, thanks @​hopstreax).
• Fix: Terraform secret redaction now also covers secrets nested inside list values (configs = [{ password = "…" }]), not just maps (#3762, #3644 follow-up, thanks @​abhay-codes07).
• Fix: export no longer rewrites unchanged wiki/Obsidian pages on every run — a page whose content is identical is left untouched (stable mtimes, clean git/Obsidian sync), while changed and new pages still write and orphaned pages are still swept (#3760, #3060, thanks @​abhay-codes07).

0.9.66 (2026-09-22)

• Feature: five new language extractors — COBOL (.cbl/.cob/.cobol/.cpy; programs, paragraphs, PERFORM/CALL/COPY, pure-regex, no new dependency) (#3713, thanks @​Abdul535), VB.NET (.vb; case-insensitive types/methods, Inherits/Implements/Handles) (#3717, thanks @​Abdul535), R (.r/.R; assignment-form function defs, library/source, S4/R6 classes) (#3715, thanks @​Abdul535), Solidity (.sol; contracts/interfaces/libraries, is inheritance, imports, modifiers) (#3716, thanks @​Abdul535), and Erlang (.erl/.hrl/.escript; modules, functions by arity, behaviours, local + remote foo:bar() calls) (#3714, thanks @​Abdul535). The R and Erlang grammars ship via the r/erlang extras (they have no standalone PyPI wheel); Solidity and VB.NET have their own extras.
• Feature: Go interface method requirements now resolve to the interface, and their parameter/return types emit references edges (#3672, #3737, thanks @​rajatnagda45, @​oleksii-tumanov).
• Feature: a Rust self.method() call resolves across files for simple generic impls (impl<T> Foo<T>) (#3653, thanks @​oleksii-tumanov).
• Fix: graph.json is now deterministic across runs — update/extract/cluster-only/label pin PYTHONHASHSEED via a one-time re-exec, so hash-seed-sensitive community detection (Leiden/Louvain) produces identical output run-to-run and matches hook-triggered rebuilds (#3743, #3641, thanks @​ayushcodes10).
• Fix: a same-relation edge collision now keeps the higher-confidence edge (EXTRACTED over INFERRED) instead of resolving by arrival order (#3711, thanks @​shobhitagnihotri69).

... (truncated)

Commits

• 4df8d4d release: 0.9.70
• e4a6f50 fix(watch): serialize _rebuild_lock on Windows via msvcrt
• e1d9dee security(fortran): strip #include directives before cpp (GHSA-pcc4-rvhr-2pr8)
• c66eebe fix(python): resolve nested scan-root imports via namespace projection (#3843)
• 1990b02 fix(extract): skip JSX member tags
• a3559c2 test: member JSX tag must not bind to a local function by its last segment
• 3a8db79 fix(extract): add calls edges for JSX component usage
• cd7aa6c test(csharp): verify user-defined tuple element types stay referenced (#3796)
• 3c407dc fix(csharp): don't collect tuple element names as type references (#3796)
• 286000d fix(skillgen): prevent INPUT_PATH shell injection
• Additional commits viewable in compare view

Updates graphifyy from 0.9.59 to 0.9.70

Release notes

Sourced from graphifyy's releases.

v0.9.70

• Security: the Fortran capital-F cpp step no longer allows an untrusted .F/.F90 source to read arbitrary host files. -nostdinc -I /dev/null did not stop cpp from resolving absolute (#include "/etc/passwd") or traversing (#include "../../../secret") includes, which inlined host-file contents into graph.json/GRAPH_REPORT.md and the LLM context on the default offline path. Every #include directive is now stripped before preprocessing and the source is fed to cpp on stdin; macro expansion is preserved (GHSA-pcc4-rvhr-2pr8, CWE-22/73/200).
• Security: the Aider/Devin monolith --watch snippet no longer interpolates the agent-substituted INPUT_PATH into a shell command — it now reads the trusted graphify-out/.graphify_root written in Step 1, closing the last instance of the shell-injection class from #3642 (#3852, #3844, thanks @​hopstreax).
• Security: Terraform secret redaction now also covers a value paired with a secret-named name in name/value pair lists (environment = [{ name = "DB_PASSWORD", value = "…" }], ECS valueFrom included), where the sensitive signal is the sibling name literal rather than a key (#3870, #3787, thanks @​breken-ai).
• Fix: graphify watch now serializes concurrent rebuilds on Windows via msvcrt byte-range locking instead of a no-op lock, closing a WinError 32 race between overlapping rebuilds; the POSIX fcntl path is unchanged (#3883, #3881, thanks @​harshaygadekar).
• Fix: C# type references no longer collect a named tuple's element names as type references ((int Count, string Name) recorded a bogus ref to Count/Name); only the element types are referenced (#3877, #3796, thanks @​KaiyiQuan).
• Feature: JSX component usage now produces calls edges — <MyButton/> and <_Row/> link to the component, while lowercase DOM tags (<div>) and member tags (<Nav.Item>) are conservatively skipped, so React component graphs capture render relationships (#3855, #3854, thanks @​sinangumuskabak-sys).
• Fix: absolute Python imports that spell the scan root's own nested namespace (from Company.Apps.Team.lib import x when the scan root is Team/) now resolve to the local module by projecting the namespace prefix onto the scan-root layout (#3867, #3843, thanks @​nikhilsaxena04).

v0.9.69

• Feature: five language extractors gained structural depth — OCaml classes now emit their methods (via the method relation) and instance variables (#3838, thanks @​rajatnagda45); Elixir defprotocol/defimpl are extracted as containers holding their functions, with a same-file implements link (#3839, thanks @​rajatnagda45); Fortran derived-type contains blocks link type-bound procedures to the type, resolving the => impl target (#3840, thanks @​rajatnagda45); Julia macro definitions and @enum types are extracted, including valued (red = 1) and typed (Color::UInt8) enum forms, with members using the case_of relation (#3841, thanks @​rajatnagda45); Kotlin annotations (class/function/property, use-site targets) and val/var primary-constructor properties now produce edges (#3848, #3842, thanks @​nikhilsaxena04).
• Fix: a TypeScript "solution" tsconfig.json that only carries references (no paths of its own) now resolves path aliases declared in the referenced project configs, so alias imports in a tsc -b layout no longer dangle (#3753, #3745, thanks @​abhay-codes07).
• Fix: extraction now skips the process pool up front when the spawn start method can't re-import __main__ (stdin, python -c, REPL, embedded callers), falling back to a correct sequential run instead of a wall of BrokenProcessPool tracebacks (#3754, #3669, thanks @​abhay-codes07).
• Fix: entity deduplication preserves a genuine pre-existing self-loop (a recursive call, a self-referential FK) while still dropping a self-loop newly created by a merge (#3825, thanks @​Abhirup0).
• Fix: ingest classifies a URL by its parsed host, not by text anywhere in the URL, so example.com/article-about-youtube is no longer mistaken for a YouTube link; subdomains and youtu.be still match, path-based extension detection is unchanged (#3831, thanks @​L4XB).
• Fix: graphify update on a destination outside the scan root no longer leaks a stat-index cache into the corpus — the incremental detection path now forwards cache_root like the fresh-scan path (#3850, #3847, thanks @​ayushcodes10).
• Fix: manifest duplicate-key collapse breaks ties by last-seen time instead of arbitrary iteration order, so a stale duplicate can no longer win and under-report changed files; also re-anchors foreign-platform absolute keys and normalizes ../. segments so more duplicates actually collapse (#3781, #1964, thanks @​ayushcodes10).
• Docs: a community-health and contributor-guide overhaul — new CONTRIBUTING.md, CODE_OF_CONDUCT.md, and RELEASING.md, refreshed issue/PR templates, and corrected factual drift in SECURITY.md (supported version, network/XSS boundaries), ARCHITECTURE.md (shared-state), and AGENTS.md (scoped-query workflow) (#3845, thanks @​nikhilsaxena04).

v0.9.68

• Security: the /graphify add ... --watch reference no longer passes the raw, agent-substituted INPUT_PATH placeholder unquoted into a shell command (… -m graphify.watch INPUT_PATH), where a scan root containing $(…), backticks, or ; could execute — a follow-on to the Step 1 fix. The watcher now reads the trusted graphify-out/.graphify_root that Step 1 resolves, so there is no path to substitute (#3742, #3642, thanks @​ayushcodes10). The identical placeholder still appears in the Aider/Devin monolith --watch snippet and is tracked separately.
• Fix: incremental updates (update/extract --code-only/watch) now preserve a cross-file imports/calls/uses edge whose target symbol lives in an unchanged file — the symbol-resolution facts pass widens its target index with the read-only resolution context, so re-extracting one file no longer silently drops its edges into the rest of the graph; a genuinely removed edge is still pruned (#3812, #3776, thanks @​hopstreax).
• Fix: C# type references (inherits/implements/parameter/return/base types) no longer resolve to a same-named non-type node — an enum member, property, field, or method sharing a type's name is excluded from the type-definition index, so a class inherits from the real base rather than a stray member; resolution of partial classes without a contains edge is restored (#3815, #3795, thanks @​hopstreax).
• Fix: dedup now keeps the node with a real source location over a richer but source-less one when merging duplicates, so a merged entity points at real code instead of an inferred/external stub; the loser's attributes are still folded onto the survivor (#3786, #3775, thanks @​ayushcodes10).
• Fix: Maven pom.xml ingestion resolves a dependency's inherited groupId/version from the local <parent> block and substitutes ${property} / ${project.*} placeholders (offline, one level), so previously-dangling depends_on edges now connect (#3823, #3806, thanks @​chiliec).
• Fix: the PYTHONHASHSEED re-exec (0.9.67) now waits for and propagates the child's exit code on Windows instead of returning early — os.execvpe is a true process replacement only on POSIX; on Windows it spawned a new process and let the parent race ahead unpinned, crashing update/extract/cluster-only/label. The Windows path now spawns via subprocess.run and exits with the child's status; the POSIX path is unchanged (#3816, #3799, thanks @​sinangumuskabak-sys).
• Fix: Terraform secret redaction now also covers a secret-named variable default and output value — the secret's name lives in the block label, so the literal sat under the generic default/value key that the key-name check never flagged (variable "db_password" { default = "…" } reached graph.json verbatim). Redacted when the label names a secret or the block sets sensitive = true (#3817, #3644/#3762 follow-up, thanks @​breken-ai).
• Fix: fixed-format COBOL that carries a sequence NUMBER in columns 1-6 (not blanks) is now detected as fixed-format — previously it was misread as free-format, the sequence digits stayed in the code, and every paragraph and PERFORM edge was silently dropped, leaving only the file and program nodes (#3813, thanks @​abhay-codes07).
• Fix: PERFORM A THRU/THROUGH Z now links both endpoints of the range, not just the entry paragraph, so the range-end no longer lacks an inbound calls edge; a dangling THRU target is skipped rather than fabricated (#3814, thanks @​abhay-codes07).
• Fix: GRAPH_REPORT.md's Knowledge Gaps section only offers "undocumented components" as an explanation for an isolated node when the graph actually has a semantic layer (a document/paper/image node an LLM extracted meaning from) — a code-only graph no longer lists a possibility it can never have (#3828, #3801, thanks @​ayushcodes10).

v0.9.67

• Fix: the PYTHONHASHSEED determinism pin (0.9.66) now re-execs via python -m graphify instead of replaying argv[0], fixing a Windows regression where update/extract/cluster-only/label failed to re-launch through the console-script .exe launcher (#3780, thanks @​ayushcodes10).
• Feature: PHP closures are now extracted — an anonymous <...

  Description has been truncated