deps(python): bump the python-minor-and-patch group with 3 updates

[dependabot]

Bumps the python-minor-and-patch group with 3 updates: gunicorn, python-dotenv and graphifyy.

Updates gunicorn from 26.0.0 to 26.1.0

Release notes

Sourced from gunicorn's releases.

gunicorn 26.1.0

New Features

• Glob patterns in reload_extra_files: entries containing *, ? or [ are treated as patterns, so ui/*/config.json watches every view's config without listing them one by one. Patterns are re-expanded on every reload check rather than once at startup, so a file created later starts being watched without restarting gunicorn, and ** recurses. A pattern matching nothing warns instead of failing, since with live expansion it may match later (#1643, #3662).

Security

• Dependency floors raised past known advisories: every declared floor was checked against the advisory database. tornado, h2, setuptools and pymdown-extensions permitted vulnerable versions and now require the first clean release; pytest and httpx were unpinned and now carry floors. The tornado example pinned tornado<6, which was both the source of several advisories and older than the >=6.5.0 the tornado worker needs, so the example could not run as pinned.

Bug Fixes

• SIGHUP did not reload the logger configuration: Arbiter.reload() re-read the configuration file but kept using the logger built at startup, calling only reopen_files() on its existing handlers. Changes to logconfig, logconfig_dict, logconfig_json and loglevel were ignored until a full restart, which in containers meant replacing the pod. The existing logger now re-runs its setup on reload, so new handlers, formats and levels take effect while the process identity and its listeners are preserved, and re-running the setup no longer stacks duplicate syslog handlers. An invalid log configuration on reload is not fatal either: the error is reported on stderr, the previous working configuration is restored and the master keeps running with it (#3353).

• Truncated chunked bodies accepted: RFC 9112 section 7.1.2 ends a chunked body with 0 CRLF CRLF, the second CRLF being the mandatory empty trailer section. ChunkedReader.parse_chunk_size() swallowed the NoMoreData raised while scanning for it, so a body cut short right after the last chunk line was treated as complete instead of rejected. It now raises ChunkMissingTerminator (#3382, #3685).

• --spew crashed on dynamically generated code: the trace hook indexed the 2-tuple returned by inspect.getsourcelines() by line number rather than indexing the list of lines, so a frame with no __file__ raised AttributeError: 'int' object has no attribute 'rstrip' on line 1 and

... (truncated)

Commits

• 71b59a7 Merge pull request #3698 from benoitc/fix/docker-health-check-readerror
• 48287de test: catch every transport error in the docker health check
• 3110e8c Merge pull request #3696 from benoitc/docs/roadmap
• cc56c41 Merge pull request #3693 from benoitc/release/26.1.0
• 5cf1f16 docs: surface the roadmap on the site home page
• 7e35f72 docs: add FastCGI to the roadmap and point items at Ideas
• 18ddc58 docs: drop the framework and reverse-proxy non-goals from the roadmap
• 1ecae56 docs: add a roadmap and make the chat easy to find
• ca412e3 docs: sync the Latest changelog page with 26.1.0
• 640936f docs: note the dependency security work in 26.1.0
• Additional commits viewable in compare view

Updates python-dotenv from 1.2.2 to 1.2.3

Release notes

Sourced from python-dotenv's releases.

v1.2.3

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
• dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
• Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

Changelog

Sourced from python-dotenv's changelog.

[1.2.3] - 2026-08-16

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
• dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
• Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

Commits

• 49515af Bump version: 1.2.2 → 1.2.3
• 8ac846f chore: add release runbook (RELEASING.md) and make release target
• bb31c94 docs: add 1.2.3 release notes (#606, #638, #680)
• f7b18d9 fix: round-trip backslashes through set_key (#680)
• 751f8c1 ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions gro...
• f1937b6 chore(deps): update mkdocs-include-markdown-plugin requirement from >=6.0.0 t...
• 45b9372 chore(deps): update pytest requirement from >=3.9 to >=9.0.3 (#653)
• 72896e9 docs: fix broken mkdocs link in CONTRIBUTING.md (#636)
• 72754a1 ci(deps): bump peaceiris/actions-gh-pages from 4.0.0 to 4.1.0 in the github-a...
• 078325e ci(security): harden CI/CD supply chain with SHA pinning and least-privilege ...
• Additional commits viewable in compare view

Updates graphifyy from 0.9.42 to 0.9.48

Release notes

Sourced from graphifyy's releases.

v0.9.48

• Fix: a control character in a node label or id no longer aborts the whole export; the GraphML and Obsidian exporters scrub only the characters those formats forbid (tab, newline, and non-ASCII letters are preserved), and graph.json and its byte-identity round-trip are untouched (#2897, thanks @​abhay-codes07).
• Fix: graphify update / label / cluster-only no longer leave a large graph without a graph.html; the aggregated community view renders instead of raising, a failed render preserves the previous file, and a missing graph.html is regenerated on the no-change fast path without reclustering (#2853, thanks @​oleksii-tumanov).
• Feature: graphify extract --no-dedup skips the fuzzy near-duplicate merge on build and incremental merge, for operators who would rather keep distinct symbols that fuzzy-matched; exact-id uniqueness is unaffected and the flag arms the shrink guard so a surprising node drop is refused loudly (#2881, thanks @​rajarshidattapy).
• Fix: a response that parses but carries no symbols (a "hollow" reply) is now retried on the same chunk with backoff instead of being bisected like a truncated one, so an overwhelmed backend no longer wastes calls re-splitting a chunk it already answered emptily; on persistent hollow the files are marked partial and retried next run, and GRAPHIFY_MAX_RETRY_DEPTH=0 disables the hollow retry too so a chunk costs exactly one call (#2880, thanks @​rajarshidattapy).
• Fix: reasoning-first models that narrate before emitting JSON (or fence the answer) no longer have their chunk dropped; the parser recovers the JSON fragment from mixed text, preferring an object that carries the extraction keys so narration braces or a schema restatement cannot shadow the real answer, and gating on the sanitized content so a bare-string id sketch cannot either (#2882, thanks @​rajarshidattapy).
• Fix: a data-shaped JSON that the extractor deliberately declines is no longer counted as a failed extraction, so it is recorded in the incremental manifest and stops being re-processed on every run; genuine failures are still reported (#2879, thanks @​rajarshidattapy).
• Fix: C++ nested class/struct types and their members are now kept in the graph instead of being silently dropped, and C++/CLI sources (ref class, gcnew, ^/% handles) are normalized to plain C++ before parsing so tree-sitter no longer fabricates phantom symbols from the ERROR nodes it would otherwise produce (#2876, thanks @​rajarshidattapy).
• Fix: Obsidian-style [[wikilinks]] now resolve vault-wide by basename when sibling resolution misses, so cross-folder links are no longer silently lost; resolution stays deterministic on ambiguous basenames (shallowest then lexicographic path) and sibling matches keep priority (#2875, thanks @​BaeHyunJae).

v0.9.47

• Fix: extraction now bisects a file chunk on timeout instead of failing the whole chunk, so one slow file no longer drops its chunk-mates from the graph; recognized timeouts (subprocess, SDK, and botocore read/connect) route through the same bounded split-and-merge path as context-window-exceeded errors, and a single unsplittable file that times out is left unstamped and retried next run (#2866, thanks @​hopstreax).
• Fix: the cache no longer collapses symlinks when keying files, so a symlink alias and its target get distinct identities and one no longer displaces the other from the graph on a warm cache; the detect-layer containment guard that resolves paths to block symlink escape is unchanged (#2832, thanks @​oleksii-tumanov).
• Fix: graphify extract --out <dir> no longer writes converted Office/Google-Workspace sidecars back into the scanned source tree; sidecar writes go through the cache root while the content hash stays anchored to the scan root, so a read-only or pinned checkout stays clean (#2787, thanks @​hopstreax).
• Fix: the git-hook out-of-project read guard no longer misclassifies a rooted-but-driveless path (\foo\bar) as cwd-relative on Windows, where such a path resolves against the current drive root and is actually outside the project; POSIX behaviour is unchanged (#2795, thanks @​abhay-codes07).
• Fix: the partial-parse warning no longer ends with a hardcoded citation to the closed Kotlin-specific issue #2551 (which misdirected reporters of unrelated failures); it now reports the surviving symbol count so a total-loss file reads differently from a partially-recovered one (#2788, thanks @​abhay-codes07).
• Fix: Obsidian export now keeps non-ASCII letters (Hangul, CJK, Cyrillic, accented Latin) in community tags instead of collapsing every non-Latin community to the same underscore tag, and the graph-view colour groups query the identical tag so colours match again (#2862, thanks @​josh-leung-KR).
• Feature: JavaScript/TypeScript factory functions that assign callable members to a local object literal (const api = {}; api.foo = fn) now keep those members in the graph — the API object is modeled beneath its factory and the assigned functions attach as methods, including arrow-function assignments and their intra-factory call edges. The owner is minted only for identifiers proven to be object-literal bindings in the enclosing function, so arbitrary receivers do not reintroduce the phantom-owner flood, and the factory's contains edge is emitted once no matter how many methods hang off the object (#2745, thanks @​rajanpanth).
• Fix: graph.json field order is now stable across a read-rebuild round-trip, so re-running graphify update on an unchanged graph produces a byte-identical file instead of reshuffling node and link keys (#2582, thanks @​C0KERNEL).
• Fix: graphify query now names the graph it opened and its node count at the head of the answer (relative to the CWD when the graph is underneath it, absolute otherwise), so a query run from a parent project no longer silently answers from the wrong corpus with no indication which graph was used (#2789, thanks @​abhay-codes07).
• Fix: the claude backend no longer crashes with AttributeError: 'ThinkingBlock' when an extended-thinking response leads with a thinking block; the first text block is read instead (#2697, thanks @​mdshzb04).
• Fix: graphify update / save_manifest no longer rewrites manifest.json timestamps on a no-op run, so graphify-out/ stops showing as dirty (and stops producing a trailing graph commit) when nothing changed; a genuine change still updates and persists (#2838, thanks @​hopstreax).
• Fix: a C# 12 primary constructor's parameters are now walked, so class Svc(IRepo repo) emits the references edge to IRepo and calls through repo resolve — previously the class silently dropped its dependency; built-in and type-parameter types are not fabricated (#2829, thanks @​brobl2008).
• Fix: AST-derived INFERRED edges now carry a rubric confidence_score keyed to the relation (uses 0.95, indirect_call/unresolved cross-file calls 0.85) instead of landing at the rubric-forbidden 0.5 or a flat 0.8; the INFERRED default moves 0.5→0.55 so every score-less INFERRED edge is on the discrete rubric set (#2813, thanks @​abhay-codes07).
• Fix: a legacy graph.json that stored a numeric edge confidence (from a pre-enum version) no longer warns once per edge on every incremental reload; the numeric value is normalized to the INFERRED tag with the original float preserved in confidence_score (thanks @​Trantor-develops).

v0.9.46

0.9.46

• Fix: node-id normalization is now caseless-stable for combining-mark sequences — casefold and NFKC don't commute, so a single pass left normalize_id(s) != normalize_id(s.casefold()) for inputs like Greek ypogegrammeni followed by a combining accent; normalization now iterates casefold+NFKC to a fixpoint. Letter/digit-bearing ids are unchanged, so existing graphs are not re-keyed.
• Fix: Java annotations now emit references edges to their type — including class-literal arguments (@Repeatable(Foo.class), @Uses({A.class, B.class})) and annotation-member return types — so a container annotation is no longer a disconnected island; string/enum arguments are not mistaken for type references (#2426, thanks @​oleksii-tumanov).
• Fix: graphify query treats _ as a token separator (like -), so an underscore-spelled query (user_service) matches a hyphenated label (user-service); coverage-scaling keeps the broader tokenization from surfacing unrelated single-token noise (#2473, thanks @​nadiadatepe-eng).
• Fix: the post-checkout hook skips its rebuild when HEAD is unchanged (e.g. git checkout -b with no start point), so creating a branch no longer triggers a full graph rebuild (#2421, thanks @​nothariharan).
• Feature: Markdown nodes now carry a node_kind (page vs heading) attribute so a docs corpus can be filtered by kind, and leading YAML frontmatter is parsed onto the page node as bounded, sanitized attributes; a # comment inside frontmatter is no longer mis-extracted as a heading (thanks @​evanthomasgelders). Node ids are unchanged, so existing markdown graphs are not re-keyed.
• Feature: Common Lisp .lisp/.cl/.lsp/.asd extraction via tree-sitter-commonlisp (optional [commonlisp] extra) — packages, classes, functions, methods, generics, macros, variable definers, and same-file calls; opened/:used packages resolve cross-file (thanks @​fade).
• Fix: a graphify query whose node set fits the budget but whose edges push the total over now prints an honest "complete answer over budget" notice with the real size, instead of silently returning a payload several times the requested budget (and no longer advises raising the budget, which was the exact trigger); edges are still never dropped from a complete answer (#2784, thanks @​AromalBiju1).
• Fix: a .gitignore/.graphifyignore saved in a non-UTF-8 encoding no longer silently drops its rules (which let an explicitly-excluded directory get scanned anyway); the file is decoded UTF-8-first, then by a UTF-16 BOM, then the host codepage/latin-1, so the rule survives intact with a warning instead of being truncated (#2798, thanks @​abhay-codes07).
• Fix: when node dedup merges two nodes, any hyperedge that listed the merged-away node as a member now rewires that member to the survivor instead of silently dropping it, so a grouping no longer loses participants on dedup (#2805, thanks @​abhay-codes07).
• Fix: pruning a source file now also sweeps the external-import placeholder nodes it strands at degree 0, instead of leaving them to accumulate in the node count, GRAPH_REPORT.md, and exports; genuinely-isolated real nodes (which carry a source_file) are never touched (#2807, thanks @​abhay-codes07).
• Fix: when two edges connect the same node pair with different relations, the graph builder now keeps the more specific relation (calls, imports, inherits, ...) instead of letting a generic references/uses/mentions overwrite it; previously a real calls could be downgraded to references and then dropped from the call graph (#2803, thanks @​abhay-codes07).

v0.9.45

0.9.45

• Fix: graphify install <platform> now advances the .graphify_version stamp only for the platform it actually (re)writes, instead of stamping every installed platform as current; a platform whose skill content was left untouched keeps its old stamp so its staleness warning stays truthful (#2694, thanks @​ousamabenyounes). This completes #2694 (the CLAUDE_CONFIG_DIR half shipped in 0.9.44).
• Fix: an incremental rebuild no longer collapses the whole graph when the .graphify_root marker records a subfolder while stored source_file paths are relative to the repo root; the marker is validated against the stored paths before it is trusted as their anchor, so a mismatched marker can't make every unchanged source look deleted (#2603, thanks @​catpotd). A genuinely deleted source is still evicted, and incremental ids stay identical to a cold build.
• Fix: a Go file that declares both an exported and an unexported symbol differing only by case (e.g. Run and run, which are distinct in Go's case-sensitive visibility rules) no longer collapses them onto one node id and drops one; the exported symbol keeps its stable id and the unexported one is disambiguated, so an intra-file call to the unexported symbol resolves locally instead of phantoming to another package (#2779, thanks @​catpotd). Only the Go extractor's id assignment is affected; the shared id normalization is unchanged, so no other language's ids move.
• Fix: loading a graph.json that contains a hyperedge with no id field (the semantic extractor emits them and they persist verbatim) no longer crashes the incremental re-extract with KeyError: 'id'; id-less hyperedges are tolerated and retained (#2775, thanks @​ousamabenyounes).

v0.9.44

... (truncated)

Changelog

Sourced from graphifyy's changelog.

0.9.48 (2026-08-20)

• Fix: a control character in a node label or id no longer aborts the whole export; the GraphML and Obsidian exporters scrub only the characters those formats forbid (tab, newline, and non-ASCII letters are preserved), and graph.json and its byte-identity round-trip are untouched (#2897, thanks @​abhay-codes07).
• Fix: graphify update / label / cluster-only no longer leave a large graph without a graph.html; the aggregated community view renders instead of raising, a failed render preserves the previous file, and a missing graph.html is regenerated on the no-change fast path without reclustering (#2853, thanks @​oleksii-tumanov).
• Feature: graphify extract --no-dedup skips the fuzzy near-duplicate merge on build and incremental merge, for operators who would rather keep distinct symbols that fuzzy-matched; exact-id uniqueness is unaffected and the flag arms the shrink guard so a surprising node drop is refused loudly (#2881, thanks @​rajarshidattapy).
• Fix: a response that parses but carries no symbols (a "hollow" reply) is now retried on the same chunk with backoff instead of being bisected like a truncated one, so an overwhelmed backend no longer wastes calls re-splitting a chunk it already answered emptily; on persistent hollow the files are marked partial and retried next run, and GRAPHIFY_MAX_RETRY_DEPTH=0 disables the hollow retry too so a chunk costs exactly one call (#2880, thanks @​rajarshidattapy).
• Fix: reasoning-first models that narrate before emitting JSON (or fence the answer) no longer have their chunk dropped; the parser recovers the JSON fragment from mixed text, preferring an object that carries the extraction keys so narration braces or a schema restatement cannot shadow the real answer, and gating on the sanitized content so a bare-string id sketch cannot either (#2882, thanks @​rajarshidattapy).
• Fix: a data-shaped JSON that the extractor deliberately declines is no longer counted as a failed extraction, so it is recorded in the incremental manifest and stops being re-processed on every run; genuine failures are still reported (#2879, thanks @​rajarshidattapy).
• Fix: C++ nested class/struct types and their members are now kept in the graph instead of being silently dropped, and C++/CLI sources (ref class, gcnew, ^/% handles) are normalized to plain C++ before parsing so tree-sitter no longer fabricates phantom symbols from the ERROR nodes it would otherwise produce (#2876, thanks @​rajarshidattapy).
• Fix: Obsidian-style [[wikilinks]] now resolve vault-wide by basename when sibling resolution misses, so cross-folder links are no longer silently lost; resolution stays deterministic on ambiguous basenames (shallowest then lexicographic path) and sibling matches keep priority (#2875, thanks @​BaeHyunJae).

0.9.47 (2026-08-19)

• Fix: extraction now bisects a file chunk on timeout instead of failing the whole chunk, so one slow file no longer drops its chunk-mates from the graph; recognized timeouts (subprocess, SDK, and botocore read/connect) route through the same bounded split-and-merge path as context-window-exceeded errors, and a single unsplittable file that times out is left unstamped and retried next run (#2866, thanks @​hopstreax).
• Fix: the cache no longer collapses symlinks when keying files, so a symlink alias and its target get distinct identities and one no longer displaces the other from the graph on a warm cache; the detect-layer containment guard that resolves paths to block symlink escape is unchanged (#2832, thanks @​oleksii-tumanov).
• Fix: graphify extract --out <dir> no longer writes converted Office/Google-Workspace sidecars back into the scanned source tree; sidecar writes go through the cache root while the content hash stays anchored to the scan root, so a read-only or pinned checkout stays clean (#2787, thanks @​hopstreax).
• Fix: the git-hook out-of-project read guard no longer misclassifies a rooted-but-driveless path (\foo\bar) as cwd-relative on Windows, where such a path resolves against the current drive root and is actually outside the project; POSIX behaviour is unchanged (#2795, thanks @​abhay-codes07).
• Fix: the partial-parse warning no longer ends with a hardcoded citation to the closed Kotlin-specific issue #2551 (which misdirected reporters of unrelated failures); it now reports the surviving symbol count so a total-loss file reads differently from a partially-recovered one (#2788, thanks @​abhay-codes07).
• Fix: Obsidian export now keeps non-ASCII letters (Hangul, CJK, Cyrillic, accented Latin) in community tags instead of collapsing every non-Latin community to the same underscore tag, and the graph-view colour groups query the identical tag so colours match again (#2862, thanks @​josh-leung-KR).
• Feature: JavaScript/TypeScript factory functions that assign callable members to a local object literal (const api = {}; api.foo = fn) now keep those members in the graph — the API object is modeled beneath its factory and the assigned functions attach as methods, including arrow-function assignments and their intra-factory call edges. The owner is minted only for identifiers proven to be object-literal bindings in the enclosing function, so arbitrary receivers do not reintroduce the phantom-owner flood, and the factory's contains edge is emitted once no matter how many methods hang off the object (#2745, thanks @​rajanpanth).
• Fix: graph.json field order is now stable across a read-rebuild round-trip, so re-running graphify update on an unchanged graph produces a byte-identical file instead of reshuffling node and link keys (#2582, thanks @​C0KERNEL).
• Fix: graphify query now names the graph it opened and its node count at the head of the answer (relative to the CWD when the graph is underneath it, absolute otherwise), so a query run from a parent project no longer silently answers from the wrong corpus with no indication which graph was used (#2789, thanks @​abhay-codes07).
• Fix: the claude backend no longer crashes with AttributeError: 'ThinkingBlock' when an extended-thinking response leads with a thinking block; the first text block is read instead (#2697, thanks @​mdshzb04).
• Fix: graphify update / save_manifest no longer rewrites manifest.json timestamps on a no-op run, so graphify-out/ stops showing as dirty (and stops producing a trailing graph commit) when nothing changed; a genuine change still updates and persists (#2838, thanks @​hopstreax).
• Fix: a C# 12 primary constructor's parameters are now walked, so class Svc(IRepo repo) emits the references edge to IRepo and calls through repo resolve — previously the class silently dropped its dependency; built-in and type-parameter types are not fabricated (#2829, thanks @​brobl2008).
• Fix: AST-derived INFERRED edges now carry a rubric confidence_score keyed to the relation (uses 0.95, indirect_call/unresolved cross-file calls 0.85) instead of landing at the rubric-forbidden 0.5 or a flat 0.8; the INFERRED default moves 0.5→0.55 so every score-less INFERRED edge is on the discrete rubric set (#2813, thanks @​abhay-codes07).
• Fix: a legacy graph.json that stored a numeric edge confidence (from a pre-enum version) no longer warns once per edge on every incremental reload; the numeric value is normalized to the INFERRED tag with the original float preserved in confidence_score (thanks @​Trantor-develops).

0.9.46 (2026-08-17)

• Fix: node-id normalization is now caseless-stable for combining-mark sequences — casefold and NFKC don't commute, so a single pass left normalize_id(s) != normalize_id(s.casefold()) for inputs like Greek ypogegrammeni followed by a combining accent; normalization now iterates casefold+NFKC to a fixpoint. Letter/digit-bearing ids are unchanged, so existing graphs are not re-keyed.

• Fix: Java annotations now emit references edges to their type — including class-literal arguments (@Repeatable(Foo.class), @Uses({A.class, B.class})) and annotation-member return types — so a container annotation is no longer a disconnected island; string/enum arguments are not mistaken for type references (#2426, thanks @​oleksii-tumanov).

• Fix: graphify query treats _ as a token separator (like -), so an underscore-spelled query (user_service) matches a hyphenated label (user-service); coverage-scaling keeps the broader tokenization from surfacing unrelated single-token noise (#2473, thanks @​nadiadatepe-eng).

• Fix: the post-checkout hook skips its rebuild when HEAD is unchanged (e.g. git checkout -b with no start point), so creating a branch no longer triggers a full graph rebuild (#2421, thanks @​nothariharan).

• Feature: Markdown nodes now carry a node_kind (page vs heading) attribute so a docs corpus can be filtered by kind, and leading YAML frontmatter is parsed onto the page node as bounded, sanitized attributes; a # comment inside frontmatter is no longer mis-extracted as a heading (thanks @​evanthomasgelders). Node ids are unchanged, so existing markdown graphs are not re-keyed.

• Feature: Common Lisp .lisp/.cl/.lsp/.asd extraction via tree-sitter-commonlisp (optional [commonlisp] extra) — packages, classes, functions, methods, generics, macros, variable definers, and same-file calls; opened/:used packages resolve cross-file (thanks @​fade).

• Fix: a graphify query whose node set fits the budget but whose edges push the total over now prints an honest "complete answer over budget" notice with the real size, instead of silently returning a payload several times the requested budget (and no longer advises raising the budget, which was the exact trigger); edges are still never dropped from a complete answer (#2784, thanks @​AromalBiju1).

• Fix: a .gitignore/.graphifyignore saved in a non-UTF-8 encoding no longer silently drops its rules (which let an explicitly-excluded directory get scanned anyway); the file is decoded UTF-8-first, then by a UTF-16 BOM, then the host codepage/latin-1, so the rule survives intact with a warning instead of being truncated (#2798, thanks @​abhay-codes07).

• Fix: when node dedup merges two nodes, any hyperedge that listed the merged-away node as a member now rewires that member to the survivor instead of silently dropping it, so a grouping no longer loses participants on dedup (#2805, thanks @​abhay-codes07).

• Fix: pruning a source file now also sweeps the external-import placeholder nodes it strands at degree 0, instead of leaving them to accumulate in the node count, GRAPH_REPORT.md, and exports; genuinely-isolated real nodes (which carry a source_file) are never touched (#2807, thanks @​abhay-codes07).

• Fix: when two edges connect the same node pair with different relations, the graph builder now keeps the more specific relation (calls, imports, inherits, ...) instead of letting a generic references/uses/mentions overwrite it; previously a real calls could be downgraded to references and then dropped from the call graph (#2803, thanks @​abhay-codes07).

0.9.45 (2026-08-16)

• Fix: graphify install <platform> now advances the .graphify_version stamp only for the platform it actually (re)writes, instead of stamping every installed platform as current; a platform whose skill content was left untouched keeps its old stamp so its staleness warning stays truthful (#2694, thanks @​ousamabenyounes). This completes #2694 (the CLAUDE_CONFIG_DIR half shipped in 0.9.44).
• Fix: an incremental rebuild no longer collapses the whole graph when the .graphify_root marker records a subfolder while stored source_file paths are relative to the repo root; the marker is validated against the stored paths before it is trusted as their anchor, so a mismatched marker can't make every unchanged source look deleted (#2603, thanks @​catpotd). A genuinely deleted source is still evicted, and incremental ids stay identical to a cold build.
• Fix: a Go file that declares both an exported and an unexported symbol differing only by case (e.g. Run and run, which are distinct in Go's case-sensitive visibility rules) no longer collapses them onto one node id and drops one; the exported symbol keeps its stable id and the unexported one is disambiguated, so an intra-file call to the unexported symbol resolves locally instead of phantoming to another package (#2779, thanks @​catpotd). Only the Go extractor's id assignment is affected; the shared id normalization is unchanged, so no other language's ids move.

... (truncated)

Commits

• b2cd362 chore: bump to 0.9.48
• 1c6cf4a docs(changelog): add 0.9.48 entries for #2897, #2853, #2881
• e16b01c test(extract): assert --no-dedup graph invariant, not just kwarg propagation ...
• eccc6cf feat(extract): add --no-dedup so incremental merges can skip fuzzy dedup (#2881)
• 05f90f1 fix(export): restore graph.html for large graphs (#2853)
• 917e331 fix(export): a control character in a label must not abort the export (#2897)
• b54a1f0 docs(changelog): open 0.9.48 with the hollow-response/parser/cpp/markdown batch
• 69e2c0d fix(llm): retry hollow responses instead of bisecting them (#2880)
• e8bef86 fix(llm): gate the reasoning-JSON winner on sanitized content, not raw value ...
• bce2c9b fix(llm): recover JSON from reasoning-first model replies (#2882)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions