Skip to content

deps(python): bump the python-minor-and-patch group with 2 updates - #204

Merged
bifrost0x merged 3 commits into
mainfrom
dependabot/pip/python-minor-and-patch-8910004276
Sep 8, 2026
Merged

deps(python): bump the python-minor-and-patch group with 2 updates#204
bifrost0x merged 3 commits into
mainfrom
dependabot/pip/python-minor-and-patch-8910004276

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-minor-and-patch group with 2 updates: graphifyy and authlib.

Updates graphifyy from 0.9.51 to 0.9.53

Release notes

Sourced from graphifyy's releases.

v0.9.53

  • Fix: a batch of cross-language inheritance-edge corrections (thanks @​Synvoya): JavaScript class X extends Y now emits an inherits edge (#1790); PHP interfaces, enums, and traits are captured as class-like nodes with their heritage (#1791); Scala trait declarations become class-like nodes (#1792) and qualified extends/with bases resolve to the tail type (#1794); a qualified Kotlin supertype resolves to its tail type instead of the package head (#1793); a C# interface extending an interface is classified as inherits, not implements (#1817); and a Go interface type-set constraint no longer emits a spurious embeds edge (#1818).
  • Feature: Robot Framework .robot/.resource files are now extracted (optional [robot] extra) — suites, test cases, user keywords, keyword-call edges, and resource/library imports, with case/space/underscore-insensitive keyword resolution (#3192, thanks @​nshiveg).
  • Fix: chat-template control tokens are now defanged by form (<|…|>, [INST]/[SYSTEM]) rather than an enumerated few, closing a prompt-injection gap for attacker-chosen tokens (e.g. <|eot_id|>); legitimate content is untouched (#3183, thanks @​abhay-codes07).
  • Fix: graphify watch/update now preserves an authored markdown link whose target node is still live under a different spelling, extending the #3190 reconcile without loosening the deleted-target gate (#3190, thanks @​logan683).
  • Fix: a semantic node is no longer silently dropped when a run did not actually re-extract the semantic tier — an unverified per-source shrink arms the shrink guard and re-queues the source next run (#3203, thanks @​hopstreax).
  • Fix: the git hook-guard now detects a search command only in an executed position, not when it merely appears in a comment or a quoted message, eliminating false read-nudges (#3121, thanks @​abhay-codes07).
  • Fix: graphify install now backs up a diverged SKILL.md before overwriting and prints an actionable warning, instead of silently clobbering user edits (#3144, thanks @​abhay-codes07).
  • Fix: the GRAPH_REPORT headline community counts now reconcile with what is actually rendered, and the knowledge-gaps threshold matches its own label (#3148, thanks @​abhay-codes07).
  • Fix: the wiki export now notes when a god-node relation group was truncated instead of silently showing a capped list (#3127, thanks @​abhay-codes07).

v0.9.52

  • Fix: graphify watch/update no longer silently drops a Markdown link to a semantic-backed document during a code-only rebuild — authored [[wikilink]] references are repointed onto the target file's representative node, preserving links to the semantic tier without resurrecting a deleted target (#3190, thanks @​logan683).
  • Fix: T-SQL routines that parse to tree-sitter ERROR nodes — CREATE OR ALTER, the PROC shorthand, and bracket-delimited names like [dbo].[Get Widgets] — are now recovered by name over a comment/string-masked copy, so they appear in the graph without commented-out or dynamic SQL fabricating nodes (#3164, thanks @​egarcia74).
  • Fix: graphify --help now lists the prs and provider commands and the export formats it actually supports (thanks @​SyedFahad7).
  • Fix: corrected the deepseek-v4-flash pricing entry and the build_merge docstring (which wrongly claimed it saved the graph; callers persist) (thanks @​adrianengkh).
  • Fix: Razor @inject/@using in .razor/.cshtml files now flow through the scope-aware C# type resolver, so an injected service type resolves to its cross-file definition; an external/undeclared type fabricates nothing (partially addresses #3187 — a bare inject of a file-scoped-namespace type still dangles, follow-up) (thanks @​hopstreax).
  • Fix: the MCP prs tools (list_prs, triage_prs, get_pr_impact) now surface a genuine failure as an MCP error (isError) instead of success text, while an empty-but-successful result is unaffected (thanks @​noQbot).
  • Fix: the MCP get_node tool now resolves a node through the same tiered resolver as get_neighbors, so the two agree deterministically instead of get_node returning an iteration-order substring match (thanks @​noQbot).
  • Fix: a graphify install --project (committed/shared) install now emits a bare graphify hook command resolved at run time instead of pinning the absolute interpreter path, so the committed hook no longer churns across machines; the global install still pins the absolute path (thanks @​davidbhoward).
  • Fix: a PHP new Foo() now emits a calls edge to the constructed class (namespaced names resolve to the last segment), completing the object-creation modeling across C# (#2998), TypeScript (#3135), and now PHP; dynamic (new $var()), self/static/parent, and unknown external constructions fabricate nothing (#3115, thanks @​abhay-codes07).
  • Fix: a method call through a field whose type is declared on an ancestor class now resolves from a subclass — the field-type lookup walks the inheritance chain (per-file for Java/C#, cross-file for Java/Objective-C), cycle-safe and without fabricating edges (#3151, thanks @​abhay-codes07).
  • Fix: the Objective-C field-to-type table is now re-keyed alongside the node-id rewrites, so self.field / obj.field method calls still resolve after graphify update normalizes ids (#3150, thanks @​abhay-codes07).
  • Fix: TypeScript type-only imports (import type { T } from './m') no longer manufacture false import cycles; the type-only edge is marked and excluded from cycle detection while a mixed import { type A, B } keeps its real value-import edge (#3123, thanks @​abhay-codes07).
  • Fix: an import(...) used as a call type-argument (f<typeof import('mod')>()) no longer causes declarations after it to be dropped; the construct is normalized before parsing with source locations preserved (#3185, thanks @​hopstreax).
Changelog

Sourced from graphifyy's changelog.

0.9.53 (2026-08-30)

  • Fix: a batch of cross-language inheritance-edge corrections (thanks @​Synvoya): JavaScript class X extends Y now emits an inherits edge (#1790); PHP interfaces, enums, and traits are captured as class-like nodes with their heritage (#1791); Scala trait declarations become class-like nodes (#1792) and qualified extends/with bases resolve to the tail type (#1794); a qualified Kotlin supertype resolves to its tail type instead of the package head (#1793); a C# interface extending an interface is classified as inherits, not implements (#1817); and a Go interface type-set constraint no longer emits a spurious embeds edge (#1818).
  • Feature: Robot Framework .robot/.resource files are now extracted (optional [robot] extra) — suites, test cases, user keywords, keyword-call edges, and resource/library imports, with case/space/underscore-insensitive keyword resolution (#3192, thanks @​nshiveg).
  • Fix: chat-template control tokens are now defanged by form (<|…|>, [INST]/[SYSTEM]) rather than an enumerated few, closing a prompt-injection gap for attacker-chosen tokens (e.g. <|eot_id|>); legitimate content is untouched (#3183, thanks @​abhay-codes07).
  • Fix: graphify watch/update now preserves an authored markdown link whose target node is still live under a different spelling, extending the #3190 reconcile without loosening the deleted-target gate (#3190, thanks @​logan683).
  • Fix: a semantic node is no longer silently dropped when a run did not actually re-extract the semantic tier — an unverified per-source shrink arms the shrink guard and re-queues the source next run (#3203, thanks @​hopstreax).
  • Fix: the git hook-guard now detects a search command only in an executed position, not when it merely appears in a comment or a quoted message, eliminating false read-nudges (#3121, thanks @​abhay-codes07).
  • Fix: graphify install now backs up a diverged SKILL.md before overwriting and prints an actionable warning, instead of silently clobbering user edits (#3144, thanks @​abhay-codes07).
  • Fix: the GRAPH_REPORT headline community counts now reconcile with what is actually rendered, and the knowledge-gaps threshold matches its own label (#3148, thanks @​abhay-codes07).
  • Fix: the wiki export now notes when a god-node relation group was truncated instead of silently showing a capped list (#3127, thanks @​abhay-codes07).

0.9.52 (2026-08-29)

  • Fix: graphify watch/update no longer silently drops a Markdown link to a semantic-backed document during a code-only rebuild — authored [[wikilink]] references are repointed onto the target file's representative node, preserving links to the semantic tier without resurrecting a deleted target (#3190, thanks @​logan683).
  • Fix: T-SQL routines that parse to tree-sitter ERROR nodes — CREATE OR ALTER, the PROC shorthand, and bracket-delimited names like [dbo].[Get Widgets] — are now recovered by name over a comment/string-masked copy, so they appear in the graph without commented-out or dynamic SQL fabricating nodes (#3164, thanks @​egarcia74).
  • Fix: graphify --help now lists the prs and provider commands and the export formats it actually supports (thanks @​SyedFahad7).
  • Fix: corrected the deepseek-v4-flash pricing entry and the build_merge docstring (which wrongly claimed it saved the graph; callers persist) (thanks @​adrianengkh).
  • Fix: Razor @inject/@using in .razor/.cshtml files now flow through the scope-aware C# type resolver, so an injected service type resolves to its cross-file definition; an external/undeclared type fabricates nothing (partially addresses #3187 — a bare inject of a file-scoped-namespace type still dangles, follow-up) (thanks @​hopstreax).
  • Fix: the MCP prs tools (list_prs, triage_prs, get_pr_impact) now surface a genuine failure as an MCP error (isError) instead of success text, while an empty-but-successful result is unaffected (thanks @​noQbot).
  • Fix: the MCP get_node tool now resolves a node through the same tiered resolver as get_neighbors, so the two agree deterministically instead of get_node returning an iteration-order substring match (thanks @​noQbot).
  • Fix: a graphify install --project (committed/shared) install now emits a bare graphify hook command resolved at run time instead of pinning the absolute interpreter path, so the committed hook no longer churns across machines; the global install still pins the absolute path (thanks @​davidbhoward).
  • Fix: a PHP new Foo() now emits a calls edge to the constructed class (namespaced names resolve to the last segment), completing the object-creation modeling across C# (#2998), TypeScript (#3135), and now PHP; dynamic (new $var()), self/static/parent, and unknown external constructions fabricate nothing (#3115, thanks @​abhay-codes07).
  • Fix: a method call through a field whose type is declared on an ancestor class now resolves from a subclass — the field-type lookup walks the inheritance chain (per-file for Java/C#, cross-file for Java/Objective-C), cycle-safe and without fabricating edges (#3151, thanks @​abhay-codes07).
  • Fix: the Objective-C field-to-type table is now re-keyed alongside the node-id rewrites, so self.field / obj.field method calls still resolve after graphify update normalizes ids (#3150, thanks @​abhay-codes07).
  • Fix: TypeScript type-only imports (import type { T } from './m') no longer manufacture false import cycles; the type-only edge is marked and excluded from cycle detection while a mixed import { type A, B } keeps its real value-import edge (#3123, thanks @​abhay-codes07).
  • Fix: an import(...) used as a call type-argument (f<typeof import('mod')>()) no longer causes declarations after it to be dropped; the construct is normalized before parsing with source locations preserved (#3185, thanks @​hopstreax).
Commits
  • 33362d9 chore: bump to 0.9.53
  • e7a22ee docs(changelog): add the @​Synvoya cross-language heritage-edge batch to 0.9.53
  • 588dc04 fix(go): don't emit embeds for interface type-set constraints (#1818)
  • 9aeade7 fix(csharp): classify an interface base as inherits, not implements (#1817)
  • c361189 fix(kotlin): resolve a qualified supertype to its tail type name (#1793)
  • bf385a5 fix(scala): normalize qualified heritage names to the tail type (#1794)
  • 5a8a84d fix(scala): capture trait declarations as class-like nodes (#1792)
  • 88f5396 fix(php): capture interface/enum/trait heritage as class-like nodes (#1791)
  • 6b2dfa0 fix(extract): emit inherits edge for JavaScript class extends (#1790)
  • b27f219 chore(lock): sync uv.lock for the robot extra (#3192)
  • Additional commits viewable in compare view

Updates authlib from 1.7.2 to 1.8.0

Release notes

Sourced from authlib's releases.

v1.8.0

What's Changed

New Contributors

Full Changelog: authlib/authlib@v1.7.2...v1.8.0

Commits
  • 1a86748 chore: release 1.8.0
  • e4fb941 Merge pull request #923 from authlib/fix-921
  • 9f2cd2e Merge pull request #922 from authlib/fix-902
  • 5d53239 fix(oidc): omit claims when the value is None
  • 772bc72 Merge pull request #919 from RavSinghChandan/fix-oauth1-insecure-transport-de...
  • 11794b0 Merge pull request #908 from arpitjain099/chore/device-cred-authenticated-cli...
  • 13f2eb0 fix(client): Added client_id parameter to AssertionClient (#476)
  • dde5b7a fix(client): rollback
  • e4aec8c fix(client): remove default= keyword from starlette client config.get calls (...
  • 62f41cc fix(client): httpx oauth1 binary form data (#779)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps(python): bump the python-minor-and-patch group with 2 updates
8245c6e 
Bumps the python-minor-and-patch group with 2 updates: [graphifyy](https://github.com/Graphify-Labs/graphify) and [authlib](https://github.com/authlib/authlib).


Updates `graphifyy` from 0.9.51 to 0.9.53
- [Release notes](https://github.com/Graphify-Labs/graphify/releases)
- [Changelog](https://github.com/Graphify-Labs/graphify/blob/v8/CHANGELOG.md)
- [Commits](Graphify-Labs/graphify@v0.9.51...v0.9.53)

Updates `authlib` from 1.7.2 to 1.8.0
- [Release notes](https://github.com/authlib/authlib/releases)
- [Commits](authlib/authlib@v1.7.2...v1.8.0)

---
updated-dependencies:
- dependency-name: graphifyy
  dependency-version: 0.9.53
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: authlib
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Sep 7, 2026
@bifrost0x
bifrost0x merged commit 3717f12 into main Sep 8, 2026
20 of 21 checks passed
@bifrost0x
bifrost0x deleted the dependabot/pip/python-minor-and-patch-8910004276 branch September 8, 2026 08:07
@github-project-automation github-project-automation Bot moved this from Backlog to Done in WebSSH Roadmap Sep 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

WebSSH Roadmap
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@bifrost0x