build(deps): bump graphifyy from 0.9.70 to 0.9.85

[dependabot]

Bumps graphifyy from 0.9.70 to 0.9.85.

Release notes

Sourced from graphifyy's releases.

v0.9.85

A language-extraction and tooling batch: six extractor/exporter fixes picked from open issues, plus fourteen community pull requests.

• Fix: Julia functions with a where clause (long and short form) and parametric type definitions (struct Box{T}, abstract type Shape{T}, struct Sq{T} <: Shape{T}) are now extracted. The name sat inside a where_expression / parametrized_type_expression wrapper that the name lookup skipped, so the whole method/type was dropped; a declared type parameter (value::T) no longer leaks as a phantom field-type node (#4126, #4128).
• Fix: Fortran a named generic interface now gets a callable node and a dispatches_to edge to each listed module procedure, so a call to the generic name resolves instead of dangling; unnamed and operator/assignment interfaces are unaffected (#4141, #4142, thanks @​rajatnagda45).
• Fix: Elixir defdelegate is now extracted as a function definition, so the delegated function appears and same-module calls to it resolve (#4132).
• Fix: Scala 3 given ... with instance methods are scoped to the given instead of leaking to file scope (where they collided with the same-named trait type); an anonymous given Show[Int] with keeps its members under a synthesized name (#4130).
• Fix: graph.html a node label containing an unclosed <!-- then <script can no longer break out of the embedded data script and blank the page; every < in the embedded JSON is escaped (#4124).
• Fix: the incomplete-extraction message now explains a pure semantic omission (a smaller --token-budget is the lever) instead of always blaming truncation (#4101, #4280, thanks @​ayushcodes10).
• Fix: TypeScript export type * star re-exports no longer trip a spurious syntax-error flag that skewed the health report (#3942, #4303, thanks @​ayushcodes10).
• Fix: Rust a cross-file reference to a type with impl blocks in other files now binds to the single declaration instead of a sourceless stub, fail-closed (#4283, #4284, thanks @​Alin1233).
• Fix: distinct files that mint the same node id after the extension is dropped (x.py vs x.html) are kept as separate nodes instead of collapsing and losing one (#4281, #4282, thanks @​bitwizard25).
• Fix: the git hook now updates the graph for files whose names contain non-ASCII characters (core.quotePath=false plus C-quote decoding) (#4278, #4279, thanks @​smngvlkz).
• Fix: watch the rebuild lock no longer unlinks on release while a waiter holds it, closing a race that let two rebuilds run at once (POSIX) (#4273, #4277, thanks @​ayushcodes10).
• Fix: an unanchored ignore pattern is now matched against the entry name only (so * no longer crosses / and negations behave like git) (#4242, #4251, thanks @​Yyunozor).
• Fix: the hook-guard Read nudge now fires for PowerShell source files (.ps1/.psm1/.psd1) (#4271, #4272, thanks @​rtmalikian).
• Fix: the skill now tells you that graphify-out/ was written into your working tree, with how to gitignore or share it (#3941, #4308, thanks @​eoinforker).
• Fix: graphify affected <Symbol> now reaches callers through the symbol's defining file, so Dart/Flutter (and other file-module languages) return results instead of nothing (#4288, #4290, thanks @​dcaldr).
• Fix: an export default with a huge base64 literal plus a tsconfig baseUrl no longer crashes extraction with "File name too long" (#4166, #4169, thanks @​bastiennoel93).
• Fix: markdown links to a file name containing a space ([x](https://github.com/Graphify-Labs/graphify/blob/HEAD/<My Note.md>), [x](https://github.com/Graphify-Labs/graphify/blob/HEAD/My%20Note.md)) now resolve to a references edge (#4177, #4178, thanks @​Yyunozor).
• Perf: skip a per-call os.getcwd() in the path-memo key for absolute paths, and walk each JS/TS tree once when collecting symbol facts — both output-identical (#4301, #4302, thanks @​pishuv).

v0.9.84

A correctness batch picked directly from open issues, plus an OpenCode plugin fix.

• Fix: PowerShell functions (and classes/enums) defined inside a file-scope begin {} / process {} / end {} block are now extracted. These blocks parse as pseudo-commands rather than named blocks, so the walker returned before descending and dropped everything inside — the common [CmdletBinding()] advanced-function layout (#4270).
• Fix: R every backtick-quoted binding now gets a collision-free id. A partially-symbolic name like `%foo%` (or an S3 method `[.cls`, or a dotted `my.op`) normalized to the same id as an ordinary identifier and was silently dropped on merge; such names now use the reserved operator namespace (#4253). (The separate infinite-loop reported in that issue was already fixed in 0.9.83.)
• Fix: graphify path and the MCP shortest_path tool now fail closed on a file::symbol endpoint whose file defines no such symbol, instead of falling back to scoring the bare name and answering from a same-named symbol in another file; the refusal lists the files that do define it (#4264).
• Fix: OpenCode the plugin now loads on OpenCode 2 (a default export with setup()) while keeping the v1 server() hook, and graphify install refreshes an already-installed v1-only copy, so the graph tools appear again for users upgraded past the v1 plugin contract (#3554, #3732, thanks @​bercedev).
• Fix: Python a bare import logging is no longer captured by a loose same-named module (scripts/logging.py) in a non-package directory — it resolves to the stdlib module. Guarded by a vendored, deterministic stdlib-name set across the module resolver, the sibling-repoint pass, and the build-time stem-alias index; a deliberate package shadow (logging/__init__.py) still resolves (#4261).
• Fix: Python a qualified external annotation (httpx.Response) no longer binds to an unrelated private local class (_Response). The stub-rewire match key now preserves underscores, so _Response and Response are distinct identifiers (#4269).
• Fix: C# an external type the corpus references but never declares (List<T>, System.Type, Unity's VisualElement) now gets one shared, name-keyed placeholder instead of a separate per-file stub (a_cs_list, b_cs_list), so a query returns one node and the files sharing the type connect through it (#4247).
• Internal: added regression coverage locking in cross-module binding of a singly-defined type through re-export chains and the unique-stub rewire; the reported failure (#4262) no longer reproduces on this line.

v0.9.83

A C# resolution and determinism batch, plus Windows test-suite fixes.

• Fix: C# a generic and a non-generic type of the same name (Effect vs Effect<T>) now get distinct node ids (arity folded into the id), so they no longer collapse into one node and Effect<T> : Effect no longer produces an inherits self-loop (#4255, #4249, thanks @​ayushcodes10).
• Fix: C# a call through a member chain (a.b.C()), element access (xs[i].M()), or inside a constructor body now resolves to the right method, fail-closed to a single declared type per hop (collection element types only for T[]/List<T>), instead of being dropped (#4258, #4246, thanks @​Mpasha17).
• Fix: C# a bare call whose name matches an enum member (Delegate(t) next to a Delegate case) no longer binds to the enum member; case members are excluded from both the per-file and cross-file call-resolution maps, fail-closed (#4254, #4245, thanks @​ayushcodes10).
• Fix: C# a static factory that constructs its own type keeps its method membership edge — an undirected collapse previously let the reverse calls edge overwrite it, hiding the member from every type walk (#4256, #4248, thanks @​Mpasha17).
• Fix: an unqualified call in Java/C#/Scala/C++ binds to the method on the caller's own class chain (own class, then in-file bases, then enclosing classes) instead of the last same-named method declared anywhere in the file; fail-closed on a tie, with free functions and constructors still resolving (#4252, thanks @​Yyunozor).
• Fix: an unresolved re-export target id is now portable — it is minted in a dedicated namespace with a hash over the repo-relative path instead of the absolute checkout path, so a clone produces the same graph (#4257, thanks @​andan0).
• Fix: graphify's own skill runbook now reuses the persisted scan options (excludes and the gitignore flag) a prior build wrote, so a skill-driven update no longer drops opted-in files or re-adds explicitly excluded ones versus a CLI rebuild (#4250, #4240, thanks @​deepanshupal).
• Fix: the test suite passes on Windows — _atomic_replace refuses a read-only destination there instead of silently clobbering it (nt-only guard, no POSIX change), plus encoding, path-shape, and non-regular-file test guards (#4260, thanks @​SoloDrex52).
• Fix: C# nested types imported with using static now resolve (using static Demo.Layer; reaching Layer.Inner), fail-closed on ambiguity, complementing the enclosing-namespace resolution also in this release (#4235, #4216, thanks @​hopstreax).
• Fix: the AST cache directory is now namespaced by the installed tree-sitter grammar versions (...-g<fingerprint>), so upgrading a grammar within the same graphify release no longer serves stale or ABI-incompatible cached ASTs for unchanged files (#4239, #4236, thanks @​nothariharan).

... (truncated)

Changelog

Sourced from graphifyy's changelog.

0.9.85 (2026-10-10)

A language-extraction and tooling batch: six extractor/exporter fixes picked from open issues, plus fourteen community pull requests.

• Fix: Julia functions with a where clause (long and short form) and parametric type definitions (struct Box{T}, abstract type Shape{T}, struct Sq{T} <: Shape{T}) are now extracted. The name sat inside a where_expression / parametrized_type_expression wrapper that the name lookup skipped, so the whole method/type was dropped; a declared type parameter (value::T) no longer leaks as a phantom field-type node (#4126, #4128).
• Fix: Fortran a named generic interface now gets a callable node and a dispatches_to edge to each listed module procedure, so a call to the generic name resolves instead of dangling; unnamed and operator/assignment interfaces are unaffected (#4141, #4142, thanks @​rajatnagda45).
• Fix: Elixir defdelegate is now extracted as a function definition, so the delegated function appears and same-module calls to it resolve (#4132).
• Fix: Scala 3 given ... with instance methods are scoped to the given instead of leaking to file scope (where they collided with the same-named trait type); an anonymous given Show[Int] with keeps its members under a synthesized name (#4130).
• Fix: graph.html a node label containing an unclosed <!-- then <script can no longer break out of the embedded data script and blank the page; every < in the embedded JSON is escaped (#4124).
• Fix: the incomplete-extraction message now explains a pure semantic omission (a smaller --token-budget is the lever) instead of always blaming truncation (#4101, #4280, thanks @​ayushcodes10).
• Fix: TypeScript export type * star re-exports no longer trip a spurious syntax-error flag that skewed the health report (#3942, #4303, thanks @​ayushcodes10).
• Fix: Rust a cross-file reference to a type with impl blocks in other files now binds to the single declaration instead of a sourceless stub, fail-closed (#4283, #4284, thanks @​Alin1233).
• Fix: distinct files that mint the same node id after the extension is dropped (x.py vs x.html) are kept as separate nodes instead of collapsing and losing one (#4281, #4282, thanks @​bitwizard25).
• Fix: the git hook now updates the graph for files whose names contain non-ASCII characters (core.quotePath=false plus C-quote decoding) (#4278, #4279, thanks @​smngvlkz).
• Fix: watch the rebuild lock no longer unlinks on release while a waiter holds it, closing a race that let two rebuilds run at once (POSIX) (#4273, #4277, thanks @​ayushcodes10).
• Fix: an unanchored ignore pattern is now matched against the entry name only (so * no longer crosses / and negations behave like git) (#4242, #4251, thanks @​Yyunozor).
• Fix: the hook-guard Read nudge now fires for PowerShell source files (.ps1/.psm1/.psd1) (#4271, #4272, thanks @​rtmalikian).
• Fix: the skill now tells you that graphify-out/ was written into your working tree, with how to gitignore or share it (#3941, #4308, thanks @​eoinforker).
• Fix: graphify affected <Symbol> now reaches callers through the symbol's defining file, so Dart/Flutter (and other file-module languages) return results instead of nothing (#4288, #4290, thanks @​dcaldr).
• Fix: an export default with a huge base64 literal plus a tsconfig baseUrl no longer crashes extraction with "File name too long" (#4166, #4169, thanks @​bastiennoel93).
• Fix: markdown links to a file name containing a space ([x](https://github.com/Graphify-Labs/graphify/blob/v8/<My Note.md>), [x](https://github.com/Graphify-Labs/graphify/blob/v8/My%20Note.md)) now resolve to a references edge (#4177, #4178, thanks @​Yyunozor).
• Perf: skip a per-call os.getcwd() in the path-memo key for absolute paths, and walk each JS/TS tree once when collecting symbol facts — both output-identical (#4301, #4302, thanks @​pishuv).

0.9.84 (2026-10-10)

A correctness batch picked directly from open issues, plus an OpenCode plugin fix.

• Fix: PowerShell functions (and classes/enums) defined inside a file-scope begin {} / process {} / end {} block are now extracted. These blocks parse as pseudo-commands rather than named blocks, so the walker returned before descending and dropped everything inside — the common [CmdletBinding()] advanced-function layout (#4270).
• Fix: R every backtick-quoted binding now gets a collision-free id. A partially-symbolic name like `%foo%` (or an S3 method `[.cls`, or a dotted `my.op`) normalized to the same id as an ordinary identifier and was silently dropped on merge; such names now use the reserved operator namespace (#4253). (The separate infinite-loop reported in that issue was already fixed in 0.9.83.)
• Fix: graphify path and the MCP shortest_path tool now fail closed on a file::symbol endpoint whose file defines no such symbol, instead of falling back to scoring the bare name and answering from a same-named symbol in another file; the refusal lists the files that do define it (#4264).
• Fix: OpenCode the plugin now loads on OpenCode 2 (a default export with setup()) while keeping the v1 server() hook, and graphify install refreshes an already-installed v1-only copy, so the graph tools appear again for users upgraded past the v1 plugin contract (#3554, #3732, thanks @​bercedev).
• Fix: Python a bare import logging is no longer captured by a loose same-named module (scripts/logging.py) in a non-package directory — it resolves to the stdlib module. Guarded by a vendored, deterministic stdlib-name set across the module resolver, the sibling-repoint pass, and the build-time stem-alias index; a deliberate package shadow (logging/__init__.py) still resolves (#4261).
• Fix: Python a qualified external annotation (httpx.Response) no longer binds to an unrelated private local class (_Response). The stub-rewire match key now preserves underscores, so _Response and Response are distinct identifiers (#4269).
• Fix: C# an external type the corpus references but never declares (List<T>, System.Type, Unity's VisualElement) now gets one shared, name-keyed placeholder instead of a separate per-file stub (a_cs_list, b_cs_list), so a query returns one node and the files sharing the type connect through it (#4247).
• Fix: two files that differ only by extension (portal.py / portal.html) no longer collapse into one node. They derive the same extension-stripped id; the best-ranked file keeps it, the other gets an extension-qualified id (…_portal_html), and its edges follow it (matched by root-relative source_file, so absolute semantic paths work). A bare id shared across different paths still collapses with the warning (#4281).
• Internal: added regression coverage locking in cross-module binding of a singly-defined type through re-export chains and the unique-stub rewire; the reported failure (#4262) no longer reproduces on this line.

0.9.83 (2026-10-09)

A C# resolution and determinism batch, plus Windows test-suite fixes.

• Fix: C# a generic and a non-generic type of the same name (Effect vs Effect<T>) now get distinct node ids (arity folded into the id), so they no longer collapse into one node and Effect<T> : Effect no longer produces an inherits self-loop (#4255, #4249, thanks @​ayushcodes10).
• Fix: C# a call through a member chain (a.b.C()), element access (xs[i].M()), or inside a constructor body now resolves to the right method, fail-closed to a single declared type per hop (collection element types only for T[]/List<T>), instead of being dropped (#4258, #4246, thanks @​Mpasha17).
• Fix: C# a bare call whose name matches an enum member (Delegate(t) next to a Delegate case) no longer binds to the enum member; case members are excluded from both the per-file and cross-file call-resolution maps, fail-closed (#4254, #4245, thanks @​ayushcodes10).
• Fix: C# a static factory that constructs its own type keeps its method membership edge — an undirected collapse previously let the reverse calls edge overwrite it, hiding the member from every type walk (#4256, #4248, thanks @​Mpasha17).
• Fix: an unqualified call in Java/C#/Scala/C++ binds to the method on the caller's own class chain (own class, then in-file bases, then enclosing classes) instead of the last same-named method declared anywhere in the file; fail-closed on a tie, with free functions and constructors still resolving (#4252, thanks @​Yyunozor).
• Fix: an unresolved re-export target id is now portable — it is minted in a dedicated namespace with a hash over the repo-relative path instead of the absolute checkout path, so a clone produces the same graph (#4257, thanks @​andan0).
• Fix: graphify's own skill runbook now reuses the persisted scan options (excludes and the gitignore flag) a prior build wrote, so a skill-driven update no longer drops opted-in files or re-adds explicitly excluded ones versus a CLI rebuild (#4250, #4240, thanks @​deepanshupal).
• Fix: the test suite passes on Windows — _atomic_replace refuses a read-only destination there instead of silently clobbering it (nt-only guard, no POSIX change), plus encoding, path-shape, and non-regular-file test guards (#4260, thanks @​SoloDrex52).
• Fix: C# nested types imported with using static now resolve (using static Demo.Layer; reaching Layer.Inner), fail-closed on ambiguity, complementing the enclosing-namespace resolution also in this release (#4235, #4216, thanks @​hopstreax).

... (truncated)

Commits

• b4e6307 docs(changelog): correct 0.9.85 PR count (nine -> fourteen)
• 842ca78 docs(changelog): add #4290/#4169/#4178/#4301/#4302 and credit #4142 to 0.9.85
• d184e5d fix(extract): don't crash resolution on a huge export default literal (#4166)
• 74d784f perf(resolution): walk each JS/TS tree once when collecting symbol facts
• 16378b4 perf(resolution): skip os.getcwd() in the path-memo key for absolute paths
• 289e870 fix(affected): add defines to DEFAULT_AFFECTED_RELATIONS
• b28c2c5 fix(fortran): extract named generic interfaces as callable nodes
• a009ce7 revert(fortran): drop re-implementation of #4141 in favor of PR #4142
• 3f8260f release: 0.9.85
• 033b678 fix(extract): bind Rust stubs past impl blocks to the single declaration (#4283)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)