[dependabot]

Bumps the minor-and-patch group in /infra/smolvm with 3 updates: matplotlib, tree-sitter and graphifyy.

Updates matplotlib from 3.10.8 to 3.11.2

Release notes

Sourced from matplotlib's releases.

REL: v3.11.2

This is the second bugfix release of the 3.11.x series.

This release contains several bug-fixes and adjustments:

• Speed up RGBA-stage image resampling
• Fix hexbin clipping in PDF output
• Fix \text with internal braces
• Fix some crashes and make some checks more robust to unlikely cases
• Fix frame skew when saving GIF animations with PillowWriter
• Fix HiDPI handling in Qt toolbar and WebAgg embeddings
• Fix ResizeEvent handling for TextBox
• Fix bug with PGF hatch linewidth and color
• Fix a bug with drawing an empty Collection
• Fix incorrect glyphs in Cairo backends
• Improve build system to prevent conflicts between wheels and system libraries

REL: v3.11.1

This is the first bugfix release of the 3.11.x series.

This release contains several bug-fixes and adjustments:

• Fix tight layout of multiple subplots with sharey=True
• Fix NoNorm cursor formatting for uint8 images
• Fix occasional misalignment in reported mouse position (also fix a bug with canvas height)
• Fix clipped Axis labels on 3D plots with tight layout
• Fix inverted Axis on 3D plots
• Fix restoring 'auto' aspect in 3D axes after switching from 'equal'
• Fix missing glyphs when subsetting Type 1 fonts in PDF
• Fix oversized embedding of Type 42 fonts in PDF/PostScript files

As well as several documentation and typing improvements and corrections.

REL: v3.11.0

The largest change within this release is a complete overhaul of text and font processing. Through the use of libraqm, HarfBuzz, SheenBidi, and an updated release of FreeType, all text should now support modern font features, enabling full internationalization in all languages. Not all features of these libraries are supported yet, but we expect this work to enable further improvements in an easier manner.

Outside of text handling, there are several improvements to 3D Axes, performance, new accessible colour sequences, flexible figure management, and more. See the release notes for more information.

REL: v3.11.0rc2

This is the second release candidate for the meso release 3.11.0.

This release candidate fixes some problems with downstream packages, removes some missed deprecations, and corrects some additional minor bugs.

REL: v3.11.0rc1

After an extended development stretch, we are pleased to announce the first release candidate of Matplotlib 3.11.0.

The largest change within this release is a complete overhaul of text and font processing. Through the use of libraqm, HarfBuzz, SheenBidi, and an updated release of FreeType, all text should now support modern font features, enabling full internationalization in all languages. Not all features of these libraries are supported yet, but we expect this work to enable further improvements in an easier manner. Due to the update to the font rendering stack, we cannot guarantee that text will be bit-for-bit perfect with previous releases, so if you are using Matplotlib for testing, it may be necessary to introduce/raise a tolerance within your tests.

Outside of text handling, there are several improvements to 3D Axes, performance, new accessible colour sequences, flexible figure management, and more. Final release notes are still being curated, but you may browse the list of new features, API changes, and all issues/pull requests on the milestone.

... (truncated)

Commits

• d3ca917 REL: v3.11.2
• b76fea9 DOC: Set current version to 3.11.2
• 39c7f06 DOC: Prepare GitHub stats for 3.11.2
• 5dd13e3 Merge branch 'v3.11.1-doc' into release-3.11.2
• aa484be Merge branch 'v3.11.0-doc' into v3.11.1-doc
• 0e10f83 Merge pull request #32330 from meeseeksmachine/auto-backport-of-pr-32324-on-v...
• ebe947b Backport PR #32324: Don't force any diagnostics to be errors in bundled Harfbuzz
• 8f4b7c5 Merge pull request #32322 from meeseeksmachine/auto-backport-of-pr-32321-on-v...
• 93278ad Backport PR #32321: DOC: correct note about PyOS_InputHook
• b0aee78 Merge pull request #32319 from meeseeksmachine/auto-backport-of-pr-32305-on-v...
• Additional commits viewable in compare view

Updates tree-sitter from 0.25.2 to 0.26.0

Release notes

Sourced from tree-sitter's releases.

v0.26.0

Breaking changes are marked with !.

Additions:

• Point.edit()
• Point.__repr__()
• QueryCursor.set_containing_byte_range()
• QueryCursor.set_containing_point_range()
• Range.edit()
• tree_sitter.__version__

Removals:

• Language.version: use Language.abi_version !
• Language.query(source): use Query(language, source) !
• Parser.timeout_micros: use the progress_callback in parse() !
• QueryCursor.timeout_micros: use the progress_callback in matches() or captures() !

Changes:

• Point is a tuple subclass rather than a namedtuple object

Commits

• a9e753e ci(pypi): skip riscv64 tests properly
• eeababc chore: release 0.26.0
• dac834e fix(node): fix reference leak
• bdddb61 build: bump tree-sitter-rust from 0.24.1 to 0.24.2
• baa5fd8 ci: bump the actions group across 1 directory with 2 updates
• c680e3b build: bump tree_sitter/core from cd5b087 to 7f53486
• 2d3fb3a ci: bump actions/upload-pages-artifact from 4 to 5 in the actions group
• bae0829 build: bump tree-sitter-rust from 0.24.0 to 0.24.1
• d99f796 build: bump tree_sitter/core from 6f2e8a6 to cd5b087
• a9282df build: bump tree_sitter/core from cd4b6e2 to 6f2e8a6
• Additional commits viewable in compare view

Updates graphifyy from 0.9.32 to 0.9.103

Release notes

Sourced from graphifyy's releases.

graphify 0.9.103

A broad correctness, performance and robustness release across the extractors, resolution, hooks, the query and update paths, install and the skill runbook.

Extractors

• C#: preprocessor directives and #if branches that derail tree-sitter are blanked before parsing (byte-length preserving), so a directive no longer closes a class early and drops later members or calls.
• Solidity: library calls (Lib.f(), including aliased imports) and emit/revert/require naming a declared event or error now link to the member they name, gated to a unique visible type and member.
• YAML: a << merge sequence gives the earlier anchor precedence for a duplicated key, matching the spec and PyYAML.
• Markdown: a code span written as a backslash namespace (\Foo\Bar) or a type-qualified member (Type::member) resolves to the real node; a dotted mention whose method name is a language builtin is no longer dropped.
• Python: a bare builtin-named call (raise NotImplementedError(...)) no longer binds to a same-named class in another module unless imported.

Resolution

• A call inside a top-level def _main() is attributed to _main, not the public main it collides with after id normalization, without misattributing a class member's type reference.

Hooks

• A file unchanged in content is not re-flagged stale by mtime (the extraction hash is checked against the manifest).
• A dedicated Grep is held to the strict orientation gate; a Bash file read (cat/head/sed -n) of an in-project code file gets the read nudge; a search whose every target is outside the project emits no project hint; the nudge budget is restored after a Claude Code compaction; and the toplevel anchor keeps working when CDPATH is exported.

Performance

• Lower peak memory in load, resolution and extraction; a faster [#3252](https://github.com/Graphify-Labs/graphify/issues/3252) cross-file repoint; and the watch reconcile pass resolves AST ownership once per file instead of re-reading each header per node — all with identical graph output.

Update / build / cache

• graphify update re-extracts only the files whose content changed (identical to a full rebuild); a contended incremental request is recorded instead of dropped. The build write guard no longer counts intentional ghost/dedup folds as drops; cache keys keep their written case.

Query / tree

• Source nodes rank above tests and docs (a soft weight) with file-first answers; query reads query_budget/query_depth from .graphifyrc and gains --depth. export tree caps directory children while reporting full totals.

Install / thread-safety

• The Pi project skill is written to .pi/skills; uninstall removes the global skill registration it wrote. The ambient scan root is held in a ContextVar so concurrent library callers extracting different roots do not clobber each other.

The AST cache schema is bumped to 39; warm caches re-run the affected extractions.

Thanks to @​rohit-jsfreaky, @​Deepjyoti-Sarmah, @​xiongjianxu, @​nothariharan, @​andrebrait, @​ajbmachon, @​Shubham-Padkonde, @​madhusudanpatnaik, @​pei711, @​Mpasha17, @​ayushcodes10, @​gitmotion, @​briascoi, @​oleksii-tumanov, @​rohit-jsfreaky, @​viwe-monai, @​WyattAu, @​Vivek1898, @​wanjinhao1, @​PratikDhanave, @​HhH666-ux, @​sunhouy, @​mathewgeejo, @​jinsoo and @​AndresDiagoM.

graphify 0.9.102

A large correctness, performance and workflow release spanning the extractors, the query layer, incremental update, the hooks, the skill runbook and install.

Call-resolution (extractors)

• go: same-file member calls resolve through the receiver's type; cross-package pkg.T receivers bind only via the file's import; interface method calls dispatch to implicit implementers (#4966, #4853, #4934).
• rust: module-qualified calls (crate::b::helper()) resolve cross-file; calls inside expression-macro arguments are linked (#4944, #4945).
• kotlin: overloaded and init {}-block calls resolve; unreachable external-inherited calls are dropped (#4956).
• python: a module-level singleton's member calls resolve through its type; a bare method call no longer self-binds (#4972, #4933).
• js/ts: class extends through a CommonJS require resolves; a typed tagged template and an import("mod").T<X> annotation no longer half-parse or mint a false dynamic_import edge; default-exported object methods resolve (#4700, #4976, #4967).
• solidity: ../ imports resolve to the real file (#4985).
• cpp: receiver typing from params/fields, split-header owner binding, local-callable suppression, type-alias exact-spelling (#4946, #4920, #4921, #4951).

Query

• Source nodes rank above tests and docs (a soft weight, not exclusion), and answers are file-first (#4982).
• graphify query reads query_budget/query_depth from .graphifyrc and gains a --depth flag (#4760).

... (truncated)

Changelog

Sourced from graphifyy's changelog.

0.9.103 (2026-11-05)

• Fix: markdown a code span written as a backslash namespace (\Foo\Bar) or a type-qualified member (Type::member) is recognised as a symbol mention and resolves to the real node when one exists, instead of being silently dropped; an absent chain mints nothing (#4610, #4695, thanks @​viwe-monai).

• Fix: detect extract warns loudly when a large share of the corpus has no supported extractor (a 20-file floor and a 20% threshold), instead of only printing a bare unclassified count; a normal mixed project stays silent (#2942, #4646, thanks @​ayushcodes10).

• Fix: thread-safety the ambient scan root is held in a ContextVar instead of a module global, so concurrent library/async callers extracting different roots no longer clobber each other's root; the single-threaded CLI is unchanged (#4602, #4694, thanks @​WyattAu).

• Feat: tree graphify export tree caps how many children a directory lists (--max-children, default 200) while total_count still reports the full count, so a directory with thousands of entries no longer renders them all (#4766, #4768, thanks @​oleksii-tumanov).

• Fix: install the Pi project skill is written to .pi/skills, where Pi reads it, instead of a .pi/agent/skills path it never looks at; uninstall is symmetric (#5011, #5012, thanks @​Vivek1898).

• Internal: stage fake install bundles in a temp package root and fail loudly (not skip) on a wheel-build error, and serialise both wheel builders under a shared lock so concurrent runs on one checkout do not collide (#4603, #4664, thanks @​wanjinhao1); characterize _is_stale across changed/unchanged/vanished sources (#4996, thanks @​PratikDhanave); isolate the ambient venv/PATH in the _detect_run hook test (#4991, thanks @​HhH666-ux).

• Fix: solidity a library call (Lib.f(), including an aliased import) and an emit/revert/require naming a declared event or error now link to the member they name instead of producing no edge; resolution is gated to a single visible type whose unique name/arity member matches, so a builtin require or an ambiguous qualifier is left unresolved (#5001, #5005, thanks @​rohit-jsfreaky).

• Fix: csharp preprocessor directives and #if branches that derail tree-sitter are blanked before parsing (byte-length preserving, so line and column numbers do not move), so a directive no longer closes the enclosing class early and orphans later members or drops their calls; the first #if branch and distinct framework-fallback branches are kept (#5003, thanks @​rohit-jsfreaky).

• Fix: python a bare builtin-named call (raise NotImplementedError(...), list(...)) no longer binds to a same-named class in another module unless that caller imported the symbol; an imported homonym still resolves (#4989, #4999, thanks @​Deepjyoti-Sarmah).

• Fix: typescript a type-position import('mod') expression (a parameter/alias/typeof/generic-constraint annotation) no longer emits a spurious dynamic_import runtime edge; a real runtime import('mod') in the same file still does (#4992, #4998, thanks @​mathewgeejo).

• Fix: resolution a call inside a top-level def _main() is attributed to _main, not the public main it collides with after id normalization; the fix matches only the underscore-collision salt, so a class member's type reference is not misattributed to a sibling method (#4994, #4997, thanks @​sunhouy).

• Fix: yaml a << merge sequence gives the earlier anchor precedence for a duplicated key, matching the YAML merge spec and PyYAML, so the winning key carries its correct source line (#4995, thanks @​PratikDhanave).

• Fix: markdown a dotted mention whose method name is a language builtin (Repository.open) is no longer dropped; only a bare builtin name is skipped, and no spurious mention is minted (#4990, thanks @​PratikDhanave).

• Fix: hooks a Bash file read (cat, head, tail, sed -n, nl) of an in-project code file gets the same graph read-nudge a Read tool does (nudge-only, never a strict deny); writes, stdin, heredocs, docs and globs stay silent (#5010, thanks @​rohit-jsfreaky).

• Fix: hooks the once-per-session nudge budget is restored after a Claude Code compaction (a SessionStart with source=compact), so orientation can re-fire once the earlier nudges have left the model's context (#5008, thanks @​rohit-jsfreaky).

• Fix: hooks the toplevel-anchor logic keeps working when CDPATH is exported; an exported CDPATH was corrupting the relative .git capture and silently skipping the post-commit/checkout rebuild (#4977, #4988, thanks @​HhH666-ux).

• Perf: update the watch reconcile pass resolves AST ownership once per file instead of re-reading each header once per node, with identical graph output (#4978, #4986, thanks @​Deepjyoti-Sarmah).

• AST cache schema bumped to 39 for the C# (#5003), Solidity (#5001, #5005), YAML (#4995) and Markdown (#4695) extractor fixes; warm caches re-run the affected extractions.

0.9.102 (2026-11-03)

• Perf: update graphify update re-extracts only the files whose content changed since the last build (derived from the manifest inside the lock), instead of re-running the whole pipeline over the corpus for a single edit; the resulting graph is identical to a full rebuild, including cross-file edges from unchanged files into a changed one, and deletions (#4740, #4800, #4801, thanks @​Deepjyoti-Sarmah).
• Fix: watch a contended incremental rebuild request is recorded on its own queue marker instead of being dropped, so a derived-change request that loses the rebuild lock still runs on the next pass (#4800, #4802, thanks @​Deepjyoti-Sarmah).
• Fix: query source nodes are ranked above tests, docs and config in query results (a soft weight, not exclusion, so a term matched only by a test still seeds it and a question mentioning "tests" restores full weight), and the answer is rendered file-first (#4982, thanks @​rohit-jsfreaky).
• Feat: query graphify query reads project query_budget and query_depth defaults from .graphifyrc (explicit CLI flags still win), and gains a --depth N flag; a malformed setting warns and falls back to the built-in defaults (#1654, #4760, thanks @​oleksii-tumanov).
• Fix: install graphify uninstall removes the global # graphify skill registration it wrote into ~/.claude/CLAUDE.md, instead of leaving a dangling pointer to the deleted skill; a hand-written # graphify section or another tool's registration is preserved (#4975, thanks @​madhusudanpatnaik).
• Fix: js a class extends through a CommonJS require binding (const Base = require('./base'); class D extends Base {}) resolves the inherits edge to the required file's class, matching the ESM import path; an external/unresolved require is left alone (#4688, #4700, thanks @​Mpasha17).
• Fix: skill the --update runbook passes partial_source_files to the manifest write and clears a stale .graphify_partial.txt at the start of the run, so a doc whose chunk was only partly read is re-queued on the next update instead of being stamped done forever (#4807, #4814, #4816, thanks @​gitmotion).
• Fix: skill Step 4 threads force=IS_FORCE into to_json, so a --force rebuild actually overwrites past the #479 shrink guard the runbook told the user to use --force for (#4777, #4805, thanks @​pei711).
• Feat: skill for a hub/bridge question, the query workflow now tells the agent to grep the corpus for the hub's distinctive literals in edge-less files and report code that reimplements the hub instead of calling it (#4426, #4704, thanks @​ayushcodes10).
• Fix: hooks a file whose mtime is newer than graph.json but whose content is unchanged no longer weakens the strict read gate; the hook checks the file's extraction hash against the build manifest before declaring it stale, so a checkout that writes graph.json first does not force a re-read (#4974, thanks @​andrebrait).
• Fix: hooks a dedicated Grep call is held to the same once-per-session orientation gate as Read in strict mode; a directory Grep needs no index match, a single-file Grep is denied only when the graph indexes it, and external or graph-output targets stay silent without consuming the deny (#4973, thanks @​andrebrait).
• Fix: hooks a search whose every literal target is outside the project (a Bash grep/rg on a /tmp or sibling path) emits no project hint, so the graph nudge only fires for in-project searches (#4961, #4979, thanks @​Shubham-Padkonde).
• Perf: load graph.json rows are released as the graph is built (and repeated strings interned) so a load no longer holds both the parsed rows and the finished graph at peak, with identical output (#4960, thanks @​ajbmachon).
• Perf: resolve symbol resolution holds one parsed file at a time instead of retaining every parsed file across the JS and Python passes, collapsing them into a single per-file loop with unchanged edges (#4958, thanks @​ajbmachon).
• Perf: extract edge-dedup keys and per-file rows are released once consumed, cutting peak retention during extraction with identical output (#4959, thanks @​ajbmachon).
• Fix: typescript a typed tagged template (sql<{...}[]>`...`) and an import-qualified generic annotation (import("mod").T<X>) no longer leave the file half-parsed; the recovery runs only on files that already fail to parse, so a type-only import("mod").T stops minting a bogus module node and a false dynamic_import edge (#4976, thanks @​briascoi).
• Fix: go a same-file member call resolves through the receiver's type instead of a declaration-order-dependent same-named method; a bare package-function call no longer binds to a same-named method, and a package-level var fallback only applies to a genuinely unbound receiver (#4962, #4966, thanks @​xiongjianxu).
• Fix: go a member call on a receiver typed from another package (pkg.T, the usual shape of a dependency injected across packages) binds only to the T declared at the path the file imports pkg from, so two packages that both declare T are disambiguated by import evidence; an out-of-corpus qualifier stays unresolved (#3368, #4853, thanks @​nothariharan).
• Feat: go an interface method call additively dispatches to the interface's implicit implementers (method-set superset match, unexported methods scoped to the same directory, capped at 10 implementers and skipped past that), surfacing the concrete methods a call can reach while keeping the edge to the interface (#4934, thanks @​nothariharan).
• Fix: kotlin a call to an overloaded method resolves (Java gives every overload one node id, which the resolver mis-counted as ambiguous), calls inside an init {} block are attributed to the class, and a bare call no longer binds to a class the caller cannot reach through its type chain (#4935, #4956, thanks @​Deepjyoti-Sarmah).
• Fix: python a module-level singleton (g = Service() then g.method()) resolves its member calls through the instance's type, gated by an exact-spelling and lexical-shadow guard so rebinding, local shadowing or an ambiguous constructor leaves it unresolved (#4970, #4972, thanks @​Shubham-Padkonde).
• Fix: js a call through a default-exported object's method (import m from './x'; m.foo()) resolves to the static method, bound only on a single unambiguous target and suppressed by local shadowing, getters, spread or computed keys (#4963, #4967, thanks @​xiongjianxu).
• Fix: solidity an import "../x/Y.sol" resolves the .. to the real file instead of a dangling id that kept the importer's own folder (#4984, #4985, thanks @​rohit-jsfreaky).
• Fix: build the write guard no longer counts an intentional ghost fold (a #1145 same-file twin, #3344 doc-names-a-file, or #3705 method ghost folded into its surviving twin) as a dropped node on the build_merge path; a genuine drop whose survivor is also gone is still refused (#4955, #4957, thanks @​Deepjyoti-Sarmah).
• Fix: extract paths skipped by ignore rules are reported in the extract summary (bounded, sorted, root-relative, with a VCS-aware hint), surfacing the already-collected ignore list without changing the graph (#4965, #4969, thanks @​xiongjianxu).
• Perf: resolution the #3252 cross-file repoint indexes edges by source file instead of scanning every corpus edge per importing file, cutting resolution time on large graphs with no change to the resulting edges (#4980, #4981, thanks @​jinsoo).

... (truncated)

Commits

• 16218bf test(install): serialise the second wheel builder with an inline lock (#4603)
• c051a96 chore: bump AST cache schema to 39 for the markdown namespace/member mentions...
• 03838fe fix(markdown): recognise backslash namespaces and Type::member code-span ment...
• 17cf536 feat(tree): cap directory children while retaining full totals
• 79cfb37 test(install): serialise the second wheel builder under the shared lock (#4603)
• 63cf60d Fix #4603: stage fake install bundles in a temp package root, lock wheel builds
• 4c16a79 test(hooks): isolate ambient venv and PATH in _detect_run
• 892c452 test(reflect): characterize _is_stale across changed/unchanged/vanished sources
• d76b102 docs: note the context-local semantics for spawned workers
• e93821f fix: make the ambient scan root thread-isolated via ContextVar
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions