Skip to content

v1.4.7

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Oct 17:48
· 26 commits to main since this release
v1.4.7
62bc713

Release Notes 1.4.7

Released: 2026-10-08

A performance and hardening release. The graph page's cold proof drops from roughly 25s to 12s on a 12K-entity graph by proving each node once and decoding SurrealDB responses in C, Next.js moves to 16.3.8 to clear a high-severity SSRF advisory, and the docs site finally renders a real social card when links are shared.

Highlights

Graph page cold proof roughly 2x faster

The cold proof on a real 12K-entity graph goes from about 25s to 12s with an identical proven set. The old path burned 87% of its time in Python CPU on the API's event loop: it ran the full entity availability proof three times over the same rows and decoded every response with the SurrealDB SDK's pure-Python CBOR decoder.

Nodes proved once, then reused by the edge proof

available_graph_view in graph_view_availability.py now proves its nodes first and passes them to available_graph_relationships through a new proven_endpoints argument. The edge proof compares each snapshot against those rows instead of re-proving endpoints, and decodes each snapshot row once regardless of how many edges share it. The semantics of the proof are unchanged: an edge whose endpoint moved after the node proof is still dropped, the final capture still drops anything that changed afterwards, and the #770 malformed-edge test still reaches the final capture's ValidationError branch.

C-backed CBOR decoding for SurrealDB responses

New sibyl_core/backends/surreal/fast_cbor.py routes the SDK's decode through cbor2's C build while keeping the SDK's own tag decoder, thawing frozen tag contents back to lists and dicts so values match byte for byte. Real frames and 20,000 fuzzed frames decode identically, 2.2x faster. Installation via install_fast_cbor() is explicit and idempotent, and is a no-op when a C build of cbor2 is not present, so the SDK keeps its own decoder.

Next.js 16.3.8 closes a high-severity SSRF

apps/web pinned Next.js 16.3.6, which is affected by GHSA-cjq9-62q9-8jv4, a server-side request forgery in image optimization present in 16.0.0 through 16.3.7. The pin moves to 16.3.8; CI's shipped-dependency audit, which failed on every change while the old pin stood, passes again.

Performance

  • available_graph_relationships accepts proven_endpoints: Mapping[str, Entity] | None and raises ValueError when both proven_endpoints and a read memo are supplied, since the two settle the same rows twice.
  • Endpoint comparison moved into a shared endpoint_evidence helper that excludes embedding (vectors are storage, not evidence) and memoizes evidence per endpoint across a snapshot.
  • install_fast_cbor() is wired into install_core_runtime_ports() in apps/api/src/sibyl/core_runtime_ports.py, so the API and worker both pick it up.
  • Compact datetime and duration tags skip the thaw path: the SDK only indexes their two numbers, and they dominate tag volume in a response.

Dependencies

  • cbor2>=6.1.5,<7 added to apps/api dependencies (a sibyld dependency only) and to the sibyl-core dev group. The cap keeps the build below cbor2 7.
  • next moved from 16.3.6 to 16.3.8 in apps/web/package.json. The lockfile moves only next, its @next platform packages, and packages keyed on it.

Documentation Site

  • Added a 1200x630 social card at docs/public/og-image.png with absolute og:image and twitter:image URLs, explicit width, height, type, and alt text.
  • og:url is now emitted per page through transformPageData in docs/.vitepress/config.mts, since head tags cannot use VitePress base.
  • Site title and description updated to the current positioning: cross-agent memory for AI coding tools rather than knowledge graph plus task workflow.
  • Favicon switched to docs/public/favicon.png; the previous SVG reference 404'd.

Testing

  • New packages/python/sibyl-core/tests/test_fast_cbor.py checks that the C decoder returns exactly what the SDK's decoder does across record IDs, tables, decimals, durations, datetimes, UUIDs, ranges, and every geometry type, plus the raw tag forms the server sends. It also covers idempotent installation and the no-cbor2 fallback.
  • test_graph_view_availability.py gains coverage for the shared-endpoint path through a new _two_edges fixture helper.

Upgrade Notes

  • Version references bump to 1.4.7 across VERSION, apps/api, apps/cli, charts/sibyl, charts/surrealdb, docker-compose.quickstart.yml, the Ansible role defaults and compose file, and the deployment docs. Pull the 1.4.7 images or set SIBYL_IMAGE_TAG=1.4.7.
  • Helm users: charts/sibyl and charts/surrealdb are both at chart version 1.4.7; charts/surrealdb keeps appVersion 3.2.4.
  • Anyone calling available_graph_relationships directly must not pass both proven_endpoints and memo; the combination now raises ValueError.
  • No action is required to get the faster decode path. If cbor2 is unavailable or installed as a pure-Python build, the SDK decoder is used and behavior is unchanged.
  • Self-hosted web deployments should rebuild to pick up Next.js 16.3.8.

Install

Local server

curl -fsSL https://raw.githubusercontent.com/hyperb1iss/sibyl/main/install.sh | sh -s -- --version 1.4.7

Remote CLI

curl -fsSL https://raw.githubusercontent.com/hyperb1iss/sibyl/main/install.sh | sh -s -- --remote --version 1.4.7
sibyl init --remote https://sibyl.example.com
sibyl auth login

Homebrew

brew install hyperb1iss/tap/sibyl
sibyl up

Arch Linux (AUR)

paru -S sibyl
sibyl up

Headless server

curl -fsSL https://raw.githubusercontent.com/hyperb1iss/sibyl/main/install.sh | sh -s -- --version 1.4.7 --no-open

Kubernetes (Helm)

helm repo add sibyl https://raw.githubusercontent.com/hyperb1iss/sibyl/gh-pages
helm repo update sibyl
helm upgrade --install sibyl sibyl/sibyl --version 1.4.7

Artifacts

This release includes Python wheels and sdists, the generated
Homebrew formula, the generated AUR PKGBUILD, Helm charts, Docker
SBOMs, aggregate dual-registry cosign receipts, and a SHA256 checksum
manifest.

Assets 19
Loading