Semantica v0.6.6
Released: 2026-08-20
Tag: v0.6.6 · Compare: v0.6.5...v0.6.6 · PyPI: semantica 0.6.6
Highlights
Security release — upgrading is strongly recommended. Fixes for a privately disclosed batch of vulnerabilities spanning backup/restore, database export, outbound requests, and triplet-store backends, plus SSRF hardening across ingestion (tarball path traversal, SQL injection, DNS-rebinding TOCTOU, stored XSS, SPARQL injection, credential leakage across redirects, and more — see CHANGELOG.md for the full breakdown).
Also ships: first-class CrewAI integration, ContextGraph retraction and purge, a declared Semantica RDF vocabulary with deterministic entity/relationship IRIs, and timezone-aware timestamps across export/ and provenance/.
What's Changed
- #862 ·
918830a8· fix(pipeline): resolve broken import and missingrun()inPipelineWithProvenance· @Karunasagar12 - #857 ·
229cb69c· Added custom_filter_by_metadatafor each memory backend · @TaherTadpatri - #870 ·
22bf5810· fix(mcp): report package version · @oiahoon - #871 ·
9ec79598· Bump fastapi minimum version to fix PYSEC-2024-38 (starlette DoS) · @agu2347 - #873 ·
bc63e962· test(seed): use a real file for CSV loading · @nightcityblade - #929 ·
687a1807· fix(context): take the lock inContextGraph.to_dict()· @pravit-amp - #912 ·
c1154b6e· fix(security): header injection, link-prediction DoS, import ID sanitization · @Sunil56224972 - #878 ·
1a3dd503· docs(kg): documentGraphBuilderpublic methods · @cakeni - #941 ·
1ee3f2f2· fix(kg): alignGraphBuilderraw-text extraction defaults with the documented contract · @dex0shubham - #879 ·
b0080c36· fix(export): logDistanceExportermetric computation failures instead of swallowing them · @AmirF194 - #881 ·
18f1d55d· test(normalize): make optional tests deterministic · @aoright - #882 ·
0fa3483b· fix(context): clarifyget_node_propertynot-found contract (#877) · @ZohaibHassan16 - #960 ·
2cfb5de4· feat(export): add opt-inmetric_errorscolumn toDistanceExporter· @Karunasagar12 - #966 ·
7c3372c0· fix(explorer): align dev esbuild target · @le-czs - #905 ·
91d02a0f· fix(ingest): hardenRepoIngestorGitPython clone surface (#868) · @pravit-amp - #914 ·
43bac617· fix(vector_store): makeVectorManagermethods work on persistent backends (#855) · @yunaremaia - #928 ·
611874e6· security: apply SSRF guard to feed ingestion requests · @ZohaibHassan16 - #959 ·
c5d13a45· feat(seed):allow_private_ipsopt-in for trusted internal API sources · @yunaremaia - #908 ·
09c4b1b5· test(context): skip symlink test without Windows privilege · @ssynb - #976 ·
c0a05190· docs: update CONTRIBUTING.md · @eltociear - #978 ·
94d0c3dc· fix(kg): remap relationship endpoints after entity resolution · @T1mn - #932 ·
1c0cebb1· security(context): harden Markdown import against TOCTOU symlink races · @lakshanmuruganandam - #935 ·
80b1cca0· test(semantic_extract): guard openai-dependent tests and assert on the logger, not stdout · @dex0shubham - #980 ·
75f88b1c· Fix/explorer backend failure states · @ZohaibHassan16 - #984 ·
5bc09a5f· refactor(explorer): remove dead graph workspace shell · @lakshayxi - #979 ·
80b9bea0· fix(ingest): lock the repo host DNS resolve cache against concurrent mutation · @manjunathbhaskar - #983 ·
8a4ebafb· fix(context): honor explicit causal edges in decision tracing · @hsd2514 - #945 ·
4513b61e· ci: pin Python dependencies inrequirements-ci.txtfor reproducible CI · @yunaremaia - #986 ·
42afc060· ci: refreshgithub/codeql-actionpin to current v4 · @ZohaibHassan16 - #987 ·
c1be6dd7· docs: fix dead allcontributors emoji-key link · @yzxcj797 - #886 ·
557e29ee· fix(explorer): repair/api/enrich/extract(always 503) and the/api/decisionsroutes (always 500) · @joseedson18jc - #1000 ·
b8175ea8· fix(kg): make k-shortest path search side-effect free · @T1mn - #926 ·
84ce3c51· fix(context): makeContextGraph.add_edgeidempotent by deduping onedge_id· @pravit-amp - #951 ·
6df97cf0· fix(triplet_store): stop CONSTRUCT detection matching inside a leading comment · @pravit-amp - #957 ·
f1e7e64a· feat(context): add retraction and purge toContextGraph· @pravit-amp - #995 ·
8639cb9f· fix(seed): pass connection string toDBIngestorand stop mislabelingOSErrorinload_from_database· @yzxcj797 - #1003 ·
115e7965· fix(explorer): gate temporal requests on graph load · @lakshayxi - #958 ·
55798512· fix(export): harden YAML export input handling · @pravit-amp - #988 ·
d94d8f6a· Feat/crewai integration · @Shindevrp - #1011 ·
8177d887· fix(kg): preserve isolated nodes in graph analytics · @T1mn - #1016 ·
15171fd3· fix(parse): importget_progress_trackerinExcelParser· @pravit-amp - #1030 ·
c53ca4e8· docs: formalize issue assignment and duplicate-PR triage workflow · @KaifAhmad1 - #940 ·
70aa9d01· fix(normalize): validate symbol currencies · @Mr-Neutr0n - #1033 ·
6416fbb6· docs: clarify explainability is system-level, not foundation-model internal · @KaifAhmad1 - #1034 ·
4d379200· docs: surface explainability scope note near the top of the README · @KaifAhmad1 - #1042 ·
d4cb14c1· perf(split): avoid repeated spaCy model loading in split/chunking paths · @Accute9 - #1062 ·
eedf1425· Fixflatten_dictkey collisions · @shahzaib-ahmadcs - #1067 ·
04602a0e· fix(security): prevent Authorization header leakage across redirects (#947) · @Sameer6305 - #1056 ·
baf8f01f· test(export): guard Parquet tests on pyarrow itself, not the exporter import · @dex0shubham - #921 ·
5c2901ae· docs(context): fix unrunnableContextGraphdocstring example · @pravit-amp - #1079 ·
488e3812· fix(security): address privately disclosed zip-slip, SQLi, SSRF, XSS, and SPARQLi findings · @KaifAhmad1 - #1026 ·
17d878cb· fix(kg): honor exact entity resolution · @T1mn - #1081 ·
a1194a15· feat(context): addto_kg_dict()adapter for canonical KG shape · @cxzg007 - #1013 ·
7db2e2f4· fix(explorer): enable edge label rendering on the graph canvas · @yzxcj797 - #1040 ·
e6b159e5· docs(explorer): update stale authentication notes after v0.6.5 · @Kyou12138 - #1094 ·
68f7ae38· fix(ontology): render real SHACL constraint values inexplain_violations· @cxzg007 - #1086 ·
b77e3e8c· fix(kg): preserveentity_idaliases during entity merging · @T1mn - #942 ·
4a886d97· fix seed SSRF · @ZohaibHassan16 - #1109 ·
2a303cf4· Declare the Semantica vocabulary, and mint entity IRIs deterministically (#1107, #1101) · @fabio-rovai - #1120 ·
58b77ddc· Mint JSON-LD@ids the same way the RDF serializers do (#1101, missed by #1109) · @fabio-rovai - #1121 ·
6b7625ef· Write timestamps with an explicit UTC offset, and tightensem:exportedAttoxsd:dateTimeStamp(#1114) · @fabio-rovai
61 pull requests merged from 32 contributors.
Contributors
Returning contributors who shipped changes in this release:
@KaifAhmad1, @pravit-amp, @Sameer6305, @Sunil56224972, @ZohaibHassan16
New Contributors
Welcome, and thank you for your first contribution to Semantica:
- @Karunasagar12 first contribution in #862
- @TaherTadpatri first contribution in #857
- @oiahoon first contribution in #870
- @agu2347 first contribution in #871
- @nightcityblade first contribution in #873
- @cakeni first contribution in #878
- @dex0shubham first contribution in #941
- @AmirF194 first contribution in #879
- @aoright first contribution in #881
- @le-czs first contribution in #966
- @yunaremaia first contribution in #914
- @ssynb first contribution in #908
- @eltociear first contribution in #976
- @T1mn first contribution in #978
- @lakshanmuruganandam first contribution in #932
- @lakshayxi first contribution in #984
- @manjunathbhaskar first contribution in #979
- @hsd2514 first contribution in #983
- @yzxcj797 first contribution in #987
- @joseedson18jc first contribution in #886
- @Shindevrp first contribution in #988
- @Mr-Neutr0n first contribution in #940
- @Accute9 first contribution in #1042
- @shahzaib-ahmadcs first contribution in #1062
- @cxzg007 first contribution in #1081
- @Kyou12138 first contribution in #1040
- @fabio-rovai first contribution in #1109
Full Changelog: v0.6.5...v0.6.6
Contributors
oiahoon, yunaremaia, and 30 other contributors