chore(deps): Update graphrag-sdk requirement from <0.9.0,>=0.8.1 to >=0.8.1,<1.2.0

[dependabot]

Updates the requirements on graphrag-sdk to permit the latest version.

Release notes

Sourced from graphrag-sdk's releases.

v1.1.0

What's Changed

• feat: introduce StructuralChunking, add MarkdownLoader by @​drr00t in FalkorDB/GraphRAG-SDK#244
• feat(v1.1.0): incremental ingestion primitives with crash-safe cutover by @​galshubeli in FalkorDB/GraphRAG-SDK#247

New Contributors

• @​drr00t made their first contribution in FalkorDB/GraphRAG-SDK#244

Full Changelog: FalkorDB/GraphRAG-SDK@v1.0.2...v1.1.0

Changelog

Sourced from graphrag-sdk's changelog.

[1.1.0] - 2026-05-05

Adds incremental ingestion primitives and a CI-friendly batch wrapper. Built around a crash-safe state-machine cutover (idempotent rollforward keyed off a ready_to_commit marker on the pending Document node) so mid-flight failures recover correctly on retry. Documents the cost model so consumers can pick a sensible finalize() cadence. Closes a pre-existing silent-correctness bug in fuzzy resolvers (MENTIONED_IN edges were dropped for any merged entity). No breaking changes; one previously-rejected argument shape (document_id in file mode) is now accepted.

Added

• GraphRAG.update(source=..., text=..., document_id=..., if_missing=...) and update_sync() — re-sync a previously-ingested document without rebuilding the rest of the graph. SHA-256 content-hash short-circuits no-op updates: a touch-only PR (CRLF, formatter-only changes) costs roughly one Cypher lookup.

  Cutover is a documented state machine (EMPTY → WRITING → WRITTEN → COMMITTED → FINAL) with a single load-bearing transition: setting ready_to_commit = true on the pending Document node. That is the commit point — it is one Cypher statement (atomic at the per-statement level FalkorDB does guarantee), and it must complete before any destructive op touches the live document. Once committed, recovery on crash is rollforward (each post-commit op is idempotent) rather than rollback. The practical effect: an update() interrupted by a transient failure retries cleanly instead of raising DocumentNotFoundError against a half-deleted document.

  Cleans up entities orphaned by the change (zero remaining MENTIONED_IN, scoped to entities the prior version of the document referenced) along with their incident RELATES edges; entities still referenced by other documents are preserved.

• GraphRAG.delete_document(document_id) and delete_document_sync() — remove one document's chunks and the Document node, plus orphaned entities scoped to that document. Other documents' data is untouched.

• GraphRAG.apply_changes(added=..., modified=..., deleted=..., max_concurrency=3, update_concurrency=1) and apply_changes_sync() — convenience batch dispatcher for CI-driven incremental ingestion. Routes each list to the right primitive (ingest for added, update(if_missing="ingest") for modified, delete_document for deleted). Per-file failures are collected, not raised — matching ingest()'s batch contract. Does not call finalize(); that stays the caller's responsibility so a

... (truncated)

Commits

• bfa6271 Merge pull request #247 from FalkorDB/feat/incremental-updates-v1.1.0
• 518c7cc fix(v1.1.0): RELATES source_chunk_ids unioned on upsert, not overwritten
• 47bc116 fix(v1.1.0): Phase 0 rollforward also raises on missing content_hash
• fd2c1f9 style: ruff format -- api/main.py + storage/graph_store.py
• 9b51015 fix(ci): integration suite green -- LLM script, recovery snapshot
• 205dec7 fix(ci): lint + my new tests (graph_name, MockLLM import)
• 569d886 fix(v1.1.0): bot-review followups -- update/ingest path, CI, docs
• f844912 fix(v1.1.0): crash-safe orphan + stale-RELATES cleanup (PR #247 review)
• ec3e31d Merge main into feat/incremental-updates-v1.1.0
• 9c2be5c docs(v1.1.0): README + CHANGELOG + example review fixes
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[gkorland]

@copilot should the uv.lock updated too?

[Copilot]

@copilot should the uv.lock updated too?

Yes — I updated uv.lock as well and regenerated it with graphrag-sdk resolved to 1.1.0 in commit f3467c8.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• 0.0.0.0.in-addr.arpa
  • Triggering command: /usr/local/bin/node node server.js (dns block)
• roslynomnisharp.blob.core.windows.net
  • Triggering command: /home/REDACTED/work/code-graph/code-graph/.venv/bin/python3 /home/REDACTED/work/code-graph/code-graph/.venv/bin/python3 -m pytest tests/ --verbose (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[dependabot]

A newer version of graphrag-sdk exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.