Add GEXF import support

[lmeyerov]

Summary

• add GEXF loader with viz attribute bindings (color/size/position/opacity/thickness) and validation for missing nodes/edges
• add GEXF export (to_gexf) with viz/attribute mapping
• map node viz shapes to FA4 icons (disc→circle, square→square, triangle→caret-up, diamond→diamond, image→uri or picture-o)
• add fixtures + tests for 1.1draft/1.2draft/1.3 GEXF variants, failure cases, and export roundtrip
• add docs + demo notebook

Testing

• uv run pytest graphistry/tests/test_gexf.py -x

Plot URL

• https://hub.graphistry.com/graph/graph.html?dataset=80d5bafb53514a0586a1dd3e31da0688&type=arrow&viztoken=bf4b36f5-0e49-4cc2-92cd-ea59f2f127ae&usertag=ef9e6f8d-pygraphistry-0.50.5+0.g6a272f1f.dirty&splashAfter=1769404440&info=true&play=0

Fixes #899

[juice928]

👋 Hi, I'm an automated AI code review bot. I ran some checks on this PR and found 3 points that might be worth attention (could be false positives, please use your judgment):

1. Consider adding a timeout to network requests

   • graphistry/plugins/gexf.py:L96: graphistry/plugins/gexf.py:L96
   • Impact: Without a defined timeout, the application might hang indefinitely if the remote server is unresponsive.
   • Suggestion: Adding a timeout parameter (e.g., timeout=10) to the urlopen call would improve system reliability.

2. Ensure RGB values are within valid ranges for hex conversion

   • graphistry/plugins/gexf.py:L126: graphistry/plugins/gexf.py:L126
   • Impact: Values outside the 0-255 range can generate malformed hex strings, which may disrupt UI rendering.
   • Suggestion: Consider clamping the color values using max(0, min(255, val)) before formatting them.

3. Enhance XML parsing security for external data

   • graphistry/plugins/gexf.py:L297: graphistry/plugins/gexf.py:L297
   • Impact: Standard XML libraries can be vulnerable to resource exhaustion attacks when processing untrusted input.
   • Suggestion: It would be safer to use a hardened library like defusedxml to handle XML parsing.

If you find these suggestions disruptive, you can reply "stop" , and I'll automatically skip this repository in the future.

[lmeyerov]

need attribution?