Skip to content

Choose a tag to compare

@yannrichet yannrichet released this 08 Nov 16:51
· 2 commits to main since this release
a6b2f26

This release contains behavior changes that are not backward compatible, hence the
major version
(Python 3.8 dropped, cache key, default delimiters, timeouts, sh://
path resolution, fz list JSON). Read the summary below before upgrading. It also fixes wrong results with some
sh:// commands and a command-injection issue present in 1.2: upgrading is recommended.

Upgrading from 1.2: behavior changes at a glance

Each item is detailed in its section below.

  • Python 3.8 is no longer supported (requires-python >= 3.9).
  • "path" case directory names percent-encode unsafe characters (a/b -> a%2Fb).
  • cache:// uses a SHA-256 .fz_hash ("v2"); caches written by fz <= 1.2 are ignored
    unless FZ_CACHE_ACCEPT_LEGACY=1.
  • ssh:// and slurm:// have no default timeout (was 3600 s); timeout=0 and
    FZ_RUN_TIMEOUT=0 now mean "no timeout" (they timed every case out immediately).
  • A model without delim reads both $(x) and ${x} as variables (Python read only
    $(x), the CLI only ${x}).
  • fzr() raises ValueError when results_dir looks like a calculator URI.
  • sh:// resolves a word to the launch directory only if the file exists there and not
    in the case directory (results of commands such as cat in.txt > out.txt obtained
    with 1.2 should be re-checked).
  • fz list --format json: calculators are keyed by alias name (with path, uri).
  • fz-mcp: FZ_MCP_TRUSTED=0 restricts at the MCP layer; network transports need
    FZ_MCP_ALLOW_NETWORK_TRANSPORT=1.
  • Code that patched fz.runners.run_command must patch fz.runners.sh.run_command.

Also in 2.0

  • slurm-array:// calculator (one sbatch --array job for all cases).
  • Campaign traceability: manifest.json and RO-Crate metadata written by fzr and fzd.
  • cache:// identity: code_id / version_cmd on calculator aliases, FZ_CACHE_STRICT=1.
  • fz-mcp MCP server for AI agents (pip install 'funz-fz[mcp]', Python >= 3.10).
  • Security: case-name / remote-command injection and credential leakage fixed; threat model documented.
  • Warning when a model without delim reads ${...} shell text as variables.
  • Release tooling: the wheel is built once, checked, and installed on the CI matrix before publishing.

Full notes: NEWS.md ·
Documentation: https://funz.github.io/fz.github.io