Skip to content

v0.28.3 — remove stray Playwright log from the sdist, allow-list the archive

Choose a tag to compare

View all tags
@Lexus2016 Lexus2016 released this 16 Sep 17:01
· 87 commits to main since this release
v0.28.3
7aeb065

uv tool install turbo-quant-memory

Security

  • The 0.28.2 sdist shipped a stray .playwright-mcp/ console log. It contained one token-shaped string: an ephemeral Fastly anti-bot challenge token for pypi.org that had already been rejected with HTTP 401. It is not a credential and grants no access, so practical impact is nil — but it should not have been published.
  • 0.28.2 is yanked. Use 0.28.3.
  • The wheel was never affected; it only ever contained the module.

Fixed

  • The sdist now uses an explicit allow-list instead of hatchling's default, which sweeps in everything not gitignored — the root cause that turned a stray working-tree file into a published artifact. 0.28.2 also shipped .planning/, .github/, AUDIT_REPORT*.md, benchmarks/ and scripts/ for the same reason. Archive drops from 1.11 MB to 708 KB.
Assets 2
Loading