carabiner v0.1.4

pip install carabiner-sec

Fixed — a crash on Windows

Path.read_text() uses the locale encoding on Windows, not UTF-8. One em dash, smart quote or emoji anywhere in a scanned file took the whole scan down with UnicodeDecodeError — a crash for most Windows users, not an edge case.

Files read from your repo now use UTF-8 with errors="replace", because a stray byte shouldn't end a scan. Files carabiner writes use strict UTF-8. Pinned by an AST-based lint over every text read and write in the codebase.

This was found by adding Windows to the CI matrix, which had been listed as untested for several releases. It paid for itself on the first run.

Added

• Windows is now tested — Linux and Windows, Python 3.10 and 3.13.
• --offline is real. It previously only reached the drills while deps still called out through osv-scanner, and SECURITY.md claimed otherwise. Engines now declare whether they need the network and are skipped entirely, enforced by a test that blocks socket creation and asserts a full scan still completes.
• PyPI project metadata — the page was blank. README, classifiers, keywords, and PEP 639 licence metadata.

Also

The README had silently gone stale — most edits to it had no-opped, leaving it claiming "Phase 0, native engines only" long after five engines, the drill, SARIF, Docker and PyPI shipped. Rewritten, and now covered by tests asserting the docs pin the shipped version, recommend no mutable ref (@main is exactly what CI003 reports), and mention every registered engine.

Full diff: v0.1.2...v0.1.4