Pagonic v0.5.0 — Trustworthy ZIP Inspection for Automation

Highlights

Pagonic v0.5.0 makes the existing ZIP inspector easier to use in automation while keeping the product focused on “inspect before you extract”.

• Explicit verify and safe-extract policy thresholds and exit-code contract.
• Generated synthetic security regression corpus for traversal, collisions, metadata, structure, unsupported methods, and resource limits.
• Stable inspection JSON schema and deterministic ordering documentation.
• Copyable GitHub Actions, Bash, and PowerShell integration examples.
• ZipHandler compatibility policy: available without a new deprecation warning throughout the 0.5 line.
• Refreshed, slower README terminal demo showing version, inspection, verification refusal, and safe-extraction refusal.

Installation

The v0.5.0 package is now published on PyPI:

python -m pip install pagonic==0.5.0

For an isolated CLI installation, use either:

uv tool install pagonic
pipx install pagonic

The matching artifacts are also available on TestPyPI for publication checks and below as GitHub release assets. Pagonic remains an alpha-stage security-aware ZIP inspection and safe extraction toolkit.

Validation

Local normal suite: 399 passed, 8 skipped.

Local comprehensive suite: 404 passed, 3 skipped.

GitHub Actions test matrix passed all 8 Windows/Linux Python 3.10–3.13 jobs.

The published package was verified with clean Windows and Linux (WSL Ubuntu) installations using pip check, pagonic --version, inspect --json, verify, and safe-extract --dry-run.