Skip to content

DocFence 0.20.0

Choose a tag to compare

View all tags
@SybilGambleyyu SybilGambleyyu released this 01 Aug 11:49
v0.20.0
0dd66a9

Direct legacy VML shape links

DocFence 0.20.0 adds a privacy-safe inventory for direct legacy VML href
markup in supported Word stories. This closes a distinct review surface: a VML
shape can store a target directly, without an OOXML hyperlink relationship, a
HYPERLINK field, w:hyperlink markup, or a DrawingML action marker.

The new word_vml_hyperlinks projection reports only aggregate element/story,
concrete-shape/group/shape-template, and direct-target-attribute-presence
counts. Raw URLs, targets, titles, alternate text, shape IDs, story paths, and
fingerprints remain private.

Two policy rules are available:

  • require_no_word_vml_hyperlinks (DFP053)
  • no_word_vml_hyperlink_changes (DFP054)

The inventory is intentionally narrow. It scans direct unqualified href
attributes on VML arc, curve, image, line, oval, polyline, rect,
roundrect, shape, group, and shapetype elements. It does not infer an
inherited or rendered link, select a Markup Compatibility branch, resolve,
retrieve, follow, validate, evaluate, render, or execute an action.

Release evidence

  • 46 tests and Ruff pass locally.
  • Hosted CI passed on Python 3.11 and 3.13, plus distribution build and Twine
    validation, for both the release commit and tag.
  • The wheel and source archive were rebuilt independently from the tagged
    source archive and were byte-for-byte identical.

See the tagged policy reference,
threat model,
and validation notes.

Assets 5
Loading