DocFence 0.22.0
VML external-image review boundary
DocFence 0.22 adds a privacy-safe inventory for direct legacy Word VML
v:imagedata/@r:id markers backed by a relationship stored with
TargetMode="External".
- Separately counts standard image relationships and externally stored
unsupported relationship types. - Adds
require_no_word_vml_external_images(DFP057) and
no_word_vml_external_image_changes(DFP058). - Keeps targets, relationship IDs, VML attributes, story paths, and fingerprints
out of public JSON, Markdown, and SARIF output. - Deliberately excludes embedded/internal images, orphaned relationships, raw
VMLsrc,r:pict,r:href, ando:relid; it does not retrieve, render,
update, or resolve an image.
The implementation is covered by local regression tests, Python 3.11/3.13 CI,
and a pinned public Word package containing two legacy VML image-data markers.
The release wheel and source distribution were independently rebuilt from the
working tree and git archive at the tag commit and were byte-identical.
See the README and validation notes for the precise scope and source evidence.