v0.6.1: Updated certificate trust bundle

Require certifi>=2026.10.19 so default HTTPS certificate verification uses the updated trust bundle and excludes the compromised emSign ECC Root CA - G3 root.

This patch publishes the certificate-trust fix from PR #27. See the certifi security advisory for details.

Release version PR #28 · Full comparison

v0.6.0: Current MobilityData CSV catalog

MobilityAPI now uses MobilityData's current V2 CSV catalog at https://files.mobilitydatabase.org/feeds_v2.csv, restoring discovery of current feeds.

• Preserve full mdb-, tld- and tdg- feed IDs for search and downloads. Numeric MDB lookups and legacy CSV parsing remain supported.
• Read current feed names and bounding boxes. Malformed coordinates are treated as missing without blocking catalog discovery.
• Use a separate V2 cache so old catalogs cannot hide the update. The first use after upgrading requires an internet connection; the new cache supports subsequent offline use.

Includes 114 passing regression tests and validation on Python 3.11, 3.12 and 3.13.

Changes in PR #26 · Full comparison

v0.5.1: Security Fixes

Security Fixes

CVE-2024-47081 Fix

• Bumped minimum requests version to 2.32.4 to address CVE-2024-47081
  • This vulnerability allowed URL parsing to leak .netrc credentials to malicious hosts
  • CVSS Score: 5.3 (Medium severity)

Git History Cleanup

• Removed .env file from git history
  • The .env file was accidentally committed in early commits
  • History has been rewritten to remove this file completely
  • If you're a collaborator, you may need to re-clone the repository

Version Updates

• Updated version to 0.5.1
• Updated all version references in pyproject.toml, requirements.txt, and init.py

For full details, see the CHANGELOG.

v0.5.0 Bounding box meatadata

Added

• Bounding box calculation from stops.txt for direct source GTFS files
• Support for bounding box information from CSV catalog and API
• Graceful handling of missing or invalid coordinates in stops.txt
• New force_bounding_box_calculation flag to force recalculation of bounding box from stops.txt
• Automatic fallback to stops.txt calculation when bounding box is missing from API/CSV

Changed

• Enhanced bounding box handling with clear calculation priority
• Improved logging for bounding box calculation sources
• Better error handling for coordinate validation

Full Changelog: v0.4.2...v0.5.0

v0.5.0b0 Extract external GTFS file

Added

• External GTFS support:
  • New ExternalGTFSAPI class for handling GTFS files not in Mobility Database
  • Automatic provider ID generation with ext- prefix
  • Agency name extraction from agency.txt
  • Smart file matching based on content hash
  • Support for multiple agencies in a single feed
  • Versioning support with automatic cleanup of old datasets

Changed

• The saved metadata now contains the geographical bounding boxes of the dataset from Mobility Database. It is not implemented yet for external GTFS feeds and downloads from the CSV catalogue.

Full Changelog: v0.4.2...v0.5.0b0

v0.4.2 Bug fix release

Fixed

• Removed redundant metadata saving when using custom download directory

Added

• IOError handling for downloads and .zip extractions

Full Changelog: v0.4.1...v0.4.2

v0.4.1 Enhanced get_provider_info(), added get_provider_by_id()

Added

• New get_provider_by_id() method that follows the naming convention of other provider search methods

Changed

• Enhanced get_provider_info() to be the central provider search implementation:
  • Now accepts optional search parameters: provider_id, country_code, and name
  • Returns either a single provider (when searching by ID) or a list of providers (when searching by country or name)
  • Powers all other provider search methods internally for better consistency
  • Improved error handling and CSV fallback behavior

Full Changelog: v0.4.0...v0.4.1

v0.4.0 CSV mode - API key is optional from now on

Added

• Enhanced provider information retrieval:
  • New get_provider_info() method in both API and CSV modes
  • Combines live provider data with downloaded dataset information
  • Automatic fallback to CSV catalog on API errors
  • Comprehensive metadata about downloaded datasets
• CSV catalog fallback functionality (#5):
  • Automatic fallback to CSV catalog when API key is not available
  • Optional force_csv_mode to always use CSV catalog
  • Lazy initialization of CSV catalog to improve performance
  • ID normalization for consistent provider lookup
• Improved error handling:
  • Graceful handling of 413 (Request Entity Too Large) errors
  • Automatic fallback to CSV mode on authentication errors
  • Better token handling with empty headers when no token is available
  • Robust handling of CSV network errors with fallback to cached data
  • Proper handling of empty metadata files during concurrent access

Changed

• Made CSV catalog initialization lazy to reduce unnecessary directory creation
• Improved token handling to return None instead of raising errors
• Enhanced error messages and logging for better debugging
• Improved file locking mechanism:
  • Fixed handling of file modes for concurrent access
  • Added proper file existence checks before opening
  • Enhanced empty file handling during metadata operations

Developer Changes

• Added comprehensive tests for provider information retrieval
• Added tests for CSV catalog functionality
• Added tests for ID normalization and conversion
• Added tests for lazy initialization behavior
• Added tests for CSV network error scenarios
• Added tests for concurrent file access edge cases
• Updated documentation with CSV fallback examples and API reference

Full Changelog: v0.3.0...v0.4.0

v0.3.0 - Documentation and Concurrency Update

This release introduces comprehensive documentation and robust concurrency support, making the library more reliable for multi-threaded and multi-process applications.

Major Features

• 📚 New documentation site at https://bdamokos.github.io/mobility-db-api/
• 🔒 Thread-safe and process-safe metadata handling
• 🔄 Automatic metadata change detection
• 🛠️ Improved error handling and logging

Detailed Changes

Documentation

• Comprehensive documentation site with quick start guide, API reference, and examples
• Improved inline documentation and type hints
• Better error messages and logging

Concurrency Support

• File locking for concurrent metadata access
• Shared locks for reading (multiple readers allowed)
• Exclusive locks for writing (one writer at a time)
• Automatic metadata merging for concurrent writes

API Improvements

• Made API instances fully independent with separate data directories
• Added reload_metadata() method for manual metadata refresh
• Added ensure_metadata_current() for automatic metadata validation
• Improved handling of corrupted metadata files

Developer Changes

• Added automated test issue management
• Added comprehensive test suite for concurrent operations
• Improved GitHub Actions security
• Added documentation testing workflows

Full Changelog: v0.2.0...v0.3.0

v0.2.0 - Add new deletion methods

Added

• New bulk deletion methods:
  • delete_provider_datasets(): Delete all datasets for a specific provider
  • delete_all_datasets(): Delete all downloaded datasets across all providers
• Smart directory cleanup:
  • Automatic removal of empty provider directories
  • Preservation of custom files and directories
  • Safe cleanup that only removes dataset-related content

Changed

• Enhanced delete_dataset() method to handle provider directory cleanup
• Improved logging for deletion operations

Developer Changes

• Added comprehensive tests for directory cleanup behavior
• Added tests for bulk deletion operations
• Updated documentation with new deletion methods and examples

Full Changelog: v0.1.1...v0.2.0