v1.2.1

Beacon Python 1.2.1

This patch release publishes matching beacon-otel and beacon-profiling packages. Security remains embedded in beacon-otel, opt-in and disabled by default. The Contrib v0.65b0 / Core v1.44.0 baseline is unchanged.

Fixes

• Keep Security requests active after local ASGI receive cancellation (#42); resolves #25.
• Preserve the caller's protobuf backend selection when importing Profiling (#43); resolves #38.
• Reserve index zero in OTLP Profiles dictionaries (#44); resolves #41.
• Recover from Profiling export errors and bound local HTTP-export files (#45); resolves #37.
• Avoid redundant taint nodes for identity-preserving os.fspath calls (#46); resolves #33.
• Avoid duplicate sampling in asyncio lock context managers (#47); resolves #40.
• Make SQL whitespace scanning linear (#48); resolves #29.
• Deduplicate inherited SQL methods and Django debug cursor observations (#49); resolves #30.
• Stop lock sampling and always restore profiler patches during shutdown (#50); resolves #36.
• Distinguish current and local-root spans in Profiling samples (#51); resolves #39.
• Detect SQL quote boundaries crossing fixed and tainted text (#52); resolves #28.
• Track the actual string objects returned by Starlette Headers (#53); resolves #32.
• Reserve request-body tracking capacity for parsed fields (#54); resolves #31.
• Sample short lock operations and cache normalized paths (#55); resolves #35.
• Bound raw profiling buffers and reuse immutable stack frames (#56); resolves #34.
• Preserve logging locations and standard-library factory module identity (#57); resolves #23.
• Cache Security startup eligibility and reduce call overhead (#58); resolves #24.
• Propagate taint through attribute and subscript augmented assignment (#59); resolves #26.
• Prioritize attack evidence and coverage diagnostics within bounded export budgets (#60); resolves #27.

Compatibility and Operational Limits

Security supports standard-GIL CPython 3.11–3.14. CPython 3.10 receives package and schema validation; its Security runtime remains unsupported. Profiling package tests run on CPython 3.10–3.14; handled-exception collection requires sys.monitoring on 3.12+. Gunicorn requires preload_app=False.

Collection and delivery use finite budgets. Saturated buffers and unavailable exporters can drop telemetry; delivery remains best effort. Lock profiling now samples before allocating samples or walking stacks, and suppresses its own internal locks. Tune the documented sampling and buffer settings for each workload. Full-sampling lock collection still has measurable overhead.

Attack evidence remains independent of risk classification and does not establish exploit success. Unsupported syntax and absent network/path policy remain unknown. Counters are process-local. A trace ID does not guarantee that a trace was retained.

The validated backend path uses compatible pprof and OTLP HTTP/protobuf traces and logs. OTLP Profiles dictionary and reference checks use a local protocol receiver; this release does not claim a new production DataKit or Collector qualification.

Validation and Upgrade

See the versioned acceptance record. The release candidate combines all 19 fixes and passed 343 local tests before version preparation. The five-version installed-wheel CI and official protected publishing workflow passed. Both public packages passed clean-environment application acceptance.

Install beacon-otel[profiling,requests]==1.2.1, adding the framework extras your application uses. To roll back, install beacon-otel[profiling,requests]==1.2.0 in a clean environment. Previously published versions and tags remain immutable.

Release Evidence

• Source: 4cd1390a6a5b9c10da54244291cdccdec0b4df81.
• Official build and publication.
• Public-package acceptance.
• Temporary publishing variable restored to false; tag restrictions and reviewer protections retained.

Artifact SHA-256

Artifact	SHA-256
beacon_otel-1.2.1-py3-none-any.whl	8efec884079259fb72c82f2a05623e5ccb7f6aad4c1666bdd7cd394cf9152662
beacon_otel-1.2.1.tar.gz	eef99b5d0e25de2adc78bf1718d2b0e881dc92cb011d1a1c9e52796ad1fa5935
beacon_profiling-1.2.1-py3-none-any.whl	6c01682e294f28dfe174b63f3b5b719e1bed2dceeaca8ba4eb576e17e618f9c6
beacon_profiling-1.2.1.tar.gz	c783135a5b4a00fc50f9908bbe403681e3bc27bce869e4ddbf1d40f486437fdb

v1.2.0

Beacon Python 1.2.0 releases beacon-otel and beacon-profiling together. Security remains embedded in the main distribution.

Each request reaching an existing finding now emits its own occurrence ID and current trace/span correlation, even when full evidence is sampled out. Finding identity remains stable and process-local occurrence counters remain bounded.

Request-specific attack evidence distinguishes unknown, no_evidence, and suspected, independently of the code-risk candidate and outcome. SQL analysis requires the explicit ANSI dialect setting; supported simple POSIX shell syntax is analyzed conservatively. Unsupported or imprecise cases remain unknown. A stronger observation upgrades the same occurrence without counting it twice; summaries retain the strongest representative and per-status counts.

Security stays disabled by default. Enabling it does not enable local diagnostic files. Delivery is bounded best effort; a trace ID does not guarantee that its trace was retained. Attack evidence does not assert exploit success or replace risk assessment. Network/path policy-dependent classification remains unknown without the relevant policy.

Install:

pip install 'beacon-otel[profiling,flask,requests]==1.2.0'
beacon --version

Baseline: OpenTelemetry Contrib v0.65b0 (a5470c666947acddc24fd4064ec7c1b169dfe8b6) and Core v1.44.0 (53a5a40c9604583c501bcf13970a635f00e62df4). Source: ff40fa9a6faeb9cd47262d2c3c3ed8b6944d7a71.

Source CI builds and tests installed artifacts on CPython 3.10–3.14; Security runtime tests run on standard-GIL CPython 3.11–3.14. The Security suite contains 132 tests, including actual OTLP HTTP/protobuf occurrence delivery and native SQLite bound-value versus dynamic-template behavior. Candidate acceptance on CPython 3.12 also verified the public CLI, default-disabled lifecycle, three traced Flask requests, per-request attack evidence, runtime SBOM and compatible pprof uploads to a local receiver. This is local protocol acceptance; no new DataKit compatibility claim is made.

Version-pinned usage and limitations. Gunicorn requires preload_app=False. Profiling uses compatible pprof rather than the OpenTelemetry Profiles signal. Both packages' wheels and sdists are attached.

Rollback: pin beacon-otel[profiling,flask,requests]==1.1.0 in a clean environment. Published versions and tags are immutable.

Post-publication acceptance installed both exact public versions into a new CPython 3.12.3 environment without cache or checkout sources and repeated the CLI, lifecycle, traced occurrences, attack evidence, SBOM and pprof checks successfully. All four PyPI files and GitHub assets match the accepted SHA-256 digests. Public-artifact acceptance record.

v1.1.0

What's Changed

• Record Beacon Python 1.0.1 release validation by @lrwh in #13
• Use standard v-prefixed Beacon release tags by @lrwh in #14
• feat: add opt-in Beacon Security by @lrwh in #15

Full Changelog: v1.0.1...v1.1.0

Beacon Python 1.0.1

What's Changed

• docs: record Beacon Python 1.0.0 release by @lrwh in #11
• Release Beacon Python 1.0.1 without legacy product wording by @lrwh in #12

Full Changelog: v1.0.0...v1.0.1

Beacon Python 1.0.0

What's Changed

• fix: target repository in GitHub release job by @lrwh in #7
• docs: update links for organization migration by @lrwh in #8
• docs: translate Beacon documentation to English by @lrwh in #9
• chore: release Beacon Python 1.0.0 by @lrwh in #10

Full Changelog: v0.1.0...v1.0.0

0.1.0

Beacon Python 0.1.0 is the first stable release.

Packages:

• beacon-otel 0.1.0
• beacon-profiling 0.1.0

Highlights:

• OpenTelemetry Python auto-instrumentation through the beacon command.
• Optional CPU, wall-time, heap, lock-contention, and handled-exception profiling.
• Configurable 60-second default profile export interval.
• FastAPI Trace and Profile acceptance demo.

Validation:

• Python 3.10-3.14 CI passed.
• Built wheel and sdist metadata passed twine and Beacon version checks.
• 12 Beacon package tests and 49 profiling tests passed after installing the built wheels.
• Promoted from the DataKit-validated 0.1.0rc2 runtime baseline without runtime behavior changes.

Baseline:

• OpenTelemetry Python Contrib 0.65b0
• OpenTelemetry Python Core 1.44.0

Known limitations:

• Current DataKit profile ingestion uses the compatible pprof endpoint rather than OTLP Profiles v1development.
• Do not install another profiling distribution with a conflicting auto-instrumentation entry point in the same environment.

0.1.0rc2

Beacon Python 0.1.0rc2 focuses on Profiling correctness and demo acceptance.

Changes:

• Report compatible pprof CPU time from per-thread CPU clocks and exclude profiler scheduler threads.
• Run heap snapshots independently from regular stack sampling.
• Report heap live size without mislabeling live objects as cumulative allocations.
• Use a configurable 60-second default profile export interval; constructor arguments and environment variables can override it.
• Add a FastAPI demo for Trace and Profile acceptance.

Validation:

• Built and installed beacon-otel and beacon-profiling wheels in a clean Python 3.13 environment.
• Passed 12 beacon/beacon-otel tests and 49 beacon-profiling tests.
• Verified compatible pprof CPU and heap data against a local DataKit endpoint.

Current DataKit validation uses the compatible pprof upload endpoint. OTLP Profiles v1development is not enabled by that receiver.

Beacon Python 0.1.0rc1

Beacon Python 0.1.0rc1 is the first public release candidate for demo and end-to-end acceptance. It is not a general-availability release.

Packages:

• beacon-otel 0.1.0rc1
• beacon-profiling 0.1.0rc1

Highlights:

• The beacon command and OpenTelemetry auto-instrumentation distribution configuration.
• Optional OTLP and pprof profiling.

Install:

pip install "beacon-otel[profiling,requests]==0.1.0rc1"

Baseline:

• OpenTelemetry Python Contrib v0.65b0
• OpenTelemetry Python Core v1.44.0
• Release commit 44b377b

Validation:

• Python 3.10–3.14 builds, artifact metadata, and installed-wheel tests passed.
• A clean Python 3.14 environment installed the packages from public PyPI and passed the beacon startup smoke test.

Known limitations:

• Profiling is disabled by default and requires OTEL_PROFILING_ENABLED=true.
• Handled-exception profiling requires Python 3.12 or later.
• Do not install another profiling distribution with a conflicting auto-instrumentation entry point in the same environment.
• The supported scope remains subject to subsequent acceptance results.