v1.2.0

Beacon Python 1.2.0 releases beacon-otel and beacon-profiling together. Security remains embedded in the main distribution.

Each request reaching an existing finding now emits its own occurrence ID and current trace/span correlation, even when full evidence is sampled out. Finding identity remains stable and process-local occurrence counters remain bounded.

Request-specific attack evidence distinguishes unknown, no_evidence, and suspected, independently of the code-risk candidate and outcome. SQL analysis requires the explicit ANSI dialect setting; supported simple POSIX shell syntax is analyzed conservatively. Unsupported or imprecise cases remain unknown. A stronger observation upgrades the same occurrence without counting it twice; summaries retain the strongest representative and per-status counts.

Security stays disabled by default. Enabling it does not enable local diagnostic files. Delivery is bounded best effort; a trace ID does not guarantee that its trace was retained. Attack evidence does not assert exploit success or replace risk assessment. Network/path policy-dependent classification remains unknown without the relevant policy.

Install:

pip install 'beacon-otel[profiling,flask,requests]==1.2.0'
beacon --version

Baseline: OpenTelemetry Contrib v0.65b0 (a5470c666947acddc24fd4064ec7c1b169dfe8b6) and Core v1.44.0 (53a5a40c9604583c501bcf13970a635f00e62df4). Source: ff40fa9a6faeb9cd47262d2c3c3ed8b6944d7a71.

Source CI builds and tests installed artifacts on CPython 3.10–3.14; Security runtime tests run on standard-GIL CPython 3.11–3.14. The Security suite contains 132 tests, including actual OTLP HTTP/protobuf occurrence delivery and native SQLite bound-value versus dynamic-template behavior. Candidate acceptance on CPython 3.12 also verified the public CLI, default-disabled lifecycle, three traced Flask requests, per-request attack evidence, runtime SBOM and compatible pprof uploads to a local receiver. This is local protocol acceptance; no new DataKit compatibility claim is made.

Version-pinned usage and limitations. Gunicorn requires preload_app=False. Profiling uses compatible pprof rather than the OpenTelemetry Profiles signal. Both packages' wheels and sdists are attached.

Rollback: pin beacon-otel[profiling,flask,requests]==1.1.0 in a clean environment. Published versions and tags are immutable.

Post-publication acceptance installed both exact public versions into a new CPython 3.12.3 environment without cache or checkout sources and repeated the CLI, lifecycle, traced occurrences, attack evidence, SBOM and pprof checks successfully. All four PyPI files and GitHub assets match the accepted SHA-256 digests. Public-artifact acceptance record.