Skip to content

v0.4.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 31 May 12:31
· 10 commits to main since this release
v0.4.0
0851edf
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

  • Validate user-supplied URL path segments (ori, district_code, use-of-force group/spec) via new validate_path_segment(), rejecting /, \, and .. to prevent path traversal / endpoint redirection
  • Stop surfacing or logging the raw httpx exception in api_get()'s network-error branch; some httpx errors carry the request URL, which includes the API_KEY query parameter. The response is now a generic message and only the exception type is logged

Fixed

  • manage_cache runs its blocking filesystem I/O (glob/read/rmtree) via asyncio.to_thread so it no longer stalls the event loop, while keeping FastMCP middleware stats reads/resets on the event loop to avoid cross-thread access

Changed

  • validate_path_segment error messages now spell out the non-empty and no-.. constraints rather than implying them via the allowed-character list
  • Dependabot now tracks the Python (pip) and github-actions ecosystems instead of the unused npm ecosystem

Added

  • Regression tests for validate_path_segment, the ori path through validate_crime_data_params, malicious-ORI rejection in get_police_employment, path-segment rejection in lookup_agency and get_use_of_force_data, and _collect_stats skipping non-caching middleware

Full Changelog: v0.3.1...v0.4.0

Assets 4
Loading