PKG-Defender v1.0.7

PKG-Defender v1.0.7

Released July 23, 2026

---

What's Changed

Fixed

• pip install with --hash=<sha> CLI flag rejected by pip ≥26.1.2 — root
  cause: --hash is a per-requirement option valid only inside pip requirements
  files, not as a CLI flag. Moved --hash into a temp requirements file
  (printf '%s\n' 'uv==0.5.1 --hash=...' > /tmp/uv-requirements.txt && pip install -r /tmp/uv-requirements.txt --require-hashes) in
  .clusterfuzzlite/build.sh and .github/workflows/release.yml, preserving
  SHA256 pinning and OpenSSF Scorecard Pinned-Dependencies compliance.

---

📖 2 Commits since v1.0.6

Commit	Description	Author
0dae89c	chore(release): prepare release v1.0.7	Division 7
f25d139	fix(ci): use requirements file for pip hash verification in release smoke test and clusterfuzz build.sh script	Division 7

---

View Complete Changelog →