v0.4.0 - Multi-Repo Discovery, Python 3.10 Support

TL;DR

Multi-repo and foreign package discovery with --repo/--foreign/--all-repos flags, Python 3.10+ support (down from 3.12), and a catastrophic backtracking linter fix for Python 3.12+ regex engine changes.

Added

• Multi-repo package discovery: trustsight review now accepts --repo REPO (repeatable), --foreign, and --all-repos flags. Packages can be scanned from specific local repos, all auto-detected local repos (excluding official ones), and/or foreign packages via pacman -Qm.
• Config-driven discovery defaults: new [discovery] section in config.toml (default_repos, include_foreign, all_repos). CLI flags override config; if neither is set, foreign-only scanning is used as the backward-compatible default.
• vercmp-based version comparison: outdated packages are now detected via vercmp (the pacman version comparison tool), which correctly handles epoch prefixes, pkgrel, and 1.9 < 1.10. Falls back to string comparison with a warning when vercmp is unavailable.

Changed

• Python requirement lowered from >=3.12 to >=3.10: tomllib imports replaced with a tomli compatibility shim. On Python 3.11+ the stdlib tomllib is used; on 3.10 the tomli backport is required.
• CI matrix expanded: tests now run on Python 3.10, 3.11, 3.12, 3.13, and 3.14 (allow-prereleases).
• Catastrophic backtracking threshold raised: _BACKTRACK_REPS increased from 18 to 22. Python 3.12's optimised re engine runs the classic (a+)+$ pattern at 18 reps in ~15ms (under the 20ms budget), so the threshold was raised to restore the margin of separation between exponential and linear patterns.

Stats

• 5 commits since v0.3.1
• 610 tests, all passing
• Package version 0.4.0