v0.2.2

ForgeGuard 0.2.2

Truth-correction and semantic-integrity release for the read-only Gitea posture checker.

Corrected

• require trusted Gitea product confirmation for Gitea advisory conclusions
• model CVE-2026-27771 as affected, fixed, or unknown version posture
• produce N/A when core evidence is indeterminate
• keep browser and API evidence ownership disjoint
• require an explicit non-empty remote version before reporting disclosure
• neutralize untrusted Markdown output and refuse output-path collisions
• reject nested encoded dot segments and backslash separators

Release safety

• Python 3.11 and 3.12 quality matrix
• wheel and sdist validation
• exact-wheel install, metadata, dependency, and CLI smoke gates

ForgeGuard remains GET-only, single-target, and limited to instances the operator owns or is explicitly authorized to assess.

v0.2.1

Packaging hardening: dependency upper bounds, Trove classifiers, py.typed inline-typing marker, and PEP 639 license metadata. Published to PyPI via GitHub OIDC Trusted Publishing with signed PEP 740 attestations.

ForgeGuard v0.2.0

Read-only security posture self-check for self-hosted Gitea/Forgejo. Own/authorized instances only.

Install:

python -m pip install forgeguard

Highlights (v0.2):

• Version / patch-currency posture (CVE-2026-27771)
• Container-registry anonymous-exposure posture (/v2/)
• Sign-in / anonymous-access posture
• Deterministic score with a before/after example (66/100 C -> 100/100 A after patching)

Read-only HTTP GET checks only - no exploit, no mass scanning, no artifact retrieval.

PyPI: https://pypi.org/project/forgeguard/0.2.0/