Skip to content

VersionSec 0.7.0

Choose a tag to compare

View all tags
@dzeusking-dev dzeusking-dev released this 11 Sep 18:12
· 33 commits to main since this release
v0.7.0
bb97366

VersionSec 0.7.0

ForgeGuard is now VersionSec. The product, maintainer, licence and scope are unchanged - only the name changed, starting with this release.

Install

python -m pip install versionsec==0.7.0

Compatibility bridge for existing users (installs VersionSec):

python -m pip install forgeguard==0.7.0

What changed

up to 0.6.0 0.7.0
Distribution / import / CLI forgeguard versionsec
Repository gexiro-global/forgeguard gexiro-global/versionsec
Site product page on gexiro.com https://versionsec.com
Token env var FORGEGUARD_TOKEN VERSIONSEC_TOKEN

Compatibility - existing users are not abandoned

Covered by 20 dedicated tests in tests/test_migration_0_7.py:

  • import forgeguard and import forgeguard.cli keep working and return the same module objects as versionsec.* - a shim, not a second implementation that could drift.
  • The forgeguard console script is still installed and runs the canonical CLI.
  • The legacy import path is silent: no warning on stdout or stderr, so existing automation is unaffected.
  • FORGEGUARD_TOKEN is still read; when both are set, VERSIONSEC_TOKEN wins (deterministic precedence).
  • forgeguard==0.7.0 is a metadata-only bridge depending on versionsec==0.7.0.

Deliberately unchanged

Renaming these would silently break existing report pipelines, suppression lists and SARIF baselines:

  • every FG-* finding identifier (FG-VER, FG-ANON, FG-CONFIG-*, FG-RUNNER-*, FG-CVE-*, FG-FJ-*);
  • the machine-readable schema identifiers forgeguard.assessment.v1, forgeguard.config-snapshot.v1, forgeguard.runner-snapshot.v1, forgeguard.scan-result.v0.3.

Human-facing branding did change: report title, Markdown header/footer, SARIF driver name and User-Agent now read VersionSec.

Capabilities (unchanged from 0.6.0)

Separate Gitea or Forgejo providers, bounded read-only GET-only live assessment, offline configuration review, offline Actions runner review with the eight FG-RUNNER-* checks, Markdown/JSON/SARIF 2.1.0 output, deterministic completeness semantics.

Qualification targets: Gitea 1.26.4 / 1.27.3, Forgejo 15.0.8 / 16.0.4, Gitea Runner 3.4.2, Forgejo Runner 13.0.0 / 13.1.0 - the exact tested targets, not a universal support promise.

Verification for this release

  • Source bb97366b154432f2ee70f37a08cb533711300f8b (tag v0.7.0), built on trusted push run 34630928644.
  • 403 tests pass on Python 3.11 and 3.12 (383 existing + 20 new migration tests); coverage 96%.
  • Ruff lint/format, compile, pip check, python -m build and twine check all clean.
  • Both attached artifacts were installed in clean virtualenvs and exercised through the canonical and the legacy CLI, including a real runner review run.

Wheel SHA-256: 31e00d7bf76b3b5c68ba05294ffd1117a36ad8598d92493c1bbb1ce588a22870
sdist SHA-256: 43483681b6b588dd935f3fb8f310b129313d3e978521ad2b423bbf82d6f4822c

Older releases

ForgeGuard 0.2.0, 0.2.1, 0.2.2, 0.5.0 and 0.6.0 remain published on PyPI under the forgeguard name, unchanged, with their original hashes and original release notes. They were called ForgeGuard and the historical record still says so.

Boundaries

Read-only, single target, GET-only for live assessment and fully offline for configuration and runner review. No exploitation, no target discovery, no mass scanning, no security or compliance certification, no compromise determination. Use only on an instance you own or are explicitly authorized to assess.

See MIGRATION.md and CHANGELOG.md.

Erratum (added 2026-09-11, after release)

0.7.0 has a defect in the command-line version flag. versionsec --version and forgeguard --version exit with code 2 and Error: No such option: --version.

This erratum does not claim that scanning, offline configuration review or offline runner review are broken - those behave correctly in 0.7.0. Only the version flag is affected.

VersionSec 0.7.1 fixes it and supersedes this release. Use 0.7.1.

The 0.7.0 tag, assets and hashes above are unchanged and remain valid historical state; nothing in this release was replaced.

Assets 5
Loading