Skip to content

v0.43.0 — supply-chain hardening & whole-package typing

Choose a tag to compare

View all tags
@heidihelena heidihelena released this 28 Jun 19:39
v0.43.0
7d6b6fb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Supply-chain & type-safety hardening, plus security and bug fixes.

Security & supply chain

  • CI scanners: ruff (E/F/S) + mypy gating, CodeQL, pip-audit, OSV-Scanner, OpenSSF Scorecard
  • CycloneDX SBOM attached to each release; committed uv.lock; enforce_admins branch protection
  • Fixes: defusedxml for PubMed XML (S314); TSA-URL scheme guard (S310)

Bug fixes

  • Library dedupe no longer misses DOIs in non-canonical form (prefix/case)
  • corpus_diff degrades gracefully instead of crashing on a missing to_snapshot_id

Types & safety

  • Whole-package mypy — zero ignore_errors backlog (162/162 files)
  • Dual-rating flag/score regression tests (blinding window, adjudication rules)

Full notes: CHANGELOG.md (0.43.0).

Assets 6
Loading