v0.6.0

kpubdata 0.6.0 removes 141 datasets whose upstream service no longer exists, adds 36 datasets and four providers, and closes several ways an API key could leak. The removal is breaking: check the list below before upgrading. The catalogue goes from 261 datasets to 156.

pip install "kpubdata==0.6.0"

Security

• API keys are masked in transport logs and exception messages, and when a URL had to be masked the original httpx exception is no longer chained, so the key does not surface through tracebacks either (#260, #331). A key that seoul carries in the URL path is masked too (#354).
• The response cache no longer shares entries between credentials. Sensitive parameters and Authorization headers are now part of the cache key as a SHA-256 fingerprint (#263).
• datago.generic refuses hosts other than data.go.kr instead of logging a warning and sending your key anyway. Add hosts with KPUBDATA_DATAGO_EXTRA_HOSTS (#261).
• HTTP response bodies are capped at 50 MiB by default (TransportConfig.max_response_bytes) (#271).

Behaviour changes — check before upgrading

• BREAKING: 141 retired datasets removed — 136 from localdata (195 → 59) and 5 from datago: building_area, building_floor, building_recap_title, building_title and metro_path. A body-level re-probe on 2026-09-09 found no OpenAPI service behind them, so they are gone from the catalogue (#411, #412).
• Canonical query parameters are validated before the adapter is called. page, page_size, cursor, start_date, end_date, fields and sort are checked by name and type, and a bad value raises InvalidRequestError rather than TypeError/ValueError or being passed through as a filter. For example, dataset.list(page="1") and an empty cursor now raise (#264, #328).
• list_all(max_pages=...) and kpubdata fetch --all -p max_pages=N reject anything but a positive integer with InvalidRequestError (#320), and an invalid cache TTL environment value is rejected (#316).
• Registering a provider whose catalogue makes a false capability claim now raises CapabilityContractError (#231, #258).
• 15 existing datasets (12 datago, 3 localdata) are now served from declarative YAML specs instead of adapter code. Dataset ids are unchanged: a spec replaces the catalogue entry of the same name.
• KPubDataConfig.from_env() and Client.from_env() take typed keyword parameters instead of **kwargs (#276).
• kpubdata now depends on PyYAML, and the xml and mcp extras accept newer major versions (xmltodict<2, mcp<3).

Added

• New providers: neis (school meals and school information, #164, #218), fds (MFDS food traceability, #165), korean (Standard Korean Dictionary search, #222) and kipris (patent family search, #223). sgis is now registered in the default Client(); in 0.3.0–0.5.0 it had to be added with Client.register_provider() (#332).
• datago: weather — asos_daily, asos_hourly (#217), mid-term forecasts mid_fcst, mid_land_fcst, mid_sea_fcst, mid_ta (#251) and ultra_srt_fcst; air quality — airkorea_station_realtime, airkorea_forecast (#224) and air_station; nine MFDS DUR drug-safety datasets (dur_*); and agri_price (#248), bond_price and sports_facility (#163, #166), road_traffic (#87), subway_passengers (#93, #259) and culture_facility.
• seoul: bike_realtime, bike_station_master, park_info (#246), park_usage (#227) and citydata (#225).
• bok: money_supply (legacy M2 series, 1986-01 to 2004-09) (#245).
• Declarative dataset specs: a dataset can be defined in YAML under src/kpubdata/specs/, validated against a JSON Schema; 18 specs ship in this release (#378).
• kpubdata scaffold provider <name> generates the skeleton of a new provider adapter (#61, #257).
• with_retry_async and an injectable sleep function for retry backoff (#270).

Fixed

• Concurrent first use of a provider no longer raises ProviderNotRegisteredError, and a failing provider factory can be retried (#262).
• bok treats every RESULT payload as an error regardless of its code; seoul detects top-level API errors before parsing the envelope; lofin URL-encodes filter values.
• Catalogue search reuses its index across unchanged listings (#279).

For contributors

A record/replay verification pipeline (make record, make verify, KPUBDATA_MODE=replay), bulk catalogue-to-spec migration scripts, daily live smoke tests with drift reporting (#382), an MkDocs site, and the cross-repository compatibility matrix and release policy (#233, #256).

Full changelog: v0.5.0...v0.6.0