Netdryrun v0.3.1

Upgrade if you use 0.3.0. A pre-launch audit found ways 0.3.0 could report passed without testing what the file said. 0.3.1 closes them, along with the security fixes listed in the changelog. 0.3.0 is yanked on PyPI: exact pins still install it.

Run netdryrun validate after upgrading. Some files 0.3.0 accepted are now refused (exit 2). Each of those was a check that didn't test what it said: a misspelled top-level key, a quoted "false", an unknown afi or protocol, a duplicate key, min: 0, vrf: all.

• Advisory, with files you can rerun in seconds against both versions: advisories/0.3.0-false-pass
• Failure scenarios are judged only once the fault is visible in BGP. Negative checks wait for every BGP session on their node.
• Drivers never read an error as "nothing": an unknown VRF, a failed command or unrecognized output is an error, not "no routes".
• New: the inject_routes fault, the srl-hidden-leak example, a JSON Schema for reports, MCP path handling on WSL, and pipx install netdryrun in the docs (Ubuntu 24.04 refuses a plain pip install).
• Verdict Corpus rerun on the released 0.3.1: v1 24/30 (unchanged), v2 17/18 (case 18, a removed aggregate discard route, was a false pass on earlier builds and is now rejected). These are fixed test sets that guard against regressions, not an accuracy rate for your network: results and method.
• How this release was checked: releases/0.3.1/GATE.md (cleared, including the proof from PyPI after publishing). The record covers the static checks, unit tests on Python 3.10–3.14, verdict invariants, mutation testing of the verdict logic (every surviving mutant killed or shown harmless), a live lab matrix with chaos tests, and an independent review. The wheel and sdist carry signed build provenance (netdryrun-v0.3.1.sigstore.json).

Full list: CHANGELOG.