Code Polishy 0.31.6

• Support published Python library compatibility constraints in runtime and
  optional metadata through exact supplyChain.pythonLibraries manifest paths.
  Require matching exact development-group pins covering dependency extras and
  environment markers, and check version membership with the pinned PEP 440
  parser, including prereleases and local version suffixes.
• Use the same tested development pins for external Python dependency contracts,
  retaining exact lock and installed-distribution evidence with library ranges.
• Preserve distinct Python registry constraints through inventory and retain
  frozen lock verification for dependency resolution. Development requirements,
  build requirements, tool pins and resolved dependency audits remain enforced.
• Preserve Python dependency groups, extras and markers in dependency review,
  and identify published compatibility changes as package API changes even when
  the lock is unchanged.
• Document library adoption and clean-wheel minimum-version verification.
  Consumers must upgrade their Code Polishy lock before declaring
  supplyChain.pythonLibraries; existing configurations retain exact-pin policy.
• Authorize command producers to receive the private artifact output path and
  override inherited output settings so generated artifacts stay within the
  private evidence directory. Contributed by
  Jeff Musgrave in
  #18.
• Assess CVE-2026-116587 for the pinned scanner's isolated execution paths with
  an exact OpenVEX statement and source-backed review. Preserve the observed
  finding in the accepted-findings report.

Native archives for Code Polishy 0.31.6.

Source revision: 190a0d3
Publication index SHA-256: ce046df26c7f471aaef62c4ca3d0176168c01501c776aeb4c1c3757dc2a06171
OCI image: ghcr.io/riteofstring/code-polishy:v0.31.6@sha256:7ed64bf87911f069ab3215ab044d611ddec0b391db03bcb7e52ef4eb7941094b