Skip to content

views-datafactory 1.10.0

Choose a tag to compare

View all tags
@Polichinel Polichinel released this 31 Jul 22:25
v1.10.0
d72602b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Dependency hygiene and governance repair. Minor, not patch — the dependency set changed for consumers.

Upgrading

pip install --upgrade views-datafactory        # or: views-datafactory[pandas]

Nothing breaks. pandas is now declared as an optional extra rather than a required dependency, but you will still get pandas either way — xarray requires it. See the caveat below.

Packaging

  • pandas moved to a [pandas] extra. Honest caveat: this gates nothing today. xarray is a required dependency and xarray requires pandas, so no installable configuration of this package lacks it — verified per-package in a clean venv. The change makes pandas not imported, not not installed. #381 asks whether the remote zarr reader can drop xarray; that is what would make the extra real.
  • Import purity is enforced by subprocess probes. In-process assertions are worthless once pytest has loaded the module.
  • matplotlib is still a required dependency, deliberately. It was demoted, then restored: views-hydranet imports it at module level without declaring it, and four views-models environments receive it through us. Removing it would break clean builds while leaving upgraded local environments green, because pip never prunes orphaned transitive dependencies. Tracked as views-hydranet#215.
  • Adapters split so legacy and frame-native outputs no longer share a file.

Consumer surface

  • load_dataset(storage_options=...) — a new data source can supply its own credentials instead of waiting on a netrc entry on our server. Local paths are unaffected.

Security and governance

  • Branch protection on main and development with enforce_admins: true. No bypass, including for the owner.
  • All GitHub Actions pinned to commit SHAs.
  • Credential redaction at the shared HTTP layer — API tokens no longer reach logs or tracebacks via request URLs.
  • ADR-026 gained a credential ownership table with named roles and review dates, and its incorrect "Public GitHub is safe" claim was corrected.
  • C-330 retracted. It claimed no log rotation existed; rotation had been configured on the server since 2026-03-31. The entry inferred world state from repository contents.
  • C-164 re-audited: half its deferred inventory was already complete, and its "9 sources" unit counted no artifact in the repo. Corrected in eight places.

Verification

ruff clean · full suite 2320 passed · twine check 2 PASSED · wheel contains only the nine datafactory_* packages · sdist contains no reports/, docs/, or data/.

Full changelog: v1.9.0...v1.10.0

Assets 2
Loading