release: edgeproc-core 0.4.3 - #55
Merged
Merged
Conversation
Cut [Unreleased] into 0.4.3 (Problem Details reserved-member fix, Dagger release path, offline architecture map) and bump pyproject, uv.lock, SECURITY.md, README, and the installation guide to 0.4.3. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N5FAenn7CZm8tswqWR9PjJ
Point every documented immutable source pin at 7449460, the 0.4.3 release-preparation commit, so a source install carries the Problem Details fix and reports the current release. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N5FAenn7CZm8tswqWR9PjJ
release-candidate.yml passed `--tag=${{ inputs.tag }}` in the args of
dagger/dagger-for-github, which pastes args into bash unquoted, so a
crafted workflow_dispatch tag could run commands on the runner and
upload its own wheel for publish.yml. The tag now reaches shell only as
the TAG env var, a separate step rejects anything but vX.Y.Z, the pinned
action only installs the Dagger CLI, and the release call runs in a
quoted run: step. A workflow test now fails on any inputs.*,
github.event.*, or github.head_ref expression in a run: body or a Dagger
action input, and executes the tag guard against injection payloads.
Problem Details extension members now keep only exact-str keys and
str/int/finite-float values (bool dropped, subclasses narrowed to the
builtin), and reserve __proto__, constructor, prototype, and toJSON,
matching @edgeproc/errors. This closes the __proto__ passthrough, the
non-scalar/non-finite value passthrough, and the str-subclass key that
evaded the reserved-name check to forge "status" and a duplicate "type".
Also replace the installation guide's ls-remote | grep commit check,
which could never match a pin behind a tip, with git fetch + cat-file,
guarded by a docs-contract test; describe the fixes under 0.4.3.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N5FAenn7CZm8tswqWR9PjJ
Point every documented immutable source pin at 7b3ab4d, the commit that carries the release-dispatch and Problem Details wire-member fixes, so a source install contains them and reports 0.4.3. Docs only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N5FAenn7CZm8tswqWR9PjJ
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Prepares edgeproc-core 0.4.3, a patch release that ships #54: reserved RFC 9457 members (
type,title,status,detail,instance) can no longer be injected through Problem Details params.pyproject.tomland theuv.lockself-version move to 0.4.3.SECURITY.mdnow supports>=0.4.3only. The README anddocs/installation-guide.mdpins and examples are updated.## [0.4.3] — 2026-09-23covers Security (fix(errors): keep reserved RFC 9457 members out of Problem Details params #54), Fixed, Changed (Dagger-built releases), and Added (the architecture map). There's a fresh[Unreleased]section, and the compare links are updated.7449460, becausetests/test_docs_contract.pyrequires every documented source SHA to report exactly the current version. This follows the 0.4.2 precedent (release: prepare 0.4.2 source-pin contract #40 → docs: finalize protected 0.4.2 source pin #41).Merge with a merge commit, not squash: the documented source pin names
7449460, which must stay reachable frommain.Release procedure (after merge)
Daggercheck goes green on the merge commit.v0.4.3on that exactmainHEAD. The tag alone publishes nothing.release-candidate.yml) onmainwithtag=v0.4.3.publish.ymlthen publishes to PyPI via OIDC.Tests
uv run poe gate: ruff, format, mypy --strict and xenon A/A/A pass. 307 tests passed (99.28% coverage), and the docs-import check ran against the built 0.4.3 wheel.🤖 Generated with Claude Code
https://claude.ai/code/session_01N5FAenn7CZm8tswqWR9PjJ
Generated by Claude Code