boti-data 1.3.4__tar.gz → 1.3.5__tar.gz

{boti_data-1.3.4 → boti_data-1.3.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boti-data
-Version: 1.3.4
+Version: 1.3.5
 Summary: Data infrastructure for the Boti ecosystem
 Author: Luis Valverde
 Maintainer-email: Luis Valverde <lvalverdeb@gmail.com>

{boti_data-1.3.4 → boti_data-1.3.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "boti-data"
-version = "1.3.4"
+version = "1.3.5"
 description = "Data infrastructure for the Boti ecosystem"
 readme = "README.md"
 requires-python = ">=3.13"

{boti_data-1.3.4 → boti_data-1.3.5}/src/boti_data/datacube/contract.py

@@ -65,9 +65,9 @@ class DatacubeRequest(BaseModel):
     model_config = ConfigDict(extra="allow", arbitrary_types_allowed=True)
 
     filters: dict[str, Any] = Field(default_factory=dict)
-    cube: str | None = Field(default=None)
+    cube: str | None = Field(default=None, max_length=256)
     limit: int | None = Field(default=None)
-    return_type: str | None = Field(default=None)
+    return_type: str | None = Field(default=None, max_length=32)
 
 
 class DatacubeConfig(ResourceConfig):

{boti_data-1.3.4 → boti_data-1.3.5}/src/boti_data/db/partitioned_types.py

@@ -123,8 +123,8 @@ class SqlPartitionedLoadRequest(BaseModel):
     params: dict[str, Any] = Field(default_factory=dict)
     partitioned: bool = True
     partition_strategy: PartitionStrategy = "offset"
-    partition_column: str | None = None
-    order_column: str | None = None
+    partition_column: str | None = Field(default=None, max_length=256)
+    order_column: str | None = Field(default=None, max_length=256)
     chunk_size: int = Field(default=50_000, ge=1)
     single_fetch_threshold: int | None = Field(default=None, ge=0)
     limit: int | None = Field(default=None, ge=1)

{boti_data-1.3.4 → boti_data-1.3.5}/src/boti_data/db/sql_model_registry.py

@@ -9,6 +9,7 @@ from __future__ import annotations
 
 import asyncio
 import hashlib
+import logging
 import re
 import sys
 import threading
@@ -25,6 +26,8 @@ from boti_data.db.sql_model_module_injection import register_as_module_attribute
 from boti_data.db.sql_model_registry_types import DefaultBase, ModelBuildContext, RegistryConfig
 from boti_data.db.sqlalchemy_async import ensure_greenlet_available
 
+_logger = logging.getLogger(__name__)
+
 try:
     # Importing this module has the side effect of registering pgvector's
     # 'vector' type name into SQLAlchemy's Postgres dialect
@@ -34,8 +37,10 @@ try:
     # works the same as before for consumers who never touch pgvector and
     # haven't installed boti-data[pgvector].
     import pgvector.sqlalchemy  # noqa: F401
-except ImportError:
-    pass
+except ImportError as exc:
+    # Debug level only — this is an expected/best-effort probe for the
+    # overwhelming majority of consumers who never install the pgvector extra.
+    _logger.debug("pgvector.sqlalchemy not available, vector type registration skipped: %s", exc)
 
 
 class SqlModelRegistry:

{boti_data-1.3.4 → boti_data-1.3.5}/src/boti_data/enrichment/transformers.py

@@ -82,7 +82,7 @@ class RowFilter:
     async def transform(self, df: pd.DataFrame, **kwargs: Any) -> pd.DataFrame:
         for expr in self._predicates:
             _reject_dunder_expr(expr)
-            mask = df.eval(expr)
+            mask = df.eval(expr)  # nosec CWE-94 -- dunder-chain rejected above; see class docstring's Security section
             df = df.loc[mask].reset_index(drop=True)
         return df
 
@@ -116,7 +116,7 @@ class DerivedColumn:
     async def transform(self, df: pd.DataFrame, **kwargs: Any) -> pd.DataFrame:
         for name, expr in self._columns.items():
             _reject_dunder_expr(expr)
-            df[name] = df.eval(expr)
+            df[name] = df.eval(expr)  # nosec CWE-94 -- dunder-chain rejected above; see class docstring's Security section
         return df
 
 

{boti_data-1.3.4 → boti_data-1.3.5}/src/boti_data/gateway/load_request.py

@@ -17,7 +17,7 @@ class GatewayLoadRequest(BaseModel):
     model_config = ConfigDict(extra="forbid", arbitrary_types_allowed=True)
 
     # Source
-    sql: str | None = None
+    sql: str | None = Field(default=None, max_length=100_000)
     statement: Any = None
     model: Any = None
     filters: dict[str, Any] = Field(default_factory=dict)
@@ -43,13 +43,13 @@ class GatewayLoadRequest(BaseModel):
     # IN-chunking controls
     in_chunk_size: int | None = None
     in_chunk_concurrency: int | None = None
-    in_chunk_strategy: str = "auto"
+    in_chunk_strategy: str = Field(default="auto", max_length=32)
 
     # Partitioned load controls
     partitioned: bool | None = None
-    partition_strategy: str | None = None
-    partition_column: str | None = None
-    order_column: str | None = None
+    partition_strategy: str | None = Field(default=None, max_length=32)
+    partition_column: str | None = Field(default=None, max_length=256)
+    order_column: str | None = Field(default=None, max_length=256)
     chunk_size: int | None = Field(default=None, ge=1)
     single_fetch_threshold: int | None = Field(default=None, ge=0)
     max_concurrent_fetches: int | None = None

{boti_data-1.3.4 → boti_data-1.3.5}/src/boti_data/gateway/post_process.py

@@ -226,4 +226,4 @@ class PostProcessor:
         logger.info(
             f"Gateway load completed elapsed={elapsed:.2f}s metrics={describe_frame(frame)}"
         )
-        logger.info(f"Gateway load graph metrics={describe_frame(frame)}")
+        logger.info(f"Gateway load graph metrics={describe_frame(frame)}")  # nosec CWE-117 -- counts/engine-name only, never data-derived

{boti_data-1.3.4 → boti_data-1.3.5}/src/boti_data/gateway/requests.py

@@ -50,8 +50,8 @@ class DataFrameParams(BaseModel):
     fieldnames: tuple[str, ...] | None = None
     column_names: list[str] | None = None
     chunk_size: int | None = Field(default=None, ge=1)
-    index_col: str | None = None
-    datetime_index: str | None = None
+    index_col: str | None = Field(default=None, max_length=256)
+    datetime_index: str | None = Field(default=None, max_length=256)
     return_type: ReturnType = "dask"
     execution_mode: ExecutionMode = "auto"
 
@@ -133,7 +133,7 @@ class SqlLoadRequest(BaseModel):
 
     model_config = ConfigDict(extra="forbid", arbitrary_types_allowed=True)
 
-    sql: str | None = None
+    sql: str | None = Field(default=None, max_length=100_000)
     statement: Any | None = None
     model: Any | None = None
     filters: dict[str, Any] = Field(default_factory=dict)

{boti_data-1.3.4 → boti_data-1.3.5}/src/boti_data/gateway/sql_strategy_configured_async.py

@@ -52,7 +52,7 @@ async def aload_configured_execute_async_resource(
     model, stmt = await ctx.get_configured_select_async(resource, ctx.db_columns)
     t1 = perf_counter()
     if diagnostics:
-        resource.logger.info(f"Configured async select reflect_select={t1 - t0:.3f}s")
+        resource.logger.info(f"Configured async select reflect_select={t1 - t0:.3f}s")  # nosec CWE-117 -- float only
     if ctx.execution_mode == "lazy":
         t2 = perf_counter()
         partitioned_options = build_partitioned_load_options(
@@ -67,7 +67,7 @@ async def aload_configured_execute_async_resource(
         request = build_sql_partitioned_request(options_dict)
         t3 = perf_counter()
         if diagnostics:
-            resource.logger.info(f"Build partitioned request elapsed={t3 - t2:.3f}s")
+            resource.logger.info(f"Build partitioned request elapsed={t3 - t2:.3f}s")  # nosec CWE-117 -- float only
         return await run_async_partitioned_request(ctx, resource, request)
 
     df = await read_sql_async(resource, trusted_sql_request(ctx, statement=stmt, model=model))

{boti_data-1.3.4 → boti_data-1.3.5}/src/boti_data.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boti-data
-Version: 1.3.4
+Version: 1.3.5
 Summary: Data infrastructure for the Boti ecosystem
 Author: Luis Valverde
 Maintainer-email: Luis Valverde <lvalverdeb@gmail.com>