fast-mail-parser-ng 0.6.0__tar.gz

fast_mail_parser_ng-0.6.0/.cargo/config.toml

@@ -0,0 +1,11 @@
+[target.x86_64-apple-darwin]
+rustflags = [
+    "-C", "link-arg=-undefined",
+    "-C", "link-arg=dynamic_lookup",
+]
+
+[target.aarch64-apple-darwin]
+rustflags = [
+    "-C", "link-arg=-undefined",
+    "-C", "link-arg=dynamic_lookup",
+]

fast_mail_parser_ng-0.6.0/.gitattributes

@@ -0,0 +1,4 @@
+# RFC test fixtures are parsed byte-for-byte and use CRLF (the RFC 5322 line
+# ending). Keep them verbatim so Git's autocrlf never rewrites the bytes the
+# tests assert against.
+tests/data/rfc/*.eml -text

fast_mail_parser_ng-0.6.0/.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  # Rust crate dependencies (Cargo.toml / Cargo.lock at the repo root).
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  # GitHub Actions used by the workflows in .github/workflows.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

fast_mail_parser_ng-0.6.0/.github/scripts/check_benchmark.py

@@ -0,0 +1,78 @@
+#!/usr/bin/env python3
+"""Performance quality gate for CI.
+
+Reads a pytest-benchmark JSON report and fails the build unless
+``fast_mail_parser`` is at least ``BENCH_MIN_SPEEDUP`` times faster than the
+pure-Python ``mail-parser`` baseline.
+
+The comparison uses each benchmark's *minimum* time, not the mean: on shared CI
+runners the min is the least noise-prone metric (the cleanest observed run), so
+the gate is reproducible and does not flake. Both libraries are benchmarked on
+the same runner in the same run, so the *ratio* is independent of the runner's
+absolute speed (the README reports ~8x). Getting faster always passes; only a
+regression below the configured floor fails.
+
+Usage:
+    python check_benchmark.py [benchmark.json]
+
+Environment:
+    BENCH_MIN_SPEEDUP   Minimum required speedup ratio (default: 4.0).
+"""
+import json
+import os
+import sys
+
+
+def min_for(benchmarks, predicate, label):
+    matches = [b for b in benchmarks if predicate(b["name"])]
+    if not matches:
+        sys.exit(f"::error::benchmark for {label} not found in report")
+    if len(matches) > 1:
+        names = ", ".join(b["name"] for b in matches)
+        sys.exit(f"::error::ambiguous benchmark match for {label}: {names}")
+    return matches[0]["stats"]["min"]
+
+
+def main():
+    path = sys.argv[1] if len(sys.argv) > 1 else "benchmark.json"
+    threshold = float(os.environ.get("BENCH_MIN_SPEEDUP", "4.0"))
+
+    with open(path) as fh:
+        benchmarks = json.load(fh)["benchmarks"]
+
+    fast = min_for(
+        benchmarks, lambda n: "fast_mail_parser" in n, "fast_mail_parser"
+    )
+    baseline = min_for(
+        benchmarks,
+        lambda n: "mail_parser" in n and "fast" not in n,
+        "mail-parser (baseline)",
+    )
+
+    speedup = baseline / fast
+    fast_ms, base_ms = fast * 1e3, baseline * 1e3
+
+    summary = (
+        f"### Benchmark quality gate\n\n"
+        f"| Library | Min time | Speedup |\n"
+        f"|---|---|---|\n"
+        f"| fast_mail_parser | {fast_ms:.3f} ms | {speedup:.2f}x |\n"
+        f"| mail-parser (baseline) | {base_ms:.3f} ms | 1.00x |\n\n"
+        f"Required floor: **{threshold:.2f}x** — "
+        f"{'PASS ✅' if speedup >= threshold else 'FAIL ❌'}\n"
+    )
+    print(summary)
+    step_summary = os.environ.get("GITHUB_STEP_SUMMARY")
+    if step_summary:
+        with open(step_summary, "a") as fh:
+            fh.write(summary)
+
+    if speedup < threshold:
+        sys.exit(
+            f"::error::performance regression: fast_mail_parser is only "
+            f"{speedup:.2f}x faster than mail-parser (floor is {threshold:.2f}x)"
+        )
+
+
+if __name__ == "__main__":
+    main()

fast_mail_parser_ng-0.6.0/.github/workflows/publish.yml

@@ -0,0 +1,217 @@
+name: Publish
+
+# Release builds the multi-platform wheels + sdist and publishes to PyPI.
+# workflow_dispatch builds everything WITHOUT publishing — use it to validate
+# the pipeline (artifacts are uploaded) without cutting a release.
+#
+# Wheels target the CPython stable ABI (cp311-abi3, enabled via the
+# pyo3/abi3-py311 cargo feature): each platform job builds ONE wheel that
+# covers every CPython >= 3.11, including versions released after this build.
+# A new CPython minor requires no changes to this workflow.
+on:
+  release:
+    types: [created]
+  workflow_dispatch:
+
+concurrency:
+  group: publish-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  linux:
+    runs-on: ${{ matrix.platform.runner }}
+    strategy:
+      matrix:
+        platform:
+          - runner: ubuntu-latest
+            target: x86_64
+          - runner: ubuntu-latest
+            target: x86
+          - runner: ubuntu-latest
+            target: aarch64
+          - runner: ubuntu-latest
+            target: armv7
+          - runner: ubuntu-latest
+            target: s390x
+          - runner: ubuntu-latest
+            target: ppc64le
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: 3.x
+      - name: Build wheels
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        with:
+          # Pinned: see rust-toolchain.toml. 1.98.0 costs this crate ~26%.
+          rust-toolchain: 1.97.1
+          target: ${{ matrix.platform.target }}
+          args: --release --out dist
+          sccache: "true"
+          manylinux: auto
+      - name: Upload wheels
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: wheels-linux-${{ matrix.platform.target }}
+          path: dist
+
+  musllinux:
+    runs-on: ${{ matrix.platform.runner }}
+    strategy:
+      matrix:
+        platform:
+          - runner: ubuntu-latest
+            target: x86_64
+          - runner: ubuntu-latest
+            target: x86
+          - runner: ubuntu-latest
+            target: aarch64
+          - runner: ubuntu-latest
+            target: armv7
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: 3.x
+      - name: Build wheels
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        with:
+          # Pinned: see rust-toolchain.toml. 1.98.0 costs this crate ~26%.
+          rust-toolchain: 1.97.1
+          target: ${{ matrix.platform.target }}
+          args: --release --out dist
+          sccache: "true"
+          manylinux: musllinux_1_2
+      - name: Upload wheels
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: wheels-musllinux-${{ matrix.platform.target }}
+          path: dist
+
+  windows:
+    runs-on: ${{ matrix.platform.runner }}
+    strategy:
+      matrix:
+        platform:
+          - runner: windows-latest
+            target: x64
+          - runner: windows-latest
+            target: x86
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: 3.x
+          architecture: ${{ matrix.platform.target }}
+      - name: Build wheels
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        with:
+          # Pinned: see rust-toolchain.toml. 1.98.0 costs this crate ~26%.
+          rust-toolchain: 1.97.1
+          target: ${{ matrix.platform.target }}
+          args: --release --out dist
+          sccache: "true"
+      - name: Upload wheels
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: wheels-windows-${{ matrix.platform.target }}
+          path: dist
+
+  macos:
+    runs-on: ${{ matrix.platform.runner }}
+    strategy:
+      matrix:
+        platform:
+          # Only arm64 macOS wheels. The macos-13 (x86_64) runner is being
+          # retired and became unschedulable (its job sat queued until GitHub
+          # cancelled the release). x86_64 macOS installs fall back to the sdist.
+          - runner: macos-14
+            target: aarch64
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: 3.x
+      - name: Build wheels
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        with:
+          # Pinned: see rust-toolchain.toml. 1.98.0 costs this crate ~26%.
+          rust-toolchain: 1.97.1
+          target: ${{ matrix.platform.target }}
+          args: --release --out dist
+          sccache: "true"
+      - name: Upload wheels
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: wheels-macos-${{ matrix.platform.target }}
+          path: dist
+
+  sdist:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Build sdist
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        with:
+          command: sdist
+          args: --out dist
+      - name: Upload sdist
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: wheels-sdist
+          path: dist
+
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    needs: [linux, musllinux, windows, macos, sdist]
+    permissions:
+      # OIDC token for PyPI Trusted Publishing + artifact signing
+      id-token: write
+      # Used to upload release artifacts
+      contents: write
+      # Used to generate artifact attestation
+      attestations: write
+    steps:
+      - name: Collect all artifacts into dist/
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          path: dist
+          merge-multiple: true
+          # download-artifact@v8 verifies each artifact's digest against the value
+          # upload-artifact@v7 recorded; that pairing can report a spurious
+          # mismatch even though the download itself succeeds. Warn instead of
+          # failing the release — integrity is still attested by the provenance
+          # step below.
+          digest-mismatch: warn
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-path: "dist/*"
+      # Publish via PyPI Trusted Publishing (OIDC) — no long-lived credentials.
+      # OIDC also enables PEP 740 attestations (attestations: true); these are
+      # silently IGNORED if an explicit username/password is set, so do NOT add
+      # `user`/`password` here.
+      #
+      # The distribution is `fast-mail-parser-ng` (the import path stays
+      # `fast_mail_parser`; see [tool.maturin] module-name in pyproject.toml).
+      # Requires a one-time PyPI setup — add a Trusted Publisher for
+      # namecheap/fast_mail_parser, workflow "publish.yml", environment blank:
+      #
+      #   before the project exists (pending publisher, creates it on first
+      #   upload):  https://pypi.org/manage/account/publishing/
+      #   afterwards:
+      #     https://pypi.org/manage/project/fast-mail-parser-ng/settings/publishing/
+      #
+      # The `environment:` field there must match this job exactly — this job
+      # declares none, so leave it blank.
+      - name: Publish to PyPI
+        if: ${{ github.event_name == 'release' && startsWith(github.ref, 'refs/tags/') }}
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        with:
+          packages-dir: dist
+          skip-existing: true
+          attestations: true

fast_mail_parser_ng-0.6.0/.github/workflows/test.yml

@@ -0,0 +1,222 @@
+name: Test
+
+# Runs on pushes to the default branch AND on every pull request, so the
+# matrix can be used as a required merge gate. (Baseline only ran on push.)
+on:
+  push:
+    branches: [master]
+  pull_request:
+  workflow_dispatch:
+
+# Cancel superseded runs for the same ref to save runner minutes.
+concurrency:
+  group: test-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  # ---------------------------------------------------------------------------
+  # Lint. rustfmt, mypy --strict, and ruff are enforced (blocking); clippy
+  # stays advisory (continue-on-error) until its debt clears, and each runs
+  # regardless of the others:
+  #   - rustfmt -> blocking (source is rustfmt-clean).
+  #   - clippy  -> flip to blocking after the str->bytes fix (#19).
+  #   - mypy    -> blocking: `mypy --strict fast_mail_parser/` is clean (#42).
+  #   - ruff    -> blocking: `ruff check .` is clean (config in ruff.toml).
+  # ---------------------------------------------------------------------------
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+      - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
+        with:
+          # Must match rust-toolchain.toml: that file takes precedence over this
+          # input, so requesting `stable` here installs rustfmt/clippy for a
+          # toolchain cargo then does not use ("'cargo-fmt' is not installed for
+          # the toolchain"). Only an explicit RUSTUP_TOOLCHAIN env var overrides
+          # the file — see the cargo audit job.
+          toolchain: 1.97.1
+          components: rustfmt, clippy
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+
+      - name: cargo fmt --check
+        run: cargo fmt --all -- --check
+
+      # clippy::cast_possible_truncation pinpoints the str->bytes corruption bug.
+      - name: cargo clippy
+        if: always()
+        run: cargo clippy --all-targets -- -D warnings -W clippy::cast_possible_truncation
+        continue-on-error: true
+
+      # Blocking: `mypy --strict fast_mail_parser/` type-checks clean today.
+      - name: mypy --strict
+        if: always()
+        run: |
+          python -m pip install --upgrade pip mypy
+          mypy --strict fast_mail_parser/
+
+      # Blocking: `ruff check .` is clean (config in ruff.toml).
+      - name: ruff check
+        if: always()
+        run: |
+          python -m pip install ruff
+          ruff check .
+
+  # ---------------------------------------------------------------------------
+  # Supply-chain audit. Blocking (no continue-on-error): the dependency stack is
+  # current (PyO3 0.29) and the Cargo.lock audits clean, so a new advisory
+  # against any dependency should fail the build and gate the PR rather than pass
+  # silently. (It was previously advisory only because the stack was stale and a
+  # fresh advisory against a pinned dep would have blocked unrelated PRs.)
+  # rust-toolchain.toml pins the build to 1.97.1 (see that file) and the MSRV
+  # (1.83) is declared via `rust-version` in Cargo.toml; this job sets
+  # RUSTUP_TOOLCHAIN=stable explicitly so cargo-audit always audits against
+  # current stable regardless of that pin.
+  #
+  # cargo-audit is `cargo install`ed from source (~3 min — previously the
+  # slowest job by far). The compiled binary is cached and keyed on the pinned
+  # CARGO_AUDIT_VERSION: a cache hit skips the build (restores in seconds); a
+  # miss builds it once and caches it.
+  #
+  # Cache invalidation: to upgrade cargo-audit, bump CARGO_AUDIT_VERSION below.
+  # That installs the new version AND invalidates the cache in one change — the
+  # version IS the cache key, so there is no separate suffix to remember. The
+  # key is intentionally NOT tied to the rustc/cargo version: the binary runs
+  # fine across toolchain updates, and keying on it would force a needless
+  # ~3-min rebuild on every stable bump. The RustSec advisory DB is fetched
+  # fresh on every run, so findings stay current regardless of the cached
+  # binary version.
+  # ---------------------------------------------------------------------------
+  security-audit:
+    name: cargo audit
+    runs-on: ubuntu-latest
+    env:
+      RUSTUP_TOOLCHAIN: stable
+      # Bump to upgrade cargo-audit; this also invalidates the binary cache.
+      CARGO_AUDIT_VERSION: "0.22.2"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
+        with:
+          toolchain: stable
+      - name: Cache cargo-audit binary
+        id: cache-cargo-audit
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ~/.cargo/bin/cargo-audit
+          key: cargo-audit-${{ runner.os }}-${{ env.CARGO_AUDIT_VERSION }}
+      - name: Install cargo-audit
+        if: steps.cache-cargo-audit.outputs.cache-hit != 'true'
+        run: cargo install cargo-audit --version ${{ env.CARGO_AUDIT_VERSION }} --locked
+      - name: cargo audit
+        run: cargo audit
+
+  # ---------------------------------------------------------------------------
+  # Build once, test everywhere — the real merge gate. A single cp311-abi3
+  # wheel is built (stable ABI, see pyo3/abi3-py311 in Cargo.toml), then that
+  # SAME wheel is installed and tested on every supported CPython (3.11–3.14).
+  # This verifies the abi3 promise instead of assuming it: what ships to PyPI
+  # is one wheel per platform, so CI must not rebuild per Python version.
+  # ---------------------------------------------------------------------------
+  build-wheel:
+    name: Build abi3 wheel
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.11"
+      - name: Build wheel
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        with:
+          # Pinned: see rust-toolchain.toml. 1.98.0 costs this crate ~26%.
+          rust-toolchain: 1.97.1
+          args: --release --out dist
+          sccache: "true"
+          manylinux: auto
+      - name: Upload wheel
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: test-wheel
+          path: dist
+
+  test:
+    name: Test (py${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    needs: build-wheel
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13", "3.14"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: test-wheel
+          path: dist
+          # Same upload@v7/download@v8 pairing as publish.yml: digest checks
+          # can report a spurious mismatch even though the download succeeds.
+          digest-mismatch: warn
+      - name: Install the built wheel + test dependencies
+        run: pip install "$(ls dist/*.whl)[test]"
+      - name: Test
+        run: make test
+
+  # ---------------------------------------------------------------------------
+  # Benchmark quality gate. The benchmark used to run inside every matrix cell
+  # (6x redundant, slow). It now runs once here and acts as a performance gate:
+  # fast_mail_parser must stay at least BENCH_MIN_SPEEDUP times faster than the
+  # pure-Python mail-parser baseline (README reports ~8x). The ratio is measured
+  # on the same runner in the same run, so it is hardware-independent and stable.
+  # Getting faster always passes; only regressions below the floor fail.
+  # ---------------------------------------------------------------------------
+  benchmark:
+    name: Benchmark quality gate
+    runs-on: ubuntu-latest
+    # PR merge gate only: run on pull_request and workflow_dispatch, skip on
+    # push to master — re-running the benchmark post-merge is wasteful (#47).
+    if: github.event_name != 'push'
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+          cache: pip
+      - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
+        with:
+          toolchain: 1.97.1
+      # Cache the cargo registry and build artifacts so `make install` reuses
+      # compiled crates across runs instead of rebuilding from scratch (#47).
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - name: Install the package + test dependencies
+        run: |
+          make install
+          make install-test
+      - name: Run benchmark
+        run: pytest -v tests/benchmark --benchmark-min-rounds=25 --benchmark-json=benchmark.json
+      - name: Enforce performance gate
+        env:
+          # Gate on min-time ratio. The optimized parser measures ~7.8–8.7x on
+          # CI; the ratio swings with the runner's CPU (the pure-Python baseline
+          # scales differently than the Rust extension), so the README's ~8x is
+          # the typical figure, not a hard floor. Gate at 7x — below the observed
+          # range so legitimate (perf-neutral) PRs don't flake, while still
+          # catching real regressions.
+          BENCH_MIN_SPEEDUP: "7.0"
+        run: python .github/scripts/check_benchmark.py benchmark.json
+      - name: Upload benchmark report
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: benchmark-json
+          path: benchmark.json

fast_mail_parser_ng-0.6.0/.gitignore

@@ -0,0 +1,11 @@
+/target
+.idea
+.venv/
+venv/
+fast_mail_parser.egg-info
+.eggs
+build
+.pytest_cache
+dist
+__pycache__
+.python-version

fast_mail_parser_ng-0.6.0/CHANGELOG.md

@@ -0,0 +1,104 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.6.0] - 2026-08-26
+
+### Changed
+
+- **The distribution is now published as `fast-mail-parser-ng`.** Install with
+  `pip install fast-mail-parser-ng`. The import path is unchanged — existing
+  code keeps working as-is:
+
+  ```python
+  from fast_mail_parser import parse_email, ParseError
+  ```
+
+  Only the name in your requirements file changes. No code in this release
+  differs from 0.5.0; the version bump signals that consumers must update how
+  they install the package.
+
+  The `fast-mail-parser` name on PyPI still points at an unmaintained 0.2.5
+  from June 2022, published by the library's original author before he left
+  Namecheap. We do not control that name: the PEP 541 transfer request
+  ([pypi/support#11044](https://github.com/pypi/support/issues/11044)) has been
+  open and unattended since 2026-06-13. Rather than block releases on that
+  queue indefinitely, this repository publishes under a name we own. If the
+  transfer is ever granted, `fast-mail-parser` will resume as an alias.
+- Wheels are now built with a pinned Rust toolchain (1.97.1). rustc 1.98.0
+  makes the parser ~26% slower, so the pin keeps 0.6.0's wheels as fast as
+  0.5.0's (#119, tracked in #120).
+
+## [0.5.0] - 2026-08-03
+
+### Changed
+
+- Wheels now target the CPython stable ABI (`cp311-abi3`, via the
+  `pyo3/abi3-py311` feature): a single wheel per platform supports every
+  CPython ≥ 3.11, including versions released after the build. New CPython
+  minors no longer require a repo change or a new release for installability
+  (#14, #15, #101). The abi3 build benchmarked ~11% *faster* than the
+  version-specific build (min parse time, CPython 3.12, Apple Silicon), so no
+  hybrid version-specific wheels are shipped.
+- CI now builds one abi3 wheel and runs the full test matrix (CPython
+  3.11–3.14) against that same wheel — the stable-ABI contract is verified,
+  not assumed. The per-version publish matrix collapsed to one wheel per
+  platform.
+
+## [0.4.0] - 2026-06-12
+
+### Breaking
+
+- Dropped support for Python 3.7–3.10; the minimum supported version is now
+  **3.11** (`requires-python >= 3.11`).
+- `str` input to `parse_email` is now decoded as UTF-8 (lossless). Previously
+  each code point was truncated to its low byte, corrupting non-ASCII input.
+  Output for non-ASCII `str` therefore changes — pass `bytes` for exact control.
+- Message bodies that fail to decode (e.g. invalid base64) now raise
+  `ParseError` instead of silently returning an empty value.
+
+### Changed
+
+- Upgraded PyO3 0.16.6 → 0.29.0, resolving RUSTSEC-2025-0020 and
+  RUSTSEC-2026-0177.
+- Upgraded `mailparse` 0.15.0 → 0.16.1.
+- Track the stable Rust toolchain and declare the MSRV (`rust-version = 1.83`).
+- Faster string-input parsing via a UTF-8 fast path.
+
+### Added
+
+- Support for CPython 3.13 and 3.14.
+- Denial-of-service hardening: input-size cap (100 MiB) and MIME
+  recursion-depth cap (256), both surfaced as `ParseError`.
+- Public API contract tests, an RFC-feature `.eml` corpus, round-trip
+  correctness tests, and an empty-field sentinel test.
+- `CONTRIBUTING.md` with build-from-source and testing instructions.
+
+### Security
+
+- Fixed the lossy `str`→bytes conversion that corrupted non-ASCII input.
+- Added untrusted-input DoS guards (input-size and recursion-depth caps).
+- Hardened CI: PR-gated matrix, blocking `cargo audit`, SHA-pinned actions,
+  Dependabot, `cargo-deny`, OIDC Trusted Publishing, and removed real PII from
+  test fixtures.
+
+## [0.3.0]
+
+Prior release (PyO3 0.16.6). See the Git history for details.
+
+---
+
+The package version is single-sourced from `Cargo.toml`'s `[package].version`.
+`pyproject.toml` declares `dynamic = ["version"]`, so maturin reads the version
+from `Cargo.toml` at build time. Bump the version in `Cargo.toml` only.
+
+[Unreleased]: https://github.com/namecheap/fast_mail_parser/compare/v0.6.0...HEAD
+[0.6.0]: https://github.com/namecheap/fast_mail_parser/compare/v0.5.0...v0.6.0
+[0.5.0]: https://github.com/namecheap/fast_mail_parser/compare/v0.4.0...v0.5.0
+[0.4.0]: https://github.com/namecheap/fast_mail_parser/compare/v0.3.0...v0.4.0
+[0.3.0]: https://github.com/namecheap/fast_mail_parser/releases/tag/v0.3.0