log-foundry 0.9.1.dev2__tar.gz → 0.9.1.dev4__tar.gz

{log_foundry-0.9.1.dev2 → log_foundry-0.9.1.dev4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: log-foundry
-Version: 0.9.1.dev2
+Version: 0.9.1.dev4
 Summary: Generate logs for your console and JSON events for downstream consumption.
 License-Expression: MIT
 License-File: LICENSE

{log_foundry-0.9.1.dev2 → log_foundry-0.9.1.dev4}/pyproject.toml

@@ -20,7 +20,7 @@ dependencies = [
 ]
 
 # Optional features. Install with: pip install log-foundry[aws]
-version = "0.9.1.dev2"
+version = "0.9.1.dev4"
 
 [project.optional-dependencies]
 aws = ["boto3>=1.43.61"]              # SQSSink, SNSSink, KinesisSink, FirehoseSink
@@ -70,6 +70,25 @@ pytest-cov = "^7.1.0"
 ruff = ">=0.16,<0.17"
 mypy = "^2.3"
 
+# Supply-chain tooling (SPEC-023 FR-007). `optional = true` keeps it OUT of the
+# `poetry install --with dev` that every CI matrix leg runs — neither tool is needed to lint,
+# typecheck or test, and both drag in dependency trees of their own. The two security workflows
+# ask for it explicitly with `--with security`.
+#
+# In the lockfile rather than fetched ad hoc so the versions are pinned and Dependabot's existing
+# `pip` ecosystem maintains them under its cooldown, like every other dependency here.
+[tool.poetry.group.security]
+optional = true
+
+#
+# Both carry a `python = "<4.0"` marker for the same reason `clickhouse-connect` carries one:
+# `requires-python = ">=3.12"` has no upper bound, so Poetry solves against a range that runs past
+# 4.0, and a dependency capped at `<4.0` makes resolution fail outright. The marker scopes the tool
+# instead of narrowing the library's own declared range.
+[tool.poetry.group.security.dependencies]
+cyclonedx-bom = { version = "^7.3", python = "<4.0" }   # the `cyclonedx-py` CLI (SBOM generation)
+pip-audit = { version = "^2.10", python = "<4.0" }      # OSV/PyPI advisory audit of the env
+
 
 [tool.poetry-dynamic-versioning]
 enable = false
@@ -159,6 +178,11 @@ ignore = [
 # trip this rule.
 "src/log_foundry/sinks/postgres.py" = ["S608"]
 "src/log_foundry/sinks/sqlite.py" = ["S608"]
+# make-sbom.py exists to drive two virtualenvs it creates itself, so subprocess is the whole job.
+# Every argv element is either a literal, a path under a `tempfile.TemporaryDirectory` this script
+# just made, or a value read from the repository's own pyproject.toml / poetry.lock. There is no
+# caller-supplied input and no shell — `subprocess.run` is given a list, never a string.
+"scripts/make-sbom.py" = ["S603"]
 
 [tool.mypy]
 files = ["src"]