modelaudit 0.2.39__tar.gz → 0.2.41__tar.gz

{modelaudit-0.2.39 → modelaudit-0.2.41}/.github/markdown-link-check-config.json

@@ -3,6 +3,9 @@
     {
       "pattern": "^https://github.com/.*/(pull|issues)/[0-9]+$"
     },
+    {
+      "pattern": "^https://github.com/promptfoo/modelaudit/(commit|compare|releases/tag)/"
+    },
     {
       "pattern": "^https://claude.ai"
     }

{modelaudit-0.2.39 → modelaudit-0.2.41}/.github/workflows/release-please.yml

@@ -565,24 +565,24 @@ jobs:
       - name: Build standalone package sdist
         if: matrix.build-sdist == 'true'
         run: |
-          uv build --sdist --out-dir /tmp/modelaudit-picklescan-dist
+          uv build --sdist --out-dir dist
 
       - name: Build standalone package manylinux wheel
         if: runner.os == 'Linux'
         uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1
         with:
           command: build
-          args: --release --out /tmp/modelaudit-picklescan-dist --compatibility manylinux_2_28
+          args: --release --out dist
           manylinux: "2_28"
           working-directory: packages/modelaudit-picklescan
 
       - name: Build standalone package wheel
         if: runner.os != 'Linux'
         run: |
-          uv build --wheel --out-dir /tmp/modelaudit-picklescan-dist
+          uv build --wheel --out-dir dist
 
       - name: Validate standalone package metadata
-        run: uvx twine check /tmp/modelaudit-picklescan-dist/*
+        run: uvx twine check dist/*
 
       - name: Verify standalone artifact version consistency
         run: |
@@ -590,10 +590,10 @@ jobs:
           EXPECTED_VERSION="${{ needs.release-please.outputs.picklescan_version }}"
 
           shopt -s nullglob
-          artifacts=(/tmp/modelaudit-picklescan-dist/modelaudit_picklescan-*.whl /tmp/modelaudit-picklescan-dist/modelaudit_picklescan-*.tar.gz)
+          artifacts=(dist/modelaudit_picklescan-*.whl dist/modelaudit_picklescan-*.tar.gz)
           if [[ ${#artifacts[@]} -eq 0 ]]; then
             echo "ERROR: Expected at least one modelaudit_picklescan artifact"
-            ls -la /tmp/modelaudit-picklescan-dist/
+            ls -la dist/
             exit 1
           fi
 
@@ -654,10 +654,10 @@ jobs:
           fi
 
           shopt -s nullglob
-          picklescan_wheels=(/tmp/modelaudit-picklescan-dist/modelaudit_picklescan-*.whl)
+          picklescan_wheels=(dist/modelaudit_picklescan-*.whl)
           if [[ ${#picklescan_wheels[@]} -ne 1 ]]; then
             echo "ERROR: Expected exactly 1 modelaudit_picklescan wheel artifact, found ${#picklescan_wheels[@]}"
-            ls -la /tmp/modelaudit-picklescan-dist/
+            ls -la dist/
             exit 1
           fi
 
@@ -685,7 +685,7 @@ jobs:
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: modelaudit-picklescan-dist-${{ matrix.artifact-suffix }}
-          path: /tmp/modelaudit-picklescan-dist/
+          path: packages/modelaudit-picklescan/dist/
 
   publish-pypi:
     if: needs.release-please.outputs.release_created == 'true'

modelaudit-0.2.41/.release-please-manifest.json

@@ -0,0 +1,4 @@
+{
+  ".": "0.2.41",
+  "packages/modelaudit-picklescan": "0.1.3"
+}

{modelaudit-0.2.39 → modelaudit-0.2.41}/AGENTS.md

@@ -9,6 +9,17 @@ This is the single source of truth for all AI coding agents (Claude, Gemini, oth
 - Keep instructions universal and minimal; lean on deterministic tools (ruff, mypy, pytest, prettier) rather than embedding style rules.
 - When unsure, ask or fetch targeted context instead of expanding instructions.
 
+### Monorepo at a glance
+
+This repo publishes **two PyPI packages with independent versions**:
+
+| PyPI name               | Path                              | Version file                    | CHANGELOG                                     |
+| ----------------------- | --------------------------------- | ------------------------------- | --------------------------------------------- |
+| `modelaudit`            | `./` (root)                       | `pyproject.toml` + `uv.lock`    | `CHANGELOG.md`                                |
+| `modelaudit-picklescan` | `packages/modelaudit-picklescan/` | `pyproject.toml` + `Cargo.toml` | `packages/modelaudit-picklescan/CHANGELOG.md` |
+
+Root `modelaudit` hard-requires `modelaudit-picklescan>=0.1.0,<0.2.0` — when the sibling crosses `0.2.0`, bump the constraint in the same PR or the next `modelaudit` release is uninstallable. Both packages are driven by a single `release-please` workflow (`.github/workflows/release-please.yml`) with components defined in `release-please-config.json` and current versions in `.release-please-manifest.json`. Full publishing details — trusted publishing, manual `workflow_dispatch` recovery (`root_version` / `picklescan_version`), and yank procedure — are in [`docs/agents/release-process.md`](docs/agents/release-process.md). For work inside the picklescan package, start from [`packages/modelaudit-picklescan/AGENTS.md`](packages/modelaudit-picklescan/AGENTS.md).
+
 ## Mission & Principles
 
 - **Security first:** Never weaken detections or bypass safeguards.
@@ -184,7 +195,7 @@ modelaudit/
 └── CHANGELOG.md          # Keep a Changelog format
 ```
 
-Key docs: `docs/agents/architecture.md`, `docs/agents/dependencies.md`, `docs/agents/release-process.md`, `docs/agents/new-scanner-quickstart.md`.
+Key docs: `docs/agents/architecture.md`, `docs/agents/dependencies.md`, `docs/agents/release-process.md`, `docs/agents/new-scanner-quickstart.md`, `docs/agents/picklescan-package-split.md`, `packages/modelaudit-picklescan/AGENTS.md`.
 
 ## README.md Content Guidelines
 

{modelaudit-0.2.39 → modelaudit-0.2.41}/CHANGELOG.md

@@ -5,6 +5,31 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.41](https://github.com/promptfoo/modelaudit/compare/v0.2.40...v0.2.41) (2026-04-27)
+
+### Bug Fixes
+
+- **ci:** skip POSIX proof cases on Windows ([#1072](https://github.com/promptfoo/modelaudit/issues/1072)) ([bfa17a3](https://github.com/promptfoo/modelaudit/commit/bfa17a3e152cd178c5d1fdbfec55dd3f124778ef))
+- **docker:** add apt-get clean and pinned pip constraints to Dockerfile.tensorflow ([#1079](https://github.com/promptfoo/modelaudit/issues/1079)) ([8d9f9b7](https://github.com/promptfoo/modelaudit/commit/8d9f9b7c628ae05cdccf5d8eb480eea89f551e8d))
+- harden picklescan call graph RCE detection ([#1061](https://github.com/promptfoo/modelaudit/issues/1061)) ([19c4fc4](https://github.com/promptfoo/modelaudit/commit/19c4fc487b4758462ac2107a3f3e59463e5d888b))
+- harden picklescan stdlib callable detection ([f0f57b4](https://github.com/promptfoo/modelaudit/commit/f0f57b47f3355bea008a48779dbd856e6f550ec7))
+- improve test isolation, reduce duplication, and fix command injection risk in test suite ([#1078](https://github.com/promptfoo/modelaudit/issues/1078)) ([3867c83](https://github.com/promptfoo/modelaudit/commit/3867c83b2dd0d5ab6a83b650c28d64122a675dea))
+- **picklescan:** avoid call-graph false positives for PyTorch storage IDs ([#1069](https://github.com/promptfoo/modelaudit/issues/1069)) ([e75ed24](https://github.com/promptfoo/modelaudit/commit/e75ed249948558864d8f56882a02f1327323205d))
+- silence stale CodeQL generated import alerts ([#1080](https://github.com/promptfoo/modelaudit/issues/1080)) ([9530740](https://github.com/promptfoo/modelaudit/commit/9530740312725d051a41f7f2a405280ee2be4c62))
+- **telemetry:** stabilize modelaudit identity ([#1071](https://github.com/promptfoo/modelaudit/issues/1071)) ([592a656](https://github.com/promptfoo/modelaudit/commit/592a65672ac58e0b89eb50a54614e736b60c6741))
+
+### Documentation
+
+- improve PyPI READMEs ([#1057](https://github.com/promptfoo/modelaudit/issues/1057)) ([1cfb27d](https://github.com/promptfoo/modelaudit/commit/1cfb27de814125470d1e1a38eec03a83d79ff3d9))
+
+## [0.2.40](https://github.com/promptfoo/modelaudit/compare/v0.2.39...v0.2.40) (2026-04-17)
+
+### Bug Fixes
+
+- add manual release recovery path ([aeea2da](https://github.com/promptfoo/modelaudit/commit/aeea2da68099f42a2fae68a50fff9e64e5e2f86f))
+- avoid duplicate manylinux compatibility tag ([412677f](https://github.com/promptfoo/modelaudit/commit/412677f00e6a24b3471d9f14a36ef2b9405e5067))
+- persist manylinux picklescan artifacts ([346bb3f](https://github.com/promptfoo/modelaudit/commit/346bb3f048b646c69573812a08ffd23342843658))
+
 ## [0.2.39](https://github.com/promptfoo/modelaudit/compare/v0.2.38...v0.2.39) (2026-04-17)
 
 ### Bug Fixes
@@ -66,6 +91,169 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- **security:** detect `mailcap.findmatch` pickle call targets that can execute
+  attacker-controlled mailcap `test` commands on Python versions that still
+  provide `mailcap`
+- **security:** detect `setuptools._distutils.spawn.spawn` pickle call targets
+  that can execute attacker-controlled subprocess command lists when
+  `setuptools` is installed
+- **security:** detect `pipes.Template` pickle call targets that can execute
+  attacker-controlled shell pipelines on Python versions that still provide
+  `pipes`
+- **security:** resolve module-level bound-method aliases and same-module
+  constructor call paths in pickle call-graph analysis so process-dispatch
+  wrappers are blocked
+- **security:** resolve dangerous `six.moves` compatibility aliases, including
+  vendored `six` copies, in pickle call-graph analysis so subprocess, pickle
+  deserializer, and builtin execution wrappers are blocked
+- **security:** resolve constructor-default sink aliases assigned to instance
+  attributes in pickle call-graph analysis so wrappers like Botocore credential
+  process providers are blocked
+- **security:** resolve sink defaults forwarded through `super().__init__` in
+  pickle call-graph analysis so async credential process wrappers are blocked
+- **security:** resolve parameter-fed function-local class instance aliases in
+  pickle call-graph analysis so wrapper functions like `click.edit` are blocked
+- **security:** resolve function-local import aliases in pickle call-graph
+  analysis so wrappers that import RCE sinks inside function bodies are blocked
+- **security:** preserve callable invocation aliases when import-reference
+  metadata is crowded, while ignoring uninvoked nested function and lambda
+  bodies during pickle call-graph analysis
+- **security:** detect `typing._eval_type` pickle call targets that can
+  evaluate attacker-controlled `ForwardRef` expressions
+- **security:** detect `dataclasses._create_fn` pickle call targets that can
+  execute attacker-controlled generated Python source
+- **security:** detect `typing.get_type_hints` pickle call targets that can
+  evaluate attacker-controlled annotation strings
+- **security:** detect public `operator.call` pickle call targets that can
+  invoke attacker-controlled callables
+- **security:** detect `builtins.map` pickle call targets that can lazily
+  invoke attacker-controlled callables when iterated
+- **security:** detect `itertools.starmap` pickle call targets that can lazily
+  invoke attacker-controlled callables when iterated
+- **security:** detect `builtins.filter` pickle call targets that can lazily
+  invoke attacker-controlled callables when iterated
+- **security:** detect `types.MethodType` pickle call targets that can
+  synthesize attacker-controlled bound methods for later invocation
+- **security:** detect `types.DynamicClassAttribute.__get__` pickle call
+  targets that can invoke attacker-controlled descriptor getters
+- **security:** detect `functools.cached_property.__get__` pickle call targets
+  that can invoke attacker-controlled cached-property getters
+- **security:** detect `functools.cmp_to_key` pickle call targets that can
+  invoke attacker-controlled comparators during rich comparison
+- **security:** detect `logging.Filterer.filter` pickle call targets that can
+  invoke attacker-controlled logging filter callbacks
+- **security:** detect `inspect.getmembers` pickle call targets that can
+  invoke attacker-controlled descriptors during introspection
+- **security:** detect `builtins.hasattr` pickle call targets that can invoke
+  attacker-controlled descriptors during attribute-existence checks
+- **security:** detect `__del__` finalizer string seeds that can execute
+  attacker-controlled methods when pickle-built objects are dropped
+- **security:** detect `__eq__` rich-comparison string seeds that can execute
+  attacker-controlled methods during equality checks
+- **security:** detect `__lt__`, `__le__`, `__gt__`, `__ge__`, and `__ne__`
+  rich-comparison string seeds that can execute attacker-controlled methods
+  during ordering checks
+- **security:** detect `__contains__` membership string seeds that can execute
+  attacker-controlled methods during containment checks
+- **security:** detect `__setitem__` item-assignment string seeds that can
+  execute attacker-controlled methods during item mutation
+- **security:** detect `__getitem__` and `__delitem__` item-protocol string
+  seeds that can execute attacker-controlled methods during item access
+- **security:** detect binary arithmetic and bitwise dunder string seeds that
+  can execute attacker-controlled methods during operator dispatch
+- **security:** detect reflected and in-place binary operator dunder string
+  seeds that can execute attacker-controlled methods during operator dispatch
+- **security:** detect unary operator dunder string seeds that can execute
+  attacker-controlled methods during operator dispatch
+- **security:** detect context-manager entry dunder string seeds and
+  `contextlib.ExitStack.enter_context` pickle call targets that can invoke
+  attacker-controlled `__enter__` methods
+- **security:** detect iteration protocol dunder string seeds that can execute
+  attacker-controlled methods during builtin iteration dispatch
+- **security:** detect numeric rounding protocol dunder string seeds that can
+  execute attacker-controlled methods during rounding helper dispatch
+- **security:** detect descriptor setup and numeric coercion dunder string
+  seeds that can execute attacker-controlled methods during class creation
+- **security:** detect presentation and size protocol dunder string seeds that
+  can execute attacker-controlled methods during common builtin dispatch
+- **security:** detect PathLike `__fspath__` dunder string seeds that can
+  route attacker-controlled paths into file APIs during pickle loading
+- **security:** detect direct pickle calls to stdlib file-write sinks such as
+  `pathlib.Path.write_text`, `io.open`, and `_io.FileIO`
+- **security:** detect pickle calls to logging file handlers and emit/handle
+  dispatch methods that can write attacker-controlled startup hooks
+- **security:** detect pickle calls to `argparse.FileType` and high-level
+  logging stream dispatch methods that can write attacker-controlled startup
+  hooks
+- **security:** detect pickle calls to NumPy text writers that can write
+  attacker-controlled startup hooks
+- **security:** detect pickle calls to `python-dotenv` key writers that can
+  write attacker-controlled startup hooks
+- **security:** detect pickle globals whose Python call graph reaches known
+  RCE-capable source primitives such as `os.execvpe`
+- **security:** detect pickle globals whose Python call graph pairs file-open
+  and file-write wrappers that can create executable startup hooks
+- **security:** resolve pickle-imported Python class globals through bounded
+  constructor and object-method call graph entrypoints
+- **security:** detect public `io.FileIO` and `io.TextIOWrapper.write` aliases
+  for blocked `_io` file-writing primitives
+- **security:** detect builtin namespace dictionary access that can recover
+  blocked primitives through mapping lookups
+- **security:** detect dotted pickle global aliases that resolve to blocked
+  source primitives such as `os.system`
+- **security:** detect concrete `pathlib` path writer aliases and module
+  namespace dictionary recovery for modules with blocked globals
+- **security:** detect module namespace and `__builtins__` access used for
+  dynamic builtin recovery
+- **security:** detect `string.Formatter.get_field` pickle call targets that
+  can traverse attacker-controlled field expressions into callable objects
+- **security:** detect `unittest.mock._get_target` pickle call targets that
+  can manufacture delayed `pkgutil.resolve_name` resolver partials
+- **security:** detect descriptor getter pickle call targets that can bind
+  recovered function descriptors and expose builtin namespaces
+- **security:** detect wrapper and method descriptor getter pickle call targets
+  that can bind recovered slot wrappers for dynamic attribute access
+- **security:** detect global references to attribute-access and function
+  namespace source methods used for dynamic builtin recovery
+- **security:** detect object subclass enumeration globals that can recover
+  loaded process capabilities without direct imports
+- **security:** detect garbage collector object-graph globals that can recover
+  hidden namespaces and loaded process capabilities
+- **security:** detect frame-introspection globals and frame namespace
+  descriptor getters used for dynamic builtin recovery
+- **security:** detect callable `__call__` aliases of blocked pickle globals
+  used to invoke hidden RCE source primitives
+- **security:** detect wrapper `__get__` and `__self__` aliases of blocked
+  pickle globals used to recover hidden RCE source primitives
+- **security:** detect attribute aliases under blocked pickle global prefixes
+  used to recover hidden RCE source primitives
+- **security:** detect pickle calls to PyYAML unsafe loaders that can execute
+  attacker-controlled Python constructors
+- **security:** detect pickle calls to `codecs.open` and codec stream writes
+  that can write attacker-controlled startup hooks
+- **security:** detect pickle calls to durable tempfile creation and CSV
+  `DictWriter` row dispatch that can write attacker-controlled startup hooks
+- **security:** detect pickle calls to mailbox single-file `add` dispatch
+  methods that can write attacker-controlled startup hooks
+- **security:** detect pickle calls to `_tkinter` Tcl interpreter dispatch
+  methods that can execute local commands
+- **security:** detect high-level `tkinter.Misc` pickle call targets that can
+  forward attacker-controlled commands into Tcl interpreter dispatch
+- **security:** detect pickle calls to `_xxsubinterpreters.run_string` that
+  can execute attacker-controlled Python source
+- **security:** detect `builtins.staticmethod` pickle call targets that can
+  synthesize callable descriptors for later invocation
+- **security:** detect `builtins.property.__get__` pickle call targets that
+  can invoke attacker-controlled property getters during descriptor access
+- **security:** detect `builtins.classmethod.__get__` pickle call targets that
+  can synthesize attacker-controlled bound methods during descriptor access
+- **security:** detect `_functools.partial` pickle call targets that can
+  synthesize private-alias partial callables for later invocation
+- **security:** detect `_functools.reduce` pickle call targets that can invoke
+  attacker-controlled reducer callables through the private CPython alias
+- **security:** detect `functools.cache`, `functools.lru_cache`, and
+  `functools.singledispatch` pickle call targets that can synthesize callable
+  wrappers around attacker-controlled functions for later invocation
 - **cli:** add scanner selection with `--scanners`, `--exclude-scanner`, and `--list-scanners` wired into core routing, nested dispatch, remote prefilters, and scan metadata; selection-suppressed preferred scanners emit a stderr warning and populate `scanner_selection.suppressed_preferred_scanner_ids`, and unknown scanner names suggest the closest match
 - **pickle:** replace the standalone pickle scanner's package-engine selector with the Rust-only runtime and explicit native-extension errors
 - **pickle:** scan PyTorch ZIP checkpoint pickle members directly in the standalone pickle scanner
@@ -78,6 +266,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- **telemetry:** persist ModelAudit distinct IDs in Promptfoo's global config
+  format (creating `~/.promptfoo/promptfoo.yaml` if absent and migrating any
+  legacy `~/.modelaudit/user_config.json` ID) and include `isRunningInCi` on
+  analytics payloads, with presence-based detection for marker-style providers
+  (TeamCity, CodeBuild, Bitbucket, Jenkins)
 - **docs:** align public README and compatibility guidance with supported Python 3.10-3.13, TensorFlow extra requirements, supported formats, and telemetry sanitization behavior
 - **security:** credit @mosebit for privately reporting a TensorRT native-code detection gap that helped harden native-code scanner coverage
 - **security-policy:** clarify when low-impact scanner coverage gaps may be closed without publishing a public advisory while still crediting reporters
@@ -94,6 +287,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- **pickle:** detect stdlib filesystem probe and process-state callables such as `pathlib` metadata methods, `decimal.setcontext`, and `gc.disable` during pickle scans, while keeping local container mutations clean and covering public `operator.setitem` registry poisoning plus target-aware `operator.imul` warning-filter mutation.
+- **pickle:** detect public `operator.setitem` pickle calls, keep callable
+  invocation aliases ahead of import-reference budget exhaustion, dedupe repeated
+  invocation metadata before the reporting cap, preserve literal mapping-key
+  shadowing through `ChainMap`, block deeply wrapped `defaultdict` factories,
+  and avoid outer-function call-graph false positives from nested function and
+  lambda bodies.
 - **security:** prevent HuggingFace whitelist provenance from downgrading active payload, CVE, traversal, executable, operational-error, or incomplete-coverage findings. Exemptions now cover S1xx code-execution primitives (`S101`–`S115`) and HIGH-severity S3xx network primitives (`S301`/`S304`/`S305`/`S310`), and the keyword fallback uses word-boundary matching so substrings like "executable" inside "ExecuTorch" no longer over-suppress legitimate downgrades.
 - **security:** scan generic ZIP/TAR/NPZ Python members and ZIP/TAR/NPZ executable members, including wildcard imports and callable rebindings while failing closed on malformed Python source. Findings carry accurate rule codes per risk category (`S101` for `os.system`/`os.popen`, `S103` for `subprocess.*`, `S104` for `eval`/`exec`, `S106` for `__import__`, `S107` for `importlib.import_module`, `S213` for `pickle.load`/`pickle.loads`) instead of a single catch-all, the ZIP path now honors `max_mar_python_analysis_bytes` for non-MAR Python members, and source bytes are parsed directly so PEP 263 encoding declarations are respected.
 - **security:** bound PyTorch ZIP JIT/network member reads (default 32 MiB per-member cap, configurable via `max_jit_scan_member_bytes`) and mark oversized or unreadable member coverage inconclusive. Oversize and read-failure events are aggregated into a single summary INFO check per kind (with per-member detail in `details["entries"]`) so adversarial archives cannot flood the checks list, duplicate-name entries are de-duplicated by `ZipInfo` identity rather than filename so the second of two same-name members is still analyzed, directory entries are skipped explicitly, and pickle members continue through the bounded JIT/network pass so padded payloads remain covered beyond the pickle scanner raw window.

{modelaudit-0.2.39 → modelaudit-0.2.41}/Dockerfile

@@ -1,4 +1,4 @@
-ARG PYTHON_IMAGE=python:3.13-slim@sha256:d168b8d9eb761f4d3fe305ebd04aeb7e7f2de0297cec5fb2f8f6403244621664
+ARG PYTHON_IMAGE=python:3.13-slim@sha256:a0779d7c12fc20be6ec6b4ddc901a4fd7657b8a6bc9def9d3fde89ed5efe0a3d
 # Keep the major/minor version in sync with packages/modelaudit-picklescan/Cargo.toml rust-version.
 ARG PICKLESCAN_RUST_TOOLCHAIN=1.83.0
 

{modelaudit-0.2.39 → modelaudit-0.2.41}/Dockerfile.full

@@ -1,4 +1,4 @@
-ARG PYTHON_IMAGE=python:3.13-slim@sha256:d168b8d9eb761f4d3fe305ebd04aeb7e7f2de0297cec5fb2f8f6403244621664
+ARG PYTHON_IMAGE=python:3.13-slim@sha256:a0779d7c12fc20be6ec6b4ddc901a4fd7657b8a6bc9def9d3fde89ed5efe0a3d
 # Keep the major/minor version in sync with packages/modelaudit-picklescan/Cargo.toml rust-version.
 ARG PICKLESCAN_RUST_TOOLCHAIN=1.83.0
 

{modelaudit-0.2.39 → modelaudit-0.2.41}/Dockerfile.tensorflow

@@ -1,18 +1,20 @@
-FROM python:3.13-slim@sha256:d168b8d9eb761f4d3fe305ebd04aeb7e7f2de0297cec5fb2f8f6403244621664
+FROM python:3.12-slim@sha256:46cb7cc2877e60fbd5e21a9ae6115c30ace7a077b9f8772da879e4590c18c2e3
 
 WORKDIR /app
 
 # Pull in current Debian security fixes from the configured apt sources.
 RUN apt-get update \
     && apt-get install --yes --no-install-recommends --only-upgrade libc-bin libc6 \
+    && apt-get clean \
     && rm -rf /var/lib/apt/lists/*
 
 # Copy only necessary files for installation
 COPY pyproject.toml README.md ./
+COPY requirements-tensorflow.txt ./
 COPY modelaudit ./modelaudit
 
-# Install the application with TensorFlow extras
-RUN pip install --no-cache-dir ".[tensorflow]"
+# Install the application with TensorFlow extras using pinned constraints
+RUN pip install --no-cache-dir -c requirements-tensorflow.txt ".[tensorflow]"
 
 # Create a non-root user
 ARG UID=10001

{modelaudit-0.2.39 → modelaudit-0.2.41}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: modelaudit
-Version: 0.2.39
+Version: 0.2.41
 Summary: Static scanning library for detecting malicious code, potential backdoor indicators, and other security risks in ML model files
 Project-URL: Repository, https://github.com/promptfoo/modelaudit
 Project-URL: Homepage, https://github.com/promptfoo/modelaudit
@@ -130,11 +130,23 @@ Description-Content-Type: text/markdown
 [![Python versions](https://img.shields.io/pypi/pyversions/modelaudit.svg)](https://pypi.org/project/modelaudit/)
 [![Code Style: ruff](https://img.shields.io/badge/code%20style-ruff-005cd7.svg)](https://github.com/astral-sh/ruff)
 [![License](https://img.shields.io/github/license/promptfoo/modelaudit)](https://github.com/promptfoo/modelaudit/blob/main/LICENSE)
+[![Security policy](https://img.shields.io/badge/security-policy-brightgreen.svg)](https://github.com/promptfoo/modelaudit/security/policy)
 
 <img width="989" alt="ModelAudit scan results" src="https://www.promptfoo.dev/img/docs/modelaudit/modelaudit-result.png" />
 
 **[Full Documentation](https://www.promptfoo.dev/docs/model-audit/)** | **[Usage Examples](https://www.promptfoo.dev/docs/model-audit/usage/)** | **[Supported Formats](https://www.promptfoo.dev/docs/model-audit/scanners/)**
 
+## Why ModelAudit
+
+Models download from untrusted registries, pass through CI, and end up running in production. Traditional SAST tools do not look at pickle opcodes, HDF5 group layouts, ONNX proto graphs, or TensorFlow SavedModel signatures — ModelAudit does:
+
+- **Scan statically.** No model is ever loaded, unpickled, or executed.
+- **Cover the formats you actually ship.** 40+ scanners spanning pickle, PyTorch, SafeTensors, ONNX, TensorFlow, Keras, GGUF, archives, and configs.
+- **Fit into CI.** Machine-readable output (JSON, SARIF), strict mode, exit codes, and [selectable scanners](https://github.com/promptfoo/modelaudit/blob/main/docs/user/scanner-selection.md).
+- **Fail closed.** Truncated reads, exhausted budgets, and unsupported formats are reported as coverage gaps, not silent passes.
+
+Comparable tools: [`picklescan`](https://github.com/mmaitre314/picklescan) (pickle only, Python-based), [`fickling`](https://github.com/trailofbits/fickling) (pickle only, AST-based), [`modelscan`](https://github.com/protectai/modelscan) (pickle + TensorFlow + Keras subset). ModelAudit is broader in coverage and ships a native Rust pickle engine via its companion package [`modelaudit-picklescan`](https://pypi.org/project/modelaudit-picklescan/).
+
 ## Quick Start
 
 **Requires Python 3.10-3.13**
@@ -356,7 +368,8 @@ ModelAudit includes telemetry for product reliability and usage analytics.
 - Collected metadata can include command usage, scan timing, scanner/file-type usage, issue severity/type aggregates, sanitized model names/references, and coarse metadata like file extension/domain.
 - URL telemetry strips userinfo, query strings, and fragments from model references. Avoid putting credentials in model names, file names, or artifact paths when telemetry is enabled.
 - Model files are scanned locally and ModelAudit does not upload model binary contents as telemetry events.
-- Telemetry is disabled automatically in CI/test environments and in editable development installs by default.
+- Telemetry is disabled automatically when `CI=true` is set or `IS_TESTING=true` is set, and in editable development installs by default. Events that are sent from other CI providers (TeamCity, CodeBuild, Bitbucket Pipelines, Jenkins) are tagged with `isRunningInCi=true` so they can be filtered downstream.
+- The anonymous user identifier is stored in `~/.promptfoo/promptfoo.yaml` for cross-tool correlation with [Promptfoo](https://www.promptfoo.dev/). Existing IDs from `~/.modelaudit/user_config.json` are migrated on first run after upgrade.
 
 Opt out explicitly with either environment variable:
 
@@ -405,6 +418,18 @@ modelaudit model.pkl --format sarif --output results.sarif
 - **[Offline/air-gapped guide](https://github.com/promptfoo/modelaudit/blob/main/docs/user/offline-air-gapped.md)** — secure operation without internet access
 - **Troubleshooting** — run `modelaudit doctor --show-failed` to check scanner availability
 
+## Related Packages
+
+- **[`modelaudit-picklescan`](https://pypi.org/project/modelaudit-picklescan/)** — the standalone Rust-backed pickle scanner used by ModelAudit's pickle, PyTorch, ExecuTorch, and PyTorch-ZIP scanners. Install it directly if you only need pickle analysis (as a library, not a CLI) and do not want the full scanner bundle.
+
+## Reporting Vulnerabilities
+
+Do not open public issues for suspected vulnerabilities. See [SECURITY.md](https://github.com/promptfoo/modelaudit/blob/main/SECURITY.md) for coordinated disclosure.
+
+## Contributing
+
+Issues, feature requests, and PRs are welcome. See [CONTRIBUTING.md](https://github.com/promptfoo/modelaudit/blob/main/CONTRIBUTING.md).
+
 ## License
 
 MIT License — see [LICENSE](https://github.com/promptfoo/modelaudit/blob/main/LICENSE) for details.

{modelaudit-0.2.39 → modelaudit-0.2.41}/README.md

@@ -6,11 +6,23 @@
 [![Python versions](https://img.shields.io/pypi/pyversions/modelaudit.svg)](https://pypi.org/project/modelaudit/)
 [![Code Style: ruff](https://img.shields.io/badge/code%20style-ruff-005cd7.svg)](https://github.com/astral-sh/ruff)
 [![License](https://img.shields.io/github/license/promptfoo/modelaudit)](https://github.com/promptfoo/modelaudit/blob/main/LICENSE)
+[![Security policy](https://img.shields.io/badge/security-policy-brightgreen.svg)](https://github.com/promptfoo/modelaudit/security/policy)
 
 <img width="989" alt="ModelAudit scan results" src="https://www.promptfoo.dev/img/docs/modelaudit/modelaudit-result.png" />
 
 **[Full Documentation](https://www.promptfoo.dev/docs/model-audit/)** | **[Usage Examples](https://www.promptfoo.dev/docs/model-audit/usage/)** | **[Supported Formats](https://www.promptfoo.dev/docs/model-audit/scanners/)**
 
+## Why ModelAudit
+
+Models download from untrusted registries, pass through CI, and end up running in production. Traditional SAST tools do not look at pickle opcodes, HDF5 group layouts, ONNX proto graphs, or TensorFlow SavedModel signatures — ModelAudit does:
+
+- **Scan statically.** No model is ever loaded, unpickled, or executed.
+- **Cover the formats you actually ship.** 40+ scanners spanning pickle, PyTorch, SafeTensors, ONNX, TensorFlow, Keras, GGUF, archives, and configs.
+- **Fit into CI.** Machine-readable output (JSON, SARIF), strict mode, exit codes, and [selectable scanners](https://github.com/promptfoo/modelaudit/blob/main/docs/user/scanner-selection.md).
+- **Fail closed.** Truncated reads, exhausted budgets, and unsupported formats are reported as coverage gaps, not silent passes.
+
+Comparable tools: [`picklescan`](https://github.com/mmaitre314/picklescan) (pickle only, Python-based), [`fickling`](https://github.com/trailofbits/fickling) (pickle only, AST-based), [`modelscan`](https://github.com/protectai/modelscan) (pickle + TensorFlow + Keras subset). ModelAudit is broader in coverage and ships a native Rust pickle engine via its companion package [`modelaudit-picklescan`](https://pypi.org/project/modelaudit-picklescan/).
+
 ## Quick Start
 
 **Requires Python 3.10-3.13**
@@ -232,7 +244,8 @@ ModelAudit includes telemetry for product reliability and usage analytics.
 - Collected metadata can include command usage, scan timing, scanner/file-type usage, issue severity/type aggregates, sanitized model names/references, and coarse metadata like file extension/domain.
 - URL telemetry strips userinfo, query strings, and fragments from model references. Avoid putting credentials in model names, file names, or artifact paths when telemetry is enabled.
 - Model files are scanned locally and ModelAudit does not upload model binary contents as telemetry events.
-- Telemetry is disabled automatically in CI/test environments and in editable development installs by default.
+- Telemetry is disabled automatically when `CI=true` is set or `IS_TESTING=true` is set, and in editable development installs by default. Events that are sent from other CI providers (TeamCity, CodeBuild, Bitbucket Pipelines, Jenkins) are tagged with `isRunningInCi=true` so they can be filtered downstream.
+- The anonymous user identifier is stored in `~/.promptfoo/promptfoo.yaml` for cross-tool correlation with [Promptfoo](https://www.promptfoo.dev/). Existing IDs from `~/.modelaudit/user_config.json` are migrated on first run after upgrade.
 
 Opt out explicitly with either environment variable:
 
@@ -281,6 +294,18 @@ modelaudit model.pkl --format sarif --output results.sarif
 - **[Offline/air-gapped guide](https://github.com/promptfoo/modelaudit/blob/main/docs/user/offline-air-gapped.md)** — secure operation without internet access
 - **Troubleshooting** — run `modelaudit doctor --show-failed` to check scanner availability
 
+## Related Packages
+
+- **[`modelaudit-picklescan`](https://pypi.org/project/modelaudit-picklescan/)** — the standalone Rust-backed pickle scanner used by ModelAudit's pickle, PyTorch, ExecuTorch, and PyTorch-ZIP scanners. Install it directly if you only need pickle analysis (as a library, not a CLI) and do not want the full scanner bundle.
+
+## Reporting Vulnerabilities
+
+Do not open public issues for suspected vulnerabilities. See [SECURITY.md](https://github.com/promptfoo/modelaudit/blob/main/SECURITY.md) for coordinated disclosure.
+
+## Contributing
+
+Issues, feature requests, and PRs are welcome. See [CONTRIBUTING.md](https://github.com/promptfoo/modelaudit/blob/main/CONTRIBUTING.md).
+
 ## License
 
 MIT License — see [LICENSE](https://github.com/promptfoo/modelaudit/blob/main/LICENSE) for details.

{modelaudit-0.2.39 → modelaudit-0.2.41}/SECURITY.md

@@ -94,7 +94,7 @@ If a fix requires longer than the default window, we will negotiate an extension
 
 ## When we issue CVEs
 
-We request CVE IDs through [GitHub's CVE Numbering Authority (CNA)](https://docs.github.com/en/code-security/security-advisories/working-with-repository-security-advisories/about-github-security-advisories-for-repositories) program. Not every security fix warrants a CVE.
+We request CVE IDs through [GitHub's CVE Numbering Authority (CNA)](https://docs.github.com/code-security/security-advisories/repository-security-advisories/about-repository-security-advisories) program. Not every security fix warrants a CVE.
 
 **CVE issued:**
 
@@ -123,6 +123,7 @@ When in doubt, we err toward issuing a CVE.
 **In scope:**
 
 - The `modelaudit` Python package published on [PyPI](https://pypi.org/project/modelaudit/).
+- The `modelaudit-picklescan` Python package published on [PyPI](https://pypi.org/project/modelaudit-picklescan/), including its bundled Rust pickle engine.
 - The official Docker images.
 - The GitHub Actions CI/CD workflows in the [modelaudit repository](https://github.com/promptfoo/modelaudit).
 

{modelaudit-0.2.39 → modelaudit-0.2.41}/THIRD_PARTY_NOTICES.md

@@ -53,7 +53,7 @@ These are installed only when the corresponding extra is requested.
 | onnx            | `onnx`        | Apache-2.0   | <https://onnx.ai/>                           |
 | py7zr           | `sevenzip`    | LGPL-2.1+    | <https://github.com/miurahr/py7zr>           |
 | pybcj           | `sevenzip`    | LGPL-2.1+    | <https://github.com/miurahr/pybcj>           |
-| py-ubjson       | `xgboost`     | Apache-2.0   | <https://github.com/Iber/py-ubjson>          |
+| py-ubjson       | `xgboost`     | Apache-2.0   | <https://github.com/Iotic-Labs/py-ubjson>    |
 | pyppmd          | `sevenzip`    | LGPL-2.1+    | <https://github.com/miurahr/pyppmd>          |
 | safetensors     | `safetensors` | Apache-2.0   | <https://github.com/huggingface/safetensors> |
 | scikit-learn    | `joblib`      | BSD-3-Clause | <https://scikit-learn.org/>                  |