modelaudit 0.2.42__tar.gz → 0.2.44__tar.gz

{modelaudit-0.2.42 → modelaudit-0.2.44}/.gitattributes

@@ -9,3 +9,7 @@
 
 # Vendored protobuf stubs are generated artifacts.
 modelaudit/protos/* linguist-generated=true
+
+# Changelogs are append-heavy; preserve concurrent additions during merges.
+CHANGELOG.md merge=union
+packages/modelaudit-picklescan/CHANGELOG.md merge=union

modelaudit-0.2.44/.release-please-manifest.json

@@ -0,0 +1,4 @@
+{
+  ".": "0.2.44",
+  "packages/modelaudit-picklescan": "0.1.5"
+}

{modelaudit-0.2.42 → modelaudit-0.2.44}/CHANGELOG.md

@@ -5,6 +5,174 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.44](https://github.com/promptfoo/modelaudit/compare/v0.2.43...v0.2.44) (2026-05-03)
+
+### Bug Fixes
+
+- address ai quality findings ([#1218](https://github.com/promptfoo/modelaudit/issues/1218)) ([30f4ef2](https://github.com/promptfoo/modelaudit/commit/30f4ef246f7e26a4c6f85e684bfb35ceaea7c43d))
+- clear remaining security-quality findings ([#1219](https://github.com/promptfoo/modelaudit/issues/1219)) ([259f931](https://github.com/promptfoo/modelaudit/commit/259f931fa573e234734b7d72850e0ca09d775f45))
+
+### Performance Improvements
+
+- add opt-in core phase timings ([#1170](https://github.com/promptfoo/modelaudit/issues/1170)) ([75a7f0b](https://github.com/promptfoo/modelaudit/commit/75a7f0b4480f6e4305617a729fa9635b15432fe3))
+- bound directory progress pre-counts ([#1174](https://github.com/promptfoo/modelaudit/issues/1174)) ([23dc5d0](https://github.com/promptfoo/modelaudit/commit/23dc5d009a9cf14060ee046fe74ef1af02de2e7d))
+- bound ordinary license header reads ([#1197](https://github.com/promptfoo/modelaudit/issues/1197)) ([113ad34](https://github.com/promptfoo/modelaudit/commit/113ad3402d82aa1815239a4e3cbe93a862619cdc))
+- cache call graph call nodes ([#1215](https://github.com/promptfoo/modelaudit/issues/1215)) ([aa52759](https://github.com/promptfoo/modelaudit/commit/aa52759aabaac335b87e30e2cbf042d141dc4e9f))
+- cache function import aliases ([#1214](https://github.com/promptfoo/modelaudit/issues/1214)) ([d56eef2](https://github.com/promptfoo/modelaudit/commit/d56eef2de18652fee1a759642165e404b8202be9))
+- cache manifest trusted-url lookups ([#1186](https://github.com/promptfoo/modelaudit/issues/1186)) ([09e76cf](https://github.com/promptfoo/modelaudit/commit/09e76cf9a793572e961aefbbc827aeaeab351e64))
+- cache parameter controlled names ([#1213](https://github.com/promptfoo/modelaudit/issues/1213)) ([41b8f45](https://github.com/promptfoo/modelaudit/commit/41b8f4541c9b62204c74c04199931ef0484ba1a5))
+- cache scanner selection policies ([#1177](https://github.com/promptfoo/modelaudit/issues/1177)) ([371f480](https://github.com/promptfoo/modelaudit/commit/371f48024153dcd93f5df327781348b4076ddfd4))
+- cache split call graph names ([#1212](https://github.com/promptfoo/modelaudit/issues/1212)) ([77ab177](https://github.com/promptfoo/modelaudit/commit/77ab17782f23de46c57f6e2a7302a539fb0bfb98))
+- dedupe repeated metadata urls ([#1166](https://github.com/promptfoo/modelaudit/issues/1166)) ([b3f1009](https://github.com/promptfoo/modelaudit/commit/b3f1009d8e75912117df1279da6230b80e6e61cc))
+- reuse cache key content hash on store ([#1171](https://github.com/promptfoo/modelaudit/issues/1171)) ([e3981bd](https://github.com/promptfoo/modelaudit/commit/e3981bd21ddd912d893e306f354d49eb6b4e06e1))
+- reuse call graph controlled names ([#1198](https://github.com/promptfoo/modelaudit/issues/1198)) ([84e6a9b](https://github.com/promptfoo/modelaudit/commit/84e6a9bd841095917e2199e9004759bcbe9c0eb3))
+- reuse call graph module parses ([#1167](https://github.com/promptfoo/modelaudit/issues/1167)) ([0822b40](https://github.com/promptfoo/modelaudit/commit/0822b4043db270882b8fd14ff04de1cf3d3fb134))
+- reuse compiled pmml extension patterns ([#1172](https://github.com/promptfoo/modelaudit/issues/1172)) ([51ddc85](https://github.com/promptfoo/modelaudit/commit/51ddc8510bf1fa696bf38f2f54b29885c267ca2a))
+- reuse default secret regexes ([#1185](https://github.com/promptfoo/modelaudit/issues/1185)) ([b5ba149](https://github.com/promptfoo/modelaudit/commit/b5ba149f0667be7f7d86fe11f3647dac5ea3a620))
+- reuse flax layer keyword text ([#1187](https://github.com/promptfoo/modelaudit/issues/1187)) ([b50947f](https://github.com/promptfoo/modelaudit/commit/b50947fefde1140693856011b221ff540d83b100))
+- reuse flax structure analysis ([#1188](https://github.com/promptfoo/modelaudit/issues/1188)) ([c33c566](https://github.com/promptfoo/modelaudit/commit/c33c566cdb37ca480d593bbd474cb6f3dbd727b2))
+- reuse flax suspicious patterns ([#1194](https://github.com/promptfoo/modelaudit/issues/1194)) ([0351de1](https://github.com/promptfoo/modelaudit/commit/0351de1b3419353a60bdc6510772ddb6b8b55d47))
+- reuse hashes for hardlinked files ([#1175](https://github.com/promptfoo/modelaudit/issues/1175)) ([aac4367](https://github.com/promptfoo/modelaudit/commit/aac4367ef610e77c33bed9181821d83d4ccf1e4b))
+- reuse jax probe file handle ([#1161](https://github.com/promptfoo/modelaudit/issues/1161)) ([3e95649](https://github.com/promptfoo/modelaudit/commit/3e956493a476156b71fd06142190d49eb95b8bac))
+- reuse jinja scanner patterns ([#1184](https://github.com/promptfoo/modelaudit/issues/1184)) ([bb5a729](https://github.com/promptfoo/modelaudit/commit/bb5a729364aff328996d2868799b3ce394193df5))
+- reuse jit import regexes ([#1190](https://github.com/promptfoo/modelaudit/issues/1190)) ([9f37f5d](https://github.com/promptfoo/modelaudit/commit/9f37f5d35317d9273388e24e72af4a6a2fd4c001))
+- reuse lowered blacklist payload ([#1165](https://github.com/promptfoo/modelaudit/issues/1165)) ([624a17b](https://github.com/promptfoo/modelaudit/commit/624a17b2ede0e84062120987ed2b8919bedd822d))
+- reuse lowered c2 payload scan ([#1163](https://github.com/promptfoo/modelaudit/issues/1163)) ([a63efaa](https://github.com/promptfoo/modelaudit/commit/a63efaaa44c257c6428ec64ac337657f8d948d9a))
+- reuse lowered flax transform values ([#1169](https://github.com/promptfoo/modelaudit/issues/1169)) ([3d73ad7](https://github.com/promptfoo/modelaudit/commit/3d73ad719e540697d64636354f1ff23d4b2a8837))
+- reuse lowered get_file values ([#1211](https://github.com/promptfoo/modelaudit/issues/1211)) ([3bc7890](https://github.com/promptfoo/modelaudit/commit/3bc7890339f9373e73e2979e48ef010c190c6028))
+- reuse lowered hex token seed checks ([#1202](https://github.com/promptfoo/modelaudit/issues/1202)) ([8a34db9](https://github.com/promptfoo/modelaudit/commit/8a34db967e25d5b0a78479f71e53f85486f4c557))
+- reuse lowered jax context text ([#1164](https://github.com/promptfoo/modelaudit/issues/1164)) ([d012c09](https://github.com/promptfoo/modelaudit/commit/d012c09ebb8a73b75360e8132d8a1434b37342ce))
+- reuse lowered keras metadata text ([#1168](https://github.com/promptfoo/modelaudit/issues/1168)) ([abfe87b](https://github.com/promptfoo/modelaudit/commit/abfe87b3e4ac15aaf3d0721c9a9751a16fa10e6f))
+- reuse lowered layer type names ([#1203](https://github.com/promptfoo/modelaudit/issues/1203)) ([4b94a67](https://github.com/promptfoo/modelaudit/commit/4b94a67f2b5142332b49da29fdb1e8ad2106cf03))
+- reuse lowered license header text ([#1162](https://github.com/promptfoo/modelaudit/issues/1162)) ([447ea66](https://github.com/promptfoo/modelaudit/commit/447ea664889624da254d7de4c9c4219fe286e9e7))
+- reuse lowered metadata filenames ([#1205](https://github.com/promptfoo/modelaudit/issues/1205)) ([4251df5](https://github.com/promptfoo/modelaudit/commit/4251df584cb5c3491492c643f211e07f3234fd68))
+- reuse lowered metadata keys ([#1206](https://github.com/promptfoo/modelaudit/issues/1206)) ([3ea11f0](https://github.com/promptfoo/modelaudit/commit/3ea11f0d671902a95458cd143f3061b63db4f588))
+- reuse lowered ml operation names ([#1201](https://github.com/promptfoo/modelaudit/issues/1201)) ([c5de398](https://github.com/promptfoo/modelaudit/commit/c5de398c1c1cb4809edd6bcab25740dc23eda1b8))
+- reuse lowered sarif messages ([#1209](https://github.com/promptfoo/modelaudit/issues/1209)) ([fde43a4](https://github.com/promptfoo/modelaudit/commit/fde43a4a267de63530bd7716fcf6b851c6b74e78))
+- reuse lowered secret descriptions ([#1208](https://github.com/promptfoo/modelaudit/issues/1208)) ([cb0324b](https://github.com/promptfoo/modelaudit/commit/cb0324b6ffd4444a974895a0dee7d209b0e4b571))
+- reuse lowered skops member names ([#1207](https://github.com/promptfoo/modelaudit/issues/1207)) ([879c531](https://github.com/promptfoo/modelaudit/commit/879c5310f3f7f39b96bb280e9cc772647e1ea749))
+- reuse lowered xgboost legacy headers ([#1204](https://github.com/promptfoo/modelaudit/issues/1204)) ([8bc1e7d](https://github.com/promptfoo/modelaudit/commit/8bc1e7d45ee89d62d51503c8e549114fa3df197e))
+- reuse manifest text within scans ([#1160](https://github.com/promptfoo/modelaudit/issues/1160)) ([848bc1e](https://github.com/promptfoo/modelaudit/commit/848bc1ec65b428d0fe47adf117d848519e05f2be))
+- reuse metagraph attr lowercase values ([#1200](https://github.com/promptfoo/modelaudit/issues/1200)) ([349751e](https://github.com/promptfoo/modelaudit/commit/349751e228f601c30bfbe61d386621db14aefb31))
+- reuse nearby license discovery ([#1155](https://github.com/promptfoo/modelaudit/issues/1155)) ([301618d](https://github.com/promptfoo/modelaudit/commit/301618da66a41514e6e210d4ba8298cf816da81d))
+- reuse network library patterns ([#1191](https://github.com/promptfoo/modelaudit/issues/1191)) ([630bd3d](https://github.com/promptfoo/modelaudit/commit/630bd3d35eff43c980a3bb9d0f75ad6cb548b42c))
+- reuse normalized scanner selection policy ([#1153](https://github.com/promptfoo/modelaudit/issues/1153)) ([b8430a0](https://github.com/promptfoo/modelaudit/commit/b8430a04b141972febab6b03e744e1382c14aacb))
+- reuse onnx model bytes for parsing ([#1193](https://github.com/promptfoo/modelaudit/issues/1193)) ([a5356a5](https://github.com/promptfoo/modelaudit/commit/a5356a5109a09f04db6efa764cb47088b7a5b1aa))
+- reuse prefiltered sarif issues ([#1210](https://github.com/promptfoo/modelaudit/issues/1210)) ([d996043](https://github.com/promptfoo/modelaudit/commit/d9960432a37982595109d2c20ca34cbb7e2807cf))
+- reuse savedmodel function patterns ([#1183](https://github.com/promptfoo/modelaudit/issues/1183)) ([c043bcd](https://github.com/promptfoo/modelaudit/commit/c043bcd0c9509f0704406e3cbf67a374f898d73e))
+- reuse secrets detector heuristics ([#1189](https://github.com/promptfoo/modelaudit/issues/1189)) ([799e8bf](https://github.com/promptfoo/modelaudit/commit/799e8bf6c62c336cd64083309d2f615426041863))
+- reuse sibling license directory listings ([#1157](https://github.com/promptfoo/modelaudit/issues/1157)) ([5ec7f21](https://github.com/promptfoo/modelaudit/commit/5ec7f21ab0b16eaf23c654688eab4219c091fc86))
+- reuse suspicious port names ([#1192](https://github.com/promptfoo/modelaudit/issues/1192)) ([8ed7665](https://github.com/promptfoo/modelaudit/commit/8ed76651cc386ef4ad1ffbdd9f1b280ee951f1cc))
+- share call graph caches within reports ([#1156](https://github.com/promptfoo/modelaudit/issues/1156)) ([b16d37c](https://github.com/promptfoo/modelaudit/commit/b16d37c3b4439b4e6d966b8b9624642307c2a322))
+- share getattr assignment candidates ([#1199](https://github.com/promptfoo/modelaudit/issues/1199)) ([5d12903](https://github.com/promptfoo/modelaudit/commit/5d1290330328ad4fb6e6f88bddc34e7bfba9d310))
+- short-circuit hf bookkeeping checks ([#1154](https://github.com/promptfoo/modelaudit/issues/1154)) ([ed0122d](https://github.com/promptfoo/modelaudit/commit/ed0122d57bb875beab88a92dbb670c7d06ec881b))
+- skip call graph enrichment in pickle validation ([#1196](https://github.com/promptfoo/modelaudit/issues/1196)) ([2347d80](https://github.com/promptfoo/modelaudit/commit/2347d80a2d110f582c188679b4a0c04489779745))
+- skip directory pre-count without progress ([#1173](https://github.com/promptfoo/modelaudit/issues/1173)) ([83c8bb4](https://github.com/promptfoo/modelaudit/commit/83c8bb42a53180d09d707bad6cd90d06d3ab55ee))
+- skip redundant jax scans for plain pickles ([#1158](https://github.com/promptfoo/modelaudit/issues/1158)) ([04c6974](https://github.com/promptfoo/modelaudit/commit/04c6974283a02ddb5233a498ccfd0306261ab6ab))
+- skip renormalizing scanner selection ([#1181](https://github.com/promptfoo/modelaudit/issues/1181)) ([74ac7a7](https://github.com/promptfoo/modelaudit/commit/74ac7a7fef31028582c201690610076214c2d544))
+- summarize CLI progress tree once ([#1182](https://github.com/promptfoo/modelaudit/issues/1182)) ([0bc373f](https://github.com/promptfoo/modelaudit/commit/0bc373fc8a3d1694fa35a18f7789d195f2cacd79))
+
+### Documentation
+
+- add performance audit backlog ([#1159](https://github.com/promptfoo/modelaudit/issues/1159)) ([be6cc4a](https://github.com/promptfoo/modelaudit/commit/be6cc4a43facb6212c6f591779c5faddc111a280))
+
+## [0.2.43](https://github.com/promptfoo/modelaudit/compare/v0.2.42...v0.2.43) (2026-05-01)
+
+### Bug Fixes
+
+- align manifest scanner routing ([#1111](https://github.com/promptfoo/modelaudit/issues/1111)) ([ad7f253](https://github.com/promptfoo/modelaudit/commit/ad7f2534ad3e9f5ec744aadbf2448e02bdaa092f))
+- analyze jax-like pickle checkpoints ([#1114](https://github.com/promptfoo/modelaudit/issues/1114)) ([576ac54](https://github.com/promptfoo/modelaudit/commit/576ac540822e620204ea7d654848bcca9376b44f))
+- avoid inert skops cve false positives ([7538e58](https://github.com/promptfoo/modelaudit/commit/7538e58fc6ba7c3f9f7721a6c686035f6502c1e6))
+- avoid PMML system substring false positives ([#1125](https://github.com/promptfoo/modelaudit/issues/1125)) ([20fdd0c](https://github.com/promptfoo/modelaudit/commit/20fdd0c7ef498099e439306e323093920fd752c7))
+- catch suspicious nemo target leaves ([#1116](https://github.com/promptfoo/modelaudit/issues/1116)) ([b8dccfa](https://github.com/promptfoo/modelaudit/commit/b8dccfa1b2aca25c277c35616ee1b01c87953e6f))
+- close pytorch zip coverage gaps ([#1095](https://github.com/promptfoo/modelaudit/issues/1095)) ([a1ca298](https://github.com/promptfoo/modelaudit/commit/a1ca298b7d217989286b9bc0e3ef6545871f9b53))
+- correct analysis suspiciousness ([#1101](https://github.com/promptfoo/modelaudit/issues/1101)) ([11b1d3e](https://github.com/promptfoo/modelaudit/commit/11b1d3e3ce7ace309f3864c599c7f70b6479c5cb))
+- cover eager statistics consumers in picklescan ([#1148](https://github.com/promptfoo/modelaudit/issues/1148)) ([0d5ea8e](https://github.com/promptfoo/modelaudit/commit/0d5ea8e5a0be4f96d3ca97c55640cdb35b55215c))
+- detect bare torch7 require loads ([#1117](https://github.com/promptfoo/modelaudit/issues/1117)) ([7c77be0](https://github.com/promptfoo/modelaudit/commit/7c77be01de8783e852815e58811f592455b3b6c4))
+- detect extensionless archive executables ([#1110](https://github.com/promptfoo/modelaudit/issues/1110)) ([b64a2da](https://github.com/promptfoo/modelaudit/commit/b64a2da696f9a922e826c39d64c37894ce393582))
+- detect nested brace-format mapping lookups ([#1151](https://github.com/promptfoo/modelaudit/issues/1151)) ([fc296ad](https://github.com/promptfoo/modelaudit/commit/fc296adaa97815b4067f0a764e653cdf777a5724))
+- detect Paddle patterns across chunk boundaries ([#1120](https://github.com/promptfoo/modelaudit/issues/1120)) ([d4fedf9](https://github.com/promptfoo/modelaudit/commit/d4fedf9e9b1492cec291dedb1ff53fe420d13bb7))
+- fail closed on bounded scanner analysis ([#1099](https://github.com/promptfoo/modelaudit/issues/1099)) ([60973e4](https://github.com/promptfoo/modelaudit/commit/60973e4eb48928c120d62ed651b1abb95c210134))
+- fail closed on call graph errors ([#1143](https://github.com/promptfoo/modelaudit/issues/1143)) ([1a08449](https://github.com/promptfoo/modelaudit/commit/1a084493b16b5c62b0cd7022b79e60795e88b07b))
+- fail closed on directory size limits ([#1093](https://github.com/promptfoo/modelaudit/issues/1093)) ([47054d7](https://github.com/promptfoo/modelaudit/commit/47054d7fe808cfb3ee676d1da533c244170946bf))
+- fail closed on header-only streaming scans ([#1103](https://github.com/promptfoo/modelaudit/issues/1103)) ([7b934c0](https://github.com/promptfoo/modelaudit/commit/7b934c02004850b5ca2428fe2871acb3e413062a))
+- fail closed on incomplete mar scans ([#1096](https://github.com/promptfoo/modelaudit/issues/1096)) ([af31235](https://github.com/promptfoo/modelaudit/commit/af312351a7b2069214d4938cb9c8e051e25ae8f3))
+- fail closed on limited llamafile payload scans ([ceb3f22](https://github.com/promptfoo/modelaudit/commit/ceb3f22870f5555e809dbf19d7ce37e4d2488b5a))
+- fail closed on malformed XGBoost JSON ([#1123](https://github.com/promptfoo/modelaudit/issues/1123)) ([4d4ba28](https://github.com/promptfoo/modelaudit/commit/4d4ba285e60a3abfb64f0259c792c52dcb66794d))
+- fail closed on nemo archives without config ([#1115](https://github.com/promptfoo/modelaudit/issues/1115)) ([a09f763](https://github.com/promptfoo/modelaudit/commit/a09f76308e1e5e3db7d20298e1ed508806d9cbbd))
+- fail closed on ONNX raw detector failures ([#1119](https://github.com/promptfoo/modelaudit/issues/1119)) ([2963764](https://github.com/promptfoo/modelaudit/commit/2963764e28c4fb94cdfdef6a975e630c4ab4dd2f))
+- fail closed on truncated tensor metadata ([b267328](https://github.com/promptfoo/modelaudit/commit/b267328ca6952ade157a82de00ddc3ca541619f0))
+- fail closed on unanalyzable call graphs ([#1108](https://github.com/promptfoo/modelaudit/issues/1108)) ([dcb8bbe](https://github.com/promptfoo/modelaudit/commit/dcb8bbe4683c284a1ea6c84231dee6808a93fc52))
+- fail closed when recognized scanners are unavailable ([#1104](https://github.com/promptfoo/modelaudit/issues/1104)) ([f4866d4](https://github.com/promptfoo/modelaudit/commit/f4866d424c5fe2112c681f7984a2c59d9fe5b794))
+- fail closed without yaml parser ([99ef15a](https://github.com/promptfoo/modelaudit/commit/99ef15a35cea50257ca31629da3e51f50d369f75))
+- harden detector heuristics ([#1100](https://github.com/promptfoo/modelaudit/issues/1100)) ([bf57b3b](https://github.com/promptfoo/modelaudit/commit/bf57b3b20ab43d1fdf764a503a7bd9fe19c7cd11))
+- ignore inert format placeholders ([#1142](https://github.com/promptfoo/modelaudit/issues/1142)) ([8f728e8](https://github.com/promptfoo/modelaudit/commit/8f728e8454578ba34ce5b28389258fa2eba29fe8))
+- ignore inert XGBoost feature labels ([f637e1e](https://github.com/promptfoo/modelaudit/commit/f637e1ebc024913af14f4a3eff01ee4600459b5d))
+- inspect savedmodel root siblings ([#1118](https://github.com/promptfoo/modelaudit/issues/1118)) ([cf6bf8f](https://github.com/promptfoo/modelaudit/commit/cf6bf8f83499910bf179361d1015c161ee8dafff))
+- keep inert dotted global metadata clean ([#1150](https://github.com/promptfoo/modelaudit/issues/1150)) ([9a76915](https://github.com/promptfoo/modelaudit/commit/9a769151c0ffd29a1638f1dacc78d2eb77b0f268))
+- **picklescan:** detect hidden-only pytorch zips ([#1098](https://github.com/promptfoo/modelaudit/issues/1098)) ([3e94f70](https://github.com/promptfoo/modelaudit/commit/3e94f7020d5a28fc150afed1520adcac8d58ce73))
+- **picklescan:** detect statistics quantiles iterator consumption ([#1152](https://github.com/promptfoo/modelaudit/issues/1152)) ([b357fdb](https://github.com/promptfoo/modelaudit/commit/b357fdb7db320d3485cf0458a4cf0f16b86717c1))
+- **picklescan:** fail closed on late encoded payload probes ([#1107](https://github.com/promptfoo/modelaudit/issues/1107)) ([55b43a5](https://github.com/promptfoo/modelaudit/commit/55b43a5229baadf1c3673b4d89838e55c5cf6ae3))
+- **picklescan:** model str.format lookups ([#1097](https://github.com/promptfoo/modelaudit/issues/1097)) ([2c87acb](https://github.com/promptfoo/modelaudit/commit/2c87acbb01285289872203063074baf51d0cd28c))
+- preserve exact entropy literals ([#1138](https://github.com/promptfoo/modelaudit/issues/1138)) ([95ba57c](https://github.com/promptfoo/modelaudit/commit/95ba57cad1d9bb346c2752942b8e054d8dfa66ff))
+- preserve hidden model payloads ([#1091](https://github.com/promptfoo/modelaudit/issues/1091)) ([5b11f91](https://github.com/promptfoo/modelaudit/commit/5b11f91942c1e5943e74affa3fbf86244f63f9cc))
+- preserve incomplete office zip scans ([#1094](https://github.com/promptfoo/modelaudit/issues/1094)) ([9ed81db](https://github.com/promptfoo/modelaudit/commit/9ed81db90ce60e4128f8e95a0ae50f5f5a75d214))
+- preserve merged scan failures ([#1092](https://github.com/promptfoo/modelaudit/issues/1092)) ([e7fecc5](https://github.com/promptfoo/modelaudit/commit/e7fecc5e674a404164e352f07d5bca381e1862f0))
+- preserve path-sensitive directory scans ([#1102](https://github.com/promptfoo/modelaudit/issues/1102)) ([ddebc52](https://github.com/promptfoo/modelaudit/commit/ddebc52095773f651b64944412180e2ee5e76762))
+- preserve str.format lookup keys in picklescan ([#1149](https://github.com/promptfoo/modelaudit/issues/1149)) ([feb3e1c](https://github.com/promptfoo/modelaudit/commit/feb3e1ccb629344180e3a27e093e24b707c671e6))
+- reject ajax as a JAX checkpoint hint ([#1124](https://github.com/promptfoo/modelaudit/issues/1124)) ([9f51b2c](https://github.com/promptfoo/modelaudit/commit/9f51b2c8e154d94b3361dfb0b07ba6bdd37aedd1))
+- reject marker-only XGBoost binaries ([#1122](https://github.com/promptfoo/modelaudit/issues/1122)) ([30ec930](https://github.com/promptfoo/modelaudit/commit/30ec9308a50f445ddd2f55624fe0b294dc2e92cd))
+- remove filename-based framework skips ([#1137](https://github.com/promptfoo/modelaudit/issues/1137)) ([7a18b49](https://github.com/promptfoo/modelaudit/commit/7a18b49f434ddc091cb26672323dad6dab42dab7))
+- require startup hook invocations ([#1140](https://github.com/promptfoo/modelaudit/issues/1140)) ([7e0777d](https://github.com/promptfoo/modelaudit/commit/7e0777dcc71bfdbd8212358aa548ee45d3808642))
+- require strict zip signatures ([93f60af](https://github.com/promptfoo/modelaudit/commit/93f60afe5765047752f2c97fc10f160939a66c62))
+- resolve concatenated archive getattr names ([#1105](https://github.com/promptfoo/modelaudit/issues/1105)) ([59a7df6](https://github.com/promptfoo/modelaudit/commit/59a7df6464fda09f79bbd5fa44754402764e89b7))
+- resync post-budget pickle replay ([#1141](https://github.com/promptfoo/modelaudit/issues/1141)) ([e275676](https://github.com/promptfoo/modelaudit/commit/e27567661295a96d94cd1ea29abd4f42c6c249e3))
+- route extensionless scanners ([18accbd](https://github.com/promptfoo/modelaudit/commit/18accbdaf6808bd6316d742c84a1f92dce63984a))
+- route flax suffixes without msgpack ([dca6056](https://github.com/promptfoo/modelaudit/commit/dca605662e2dbf3209b4d69e61fb9f1306599b7d))
+- route middle-marker llamafiles ([f11792c](https://github.com/promptfoo/modelaudit/commit/f11792ca6c4e3237d731d54c47ce44b00a3c7d4b))
+- route renamed XML models after long prologs ([#1109](https://github.com/promptfoo/modelaudit/issues/1109)) ([e2f9962](https://github.com/promptfoo/modelaudit/commit/e2f9962a887762ad49854ec1ee750c7df20b6a7c))
+- scan concatenated compressed members ([#1135](https://github.com/promptfoo/modelaudit/issues/1135)) ([3f9a51a](https://github.com/promptfoo/modelaudit/commit/3f9a51a37b92bc6e48dedb5aa97e3aeb32d64a0d))
+- scan embedded manifest chat templates ([#1112](https://github.com/promptfoo/modelaudit/issues/1112)) ([18433a8](https://github.com/promptfoo/modelaudit/commit/18433a83966229642555fa8886e3e55a8b3e15bb))
+- scan gguf chat templates with jinja analysis ([#1113](https://github.com/promptfoo/modelaudit/issues/1113)) ([35b420a](https://github.com/promptfoo/modelaudit/commit/35b420ac908bd29cecc6e82b85e1af88056b9551))
+- scan unmarked python jit blobs ([#1136](https://github.com/promptfoo/modelaudit/issues/1136)) ([681ce62](https://github.com/promptfoo/modelaudit/commit/681ce62487f0f41a9c2af7e8f7b50be65b16f901))
+- scope huggingface bookkeeping skips ([#1090](https://github.com/promptfoo/modelaudit/issues/1090)) ([87f7204](https://github.com/promptfoo/modelaudit/commit/87f7204bedc8a6ff94472b5831abd52a25836dcd))
+- stabilize non-pytorch zip status ([7449aae](https://github.com/promptfoo/modelaudit/commit/7449aae0e36a38de7681acfd0f5f77033afea059))
+- validate all XGBoost trees ([#1121](https://github.com/promptfoo/modelaudit/issues/1121)) ([a38eab2](https://github.com/promptfoo/modelaudit/commit/a38eab225b3671e8df20621455fca775ff5ee96a))
+
+### Documentation
+
+- narrow scan coverage claims ([#1139](https://github.com/promptfoo/modelaudit/issues/1139)) ([47ec8cf](https://github.com/promptfoo/modelaudit/commit/47ec8cf3bc5a5ac3166757bbaae0c5a3c6adb73d))
+
+## [Unreleased]
+
+### Bug Fixes
+
+- detect nested brace-format lookups that reach tracked `defaultdict` factories
+- avoid `str.format` picklescan false positives when a `ChainMap` shadows a `defaultdict`
+- block `statistics.quantiles` call-iterator consumption in picklescan call-graph analysis
+- block additional eager `statistics` consumers in picklescan call-graph analysis
+- avoid picklescan false positives for inert metadata under dangerous dotted globals
+- preserve path-sensitive scan results while hashing duplicate directory contents
+- correct analysis suspiciousness scoring and alias-aware semantic risk handling
+- harden detector heuristics against comment padding, byte-backed credentials, unmarked Python blobs, and spoofed network context
+- fail closed when bounded scanner windows leave relevant model content uninspected
+- fail closed when TorchServe MAR limits leave manifest-referenced payloads unscanned
+- recurse into nested ZIP members inside PyTorch archives and fail closed when compression-ratio guards leave members unscanned
+- preserve large Office-like ZIPs when prefilter inspection is incomplete
+- fail closed when directory scans stop at the total-size budget
+- restrict Hugging Face bookkeeping filename skips to recognized cache layouts
+- preserve unsuccessful child results after scan-result merges
+- preserve supported payloads hidden behind default directory-skip names
+- use bounded raw Jinja fallback windows and fail closed when PyYAML is
+  unavailable for YAML template configs
+- let extensionless file scanners participate in local file selection so
+  supported extensionless Llamafiles do not fall through to clean unknown
+  results
+- fail closed when PyTorch ZIP tensor-metadata validation can only inspect a
+  bounded pickle prefix or cannot complete member analysis
+- preserve and scan concatenated compressed-wrapper member boundaries so a
+  benign first member cannot hide later malicious payloads
+
 ## [0.2.42](https://github.com/promptfoo/modelaudit/compare/v0.2.41...v0.2.42) (2026-04-27)
 
 ### Bug Fixes
@@ -97,6 +265,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- **security:** inspect non-canonical SavedModel root siblings for suspicious
+  executable-like content
+- **security:** detect bare-string Lua `require "module"` loads in Torch7
+  artifacts
+- **security:** keep trusted NeMo namespaces from suppressing suspicious Hydra
+  `_target_` leaf names
+- **security:** fail closed when NeMo archives contain no analyzable config files
+- **security:** analyze GGUF-embedded chat templates through the Jinja scanner
+  while preserving GGUF scanner ownership
+- **security:** run JAX checkpoint analysis for JAX-like pickle payloads that
+  stay on the primary pickle scanner path
 - **security:** detect `mailcap.findmatch` pickle call targets that can execute
   attacker-controlled mailcap `test` commands on Python versions that still
   provide `mailcap`
@@ -293,6 +472,47 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- **llamafile:** stream marker detection across executable bodies so `.exe`
+  wrappers with middle-only `llamafile` markers still route to the scanner
+- **flax:** keep explicit Flax/JAX checkpoint suffixes routed to the scanner when
+  `msgpack` is unavailable so missing parser coverage fails closed
+- **llamafile:** fail closed when bounded embedded-payload scanning stops before
+  covering the full executable
+- **skops:** require exploit-shaped structured loader nodes for CVE-2025-54412
+  and CVE-2025-54413 checks so inert prose, filenames, and valid loader nodes do
+  not become critical findings
+- **routing:** require recognized ZIP signatures before classifying files or
+  streaming previews as archives, so benign `PK*` near-matches stay unclassified
+- **xgboost:** avoid flagging inert `feature_names` metadata as executable JSON
+  content.
+- **pmml:** avoid flagging benign `ecosystem()` prose as a `system(...)` call.
+- **jax:** avoid routing `ajax` near-matches as JAX checkpoint indicators.
+- **security:** fail closed on malformed nested XGBoost JSON structures that
+  would otherwise skip booster or tree validation.
+- **security:** require the legacy XGBoost binary signature instead of
+  accepting marker-shaped text payloads as valid `.bst` models.
+- **security:** validate late XGBoost trees instead of sampling only the first
+  ten tree structures.
+- **security:** detect PaddlePaddle suspicious tokens that span the scanner's
+  1 MiB read boundaries.
+- **routing:** align manifest scanner routing with the manifest filenames and
+  dedicated manifest-style suffixes declared by the registry.
+- **security:** detect strong executable headers in generic archive members even
+  when the payload has no executable-looking suffix.
+- **routing:** preserve renamed OpenVINO and PMML XML models with long benign
+  prologs during content-based directory filtering.
+- **security:** resolve compile-time string concatenation in archive-member `getattr` calls so high-risk targets like `os.system` cannot hide behind split literals
+- **security:** fail closed when routing recognizes a model format but no scanner is available to analyze it
+- **security:** fail closed when streaming scans only fall back to heuristic header checks, even if the remote file bytes were fully read
+- **docs:** narrow public scan-coverage wording so unsupported or merely discovered formats are not over-promised
+- **analysis:** keep exact dangerous literals visible even when surrounding bytes look like ML weights
+- **analysis:** stop attacker-controlled file and directory names from suppressing dangerous framework-pattern findings
+- **security:** detect dangerous marker-free Python source blobs through the public JIT path so disguised archive members are still analyzed
+- **security:** mark ONNX scans inconclusive when raw JIT/script or network
+  detector analysis cannot complete instead of treating detector failures as
+  clean passes.
+- **security:** run Jinja template analysis for manifest-owned configs that carry
+  embedded chat-template fields.
 - **pickle:** detect stdlib filesystem probe and process-state callables such as `pathlib` metadata methods, `decimal.setcontext`, and `gc.disable` during pickle scans, while keeping local container mutations clean and covering public `operator.setitem` registry poisoning plus target-aware `operator.imul` warning-filter mutation.
 - **pickle:** detect public `operator.setitem` pickle calls, keep callable
   invocation aliases ahead of import-reference budget exhaustion, dedupe repeated

{modelaudit-0.2.42 → modelaudit-0.2.44}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: modelaudit
-Version: 0.2.42
+Version: 0.2.44
 Summary: Static scanning library for detecting malicious code, potential backdoor indicators, and other security risks in ML model files
 Project-URL: Repository, https://github.com/promptfoo/modelaudit
 Project-URL: Homepage, https://github.com/promptfoo/modelaudit
@@ -27,7 +27,7 @@ Requires-Dist: defusedxml>=0.7.1
 Requires-Dist: fsspec>=2025.5.1
 Requires-Dist: gcsfs>=2025.5.1
 Requires-Dist: huggingface-hub>=0.23.0
-Requires-Dist: modelaudit-picklescan<0.2.0,>=0.1.3
+Requires-Dist: modelaudit-picklescan<0.2.0,>=0.1.4
 Requires-Dist: msgpack<2.0,>=1.0.0
 Requires-Dist: numpy<2.0,>=1.19.0; python_version == '3.10'
 Requires-Dist: numpy<2.5,>=2.4.3; python_version >= '3.11'
@@ -143,7 +143,7 @@ Models download from untrusted registries, pass through CI, and end up running i
 - **Scan statically.** No model is ever loaded, unpickled, or executed.
 - **Cover the formats you actually ship.** 40+ scanners spanning pickle, PyTorch, SafeTensors, ONNX, TensorFlow, Keras, GGUF, archives, and configs.
 - **Fit into CI.** Machine-readable output (JSON, SARIF), strict mode, exit codes, and [selectable scanners](https://github.com/promptfoo/modelaudit/blob/main/docs/user/scanner-selection.md).
-- **Fail closed.** Truncated reads, exhausted budgets, and unsupported formats are reported as coverage gaps, not silent passes.
+- **Surface coverage limits.** Recognized scanners report bounded-analysis gaps such as truncated reads or exhausted budgets instead of presenting them as fully covered results.
 
 Comparable tools: [`picklescan`](https://github.com/mmaitre314/picklescan) (pickle only, Python-based), [`fickling`](https://github.com/trailofbits/fickling) (pickle only, AST-based), [`modelscan`](https://github.com/protectai/modelscan) (pickle + TensorFlow + Keras subset). ModelAudit is broader in coverage and ships a native Rust pickle engine via its companion package [`modelaudit-picklescan`](https://pypi.org/project/modelaudit-picklescan/).
 

{modelaudit-0.2.42 → modelaudit-0.2.44}/README.md

@@ -19,7 +19,7 @@ Models download from untrusted registries, pass through CI, and end up running i
 - **Scan statically.** No model is ever loaded, unpickled, or executed.
 - **Cover the formats you actually ship.** 40+ scanners spanning pickle, PyTorch, SafeTensors, ONNX, TensorFlow, Keras, GGUF, archives, and configs.
 - **Fit into CI.** Machine-readable output (JSON, SARIF), strict mode, exit codes, and [selectable scanners](https://github.com/promptfoo/modelaudit/blob/main/docs/user/scanner-selection.md).
-- **Fail closed.** Truncated reads, exhausted budgets, and unsupported formats are reported as coverage gaps, not silent passes.
+- **Surface coverage limits.** Recognized scanners report bounded-analysis gaps such as truncated reads or exhausted budgets instead of presenting them as fully covered results.
 
 Comparable tools: [`picklescan`](https://github.com/mmaitre314/picklescan) (pickle only, Python-based), [`fickling`](https://github.com/trailofbits/fickling) (pickle only, AST-based), [`modelscan`](https://github.com/protectai/modelscan) (pickle + TensorFlow + Keras subset). ModelAudit is broader in coverage and ships a native Rust pickle engine via its companion package [`modelaudit-picklescan`](https://pypi.org/project/modelaudit-picklescan/).