modelaudit 0.2.54__tar.gz → 0.2.55__tar.gz

{modelaudit-0.2.54 → modelaudit-0.2.55}/.github/workflows/README.md

@@ -12,7 +12,7 @@
 | **Release**                | `release-please.yml`    | Pushes to main and manual dispatch        |
 | **Docker Publish**         | `docker-publish.yml`    | Published releases and manual dispatch    |
 
-Python CI ignores documentation-only PRs, which are handled by the documentation check workflow. Code PRs use GitHub's default merge-ref checkout and run fail-fast root tests on Python 3.10, 3.12, and 3.13, a single Windows shard on Python 3.11, the reduced NumPy compatibility lane, and the standalone pickle package matrix on Python 3.10-3.13. Workflow-changing PRs run exhaustive sharded root tests across Python 3.10-3.13. Dependency audit runs on dependency-relevant PR merge refs and again on `merge_group` candidate SHAs, while the optional `run-slow-tests` label remains PR-only because merge-group payloads do not carry pull request label context.
+Python CI ignores documentation-only PRs, which are handled by the documentation check workflow. Code PRs use GitHub's default merge-ref checkout and run fail-fast root tests on Python 3.10, 3.12, 3.13, and 3.14, a single Windows shard on Python 3.11, the reduced NumPy compatibility lane, and the standalone pickle package matrix on Python 3.10-3.14. Python changes also run Python 3.14 native pickle/H5 smoke tests on macOS and Windows. Python 3.14 uses the broad root test profile. Workflow-changing PRs run exhaustive sharded root tests across Python 3.10-3.14. Dependency audit runs on dependency-relevant PR merge refs and again on `merge_group` candidate SHAs, while the optional `run-slow-tests` label remains PR-only because merge-group payloads do not carry pull request label context.
 
 Pushes to `main` and `merge_group` runs validate the exact integration SHA with the full sharded fast-test matrices across Linux and Windows, the dedicated Python 3.12 slow/integration lane, 10-way coverage sharding, the full NumPy compatibility lane, and the build/package lanes. Merge-group runs intentionally fail closed: they are treated as integration events instead of depending on changed-path classification to decide whether required lanes should run, so `CI Success` cannot go green from skipped or setup-only jobs on the merge queue candidate SHA.
 

{modelaudit-0.2.54 → modelaudit-0.2.55}/.github/workflows/nightly.yml

@@ -18,12 +18,13 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest]
-        python-version: ["3.10", "3.11", "3.12", "3.13"]
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
         shard: [0, 1, 2]
         exclude:
           - { os: windows-latest, python-version: "3.10" }
           - { os: windows-latest, python-version: "3.12" }
           - { os: windows-latest, python-version: "3.13" }
+          - { os: windows-latest, python-version: "3.14" }
     steps:
       - &checkout-repo
         name: Checkout repo

{modelaudit-0.2.54 → modelaudit-0.2.55}/.github/workflows/release-please.yml

@@ -605,7 +605,7 @@ jobs:
           - os: ubuntu-latest
             artifact-suffix: linux
             build-sdist: "true"
-          - os: macos-14
+          - os: macos-15
             artifact-suffix: macos-arm64
             build-sdist: "false"
           - os: macos-15-intel
@@ -664,10 +664,10 @@ jobs:
           cargo test --manifest-path Cargo.toml
 
       - name: Lint standalone package with Ruff
-        run: uv run --with 'ruff==0.17.0' ruff check src tests
+        run: uv run --with 'ruff==0.17.1' ruff check src tests
 
       - name: Check standalone package formatting with Ruff
-        run: uv run --with 'ruff==0.17.0' ruff format --check src tests
+        run: uv run --with 'ruff==0.17.1' ruff format --check src tests
 
       - name: Type check standalone package with mypy
         run: uv run --with 'mypy>=2.4.0,<2.5.0' --with pytest mypy src tests

{modelaudit-0.2.54 → modelaudit-0.2.55}/.github/workflows/test.yml

@@ -398,7 +398,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        include: ${{ github.event_name == 'pull_request' && needs.changes.outputs.workflows != 'true' && fromJSON('[{"python-version":"3.10","shard-count":1,"shard-index":0,"shard-name":"1/1"},{"python-version":"3.12","shard-count":1,"shard-index":0,"shard-name":"1/1"},{"python-version":"3.13","shard-count":1,"shard-index":0,"shard-name":"1/1"}]') || fromJSON('[{"python-version":"3.10","shard-count":2,"shard-index":0,"shard-name":"1/2"},{"python-version":"3.10","shard-count":2,"shard-index":1,"shard-name":"2/2"},{"python-version":"3.11","shard-count":2,"shard-index":0,"shard-name":"1/2"},{"python-version":"3.11","shard-count":2,"shard-index":1,"shard-name":"2/2"},{"python-version":"3.12","shard-count":2,"shard-index":0,"shard-name":"1/2"},{"python-version":"3.12","shard-count":2,"shard-index":1,"shard-name":"2/2"},{"python-version":"3.13","shard-count":2,"shard-index":0,"shard-name":"1/2"},{"python-version":"3.13","shard-count":2,"shard-index":1,"shard-name":"2/2"}]') }}
+        include: ${{ github.event_name == 'pull_request' && needs.changes.outputs.workflows != 'true' && fromJSON('[{"python-version":"3.10","shard-count":1,"shard-index":0,"shard-name":"1/1"},{"python-version":"3.12","shard-count":1,"shard-index":0,"shard-name":"1/1"},{"python-version":"3.13","shard-count":1,"shard-index":0,"shard-name":"1/1"},{"python-version":"3.14","shard-count":1,"shard-index":0,"shard-name":"1/1"}]') || fromJSON('[{"python-version":"3.10","shard-count":2,"shard-index":0,"shard-name":"1/2"},{"python-version":"3.10","shard-count":2,"shard-index":1,"shard-name":"2/2"},{"python-version":"3.11","shard-count":2,"shard-index":0,"shard-name":"1/2"},{"python-version":"3.11","shard-count":2,"shard-index":1,"shard-name":"2/2"},{"python-version":"3.12","shard-count":2,"shard-index":0,"shard-name":"1/2"},{"python-version":"3.12","shard-count":2,"shard-index":1,"shard-name":"2/2"},{"python-version":"3.13","shard-count":2,"shard-index":0,"shard-name":"1/2"},{"python-version":"3.13","shard-count":2,"shard-index":1,"shard-name":"2/2"},{"python-version":"3.14","shard-count":2,"shard-index":0,"shard-name":"1/2"},{"python-version":"3.14","shard-count":2,"shard-index":1,"shard-name":"2/2"}]') }}
     steps:
       - *checkout-repo
 
@@ -440,6 +440,34 @@ jobs:
             --modelaudit-shard-index ${{ matrix.shard-index }} \
             --tb=short --durations=15
 
+  python314-platform-smoke:
+    name: Python 3.14 Smoke (${{ matrix.os }})
+    needs: changes
+    if: needs.changes.outputs.integration == 'true' || needs.changes.outputs.python == 'true' || needs.changes.outputs.workflows == 'true'
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, windows-latest]
+    env:
+      PROMPTFOO_DISABLE_TELEMETRY: "1"
+    steps:
+      - *checkout-repo
+
+      - *install-uv
+
+      - *install-rust-toolchain
+
+      - name: Sync Python 3.14 smoke dependencies
+        run: uv sync --locked --python 3.14 --extra all-ci-windows --extra h5
+
+      - name: Verify Python 3.14 native and H5 imports
+        run: uv run --locked --python 3.14 python -c "import h5py, modelaudit_picklescan._rust; print(h5py.version.info)"
+
+      - name: Test Python 3.14 native pickle and H5 scanning
+        run: uv run --locked --python 3.14 pytest tests/test_python_compatibility.py -n 0 --tb=short
+
   slow-tests:
     name: Slow/Integration Tests (Python 3.12)
     needs: changes
@@ -485,11 +513,22 @@ jobs:
 
       - *install-uv
 
-      - *pin-python-312
+      # Python 3.12 traces large functions slowly: python/cpython#127953.
+      # The fast-test matrix retains Python 3.12 without coverage.
+      - name: Pin Python version
+        run: |
+          uv python pin 3.11
 
       - *install-rust-toolchain
 
-      - *cache-python-312-dependencies
+      - name: Cache Python dependencies
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
+        with:
+          path: *python-cache-paths
+          key: ${{ runner.os }}-uv-py3.11-${{ hashFiles('**/uv.lock', '**/pyproject.toml') }}
+          restore-keys: |
+            ${{ runner.os }}-uv-py3.11-
+            ${{ runner.os }}-uv-
 
       - *sync-all-ci-dependencies
 
@@ -852,20 +891,44 @@ jobs:
     needs: changes
     if: needs.changes.outputs.integration == 'true' || needs.changes.outputs.picklescan == 'true' || needs.changes.outputs.workflows == 'true'
     runs-on: ${{ matrix.os }}
-    timeout-minutes: ${{ matrix.os == 'macos-15-intel' && 30 || 15 }}
+    timeout-minutes: ${{ matrix.timeout-minutes || ((matrix.os == 'macos-15-intel' || matrix.os == 'windows-latest') && 30 || 15) }}
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest]
-        python-version: ["3.10", "3.11", "3.12", "3.13"]
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
         include:
+          - os: ubuntu-latest
+            python-version: "3.12"
+            timeout-minutes: 30
+          - os: ubuntu-latest
+            python-version: "3.13"
+            timeout-minutes: 30
+          - os: ubuntu-latest
+            python-version: "3.14"
+            timeout-minutes: 30
           # Exercise the release platform where scalar-probe timing regressed.
           - os: macos-15-intel
             python-version: "3.11"
+            timeout-minutes: 45
           - os: macos-15-intel
             python-version: "3.12"
+            timeout-minutes: 45
+          - os: macos-15
+            python-version: "3.14"
+            timeout-minutes: 60
+          - os: macos-15-intel
+            python-version: "3.14"
+            timeout-minutes: 75
+          - os: ubuntu-24.04-arm
+            python-version: "3.14"
+            timeout-minutes: 30
+          - os: windows-latest
+            python-version: "3.14"
+            timeout-minutes: 90
     defaults:
       run:
+        shell: bash
         working-directory: packages/modelaudit-picklescan
     steps:
       - *checkout-repo
@@ -876,7 +939,7 @@ jobs:
 
       - name: Install Rust toolchain
         run: |
-          rustup toolchain install 1.83.0 --profile minimal
+          rustup toolchain install 1.85.0 --profile minimal
           rustup toolchain install stable --profile minimal --component rustfmt --component clippy
           rustup default stable
 
@@ -904,7 +967,7 @@ jobs:
 
       - name: Check Rust scanner MSRV
         run: |
-          cargo +1.83.0 check --manifest-path Cargo.toml --locked
+          cargo +1.85.0 check --manifest-path Cargo.toml --locked
 
       - name: Lint Rust scanner crate
         run: |
@@ -916,11 +979,11 @@ jobs:
 
       - name: Lint standalone package with Ruff
         run: |
-          uv run --with 'ruff==0.17.0' ruff check src tests
+          uv run --with 'ruff==0.17.1' ruff check src tests
 
       - name: Check standalone package formatting with Ruff
         run: |
-          uv run --with 'ruff==0.17.0' ruff format --check src tests
+          uv run --with 'ruff==0.17.1' ruff format --check src tests
 
       - name: Type check standalone package with mypy
         run: |
@@ -928,7 +991,16 @@ jobs:
 
       - name: Run standalone package tests
         run: |
-          uv run --with pytest --with pytest-xdist --with 'typing-extensions>=4.14' pytest -n auto tests --tb=short
+          uv run --with pytest --with pytest-xdist --with 'typing-extensions>=4.14' pytest -n auto tests --tb=short --junitxml="$RUNNER_TEMP/picklescan-test-results.xml"
+
+      - name: Preserve Windows standalone test evidence
+        if: always() && runner.os == 'Windows'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: picklescan-tests-${{ matrix.os }}-${{ matrix.python-version }}
+          path: ${{ runner.temp }}/picklescan-test-results.xml
+          retention-days: 7
+          if-no-files-found: warn
 
       - name: Build standalone package
         run: |
@@ -942,6 +1014,11 @@ jobs:
         run: |
           set -euo pipefail
           uv venv /tmp/modelaudit-picklescan-wheel-smoke
+          if [[ -x /tmp/modelaudit-picklescan-wheel-smoke/bin/python ]]; then
+            SMOKE_PYTHON=/tmp/modelaudit-picklescan-wheel-smoke/bin/python
+          else
+            SMOKE_PYTHON=/tmp/modelaudit-picklescan-wheel-smoke/Scripts/python.exe
+          fi
 
           shopt -s nullglob
           picklescan_wheels=(/tmp/modelaudit-picklescan-dist/modelaudit_picklescan-*.whl)
@@ -951,23 +1028,69 @@ jobs:
             exit 1
           fi
 
-          uv pip install --python /tmp/modelaudit-picklescan-wheel-smoke/bin/python "${picklescan_wheels[0]}"
+          uv pip install --python "$SMOKE_PYTHON" "${picklescan_wheels[0]}"
 
           smoke_dir="$(mktemp -d)"
           (
             cd "$smoke_dir"
-            PYTHONPATH='' /tmp/modelaudit-picklescan-wheel-smoke/bin/python -I - <<'PY'
+            PYTHONPATH='' "$SMOKE_PYTHON" -I - <<'PY'
+          import importlib.metadata
           import importlib.util
+          import io
+          import pickle
+          import sys
+          from pathlib import Path
 
           import modelaudit_picklescan
+          import modelaudit_picklescan._rust as native
 
           assert importlib.util.find_spec("modelaudit") is None
-          assert importlib.util.find_spec("modelaudit_picklescan._rust") is not None
-          report = modelaudit_picklescan.scan_bytes(b"\x80\x04}q\x00.")
-          assert report.status.value == "complete", report
-          assert report.verdict.value == "clean", report
-          assert not any(notice.code == "engine_fallback" for notice in report.notices)
-          print("standalone modelaudit_picklescan wheel loaded without modelaudit")
+          assert not importlib.metadata.requires("modelaudit-picklescan")
+          for module in (modelaudit_picklescan, native):
+              origin = Path(module.__file__).resolve()
+              assert origin.is_relative_to(Path(sys.prefix).resolve()), origin
+              print(f"{module.__name__}: {origin}")
+          assert (Path(modelaudit_picklescan.__file__).parent / "py.typed").is_file()
+
+          for protocol in range(pickle.HIGHEST_PROTOCOL + 1):
+              payload = pickle.dumps({"weights": [1, 2, 3]}, protocol=protocol)
+              path = Path(f"protocol-{protocol}.pkl")
+              path.write_bytes(payload)
+              for report in (
+                  modelaudit_picklescan.scan_bytes(payload),
+                  modelaudit_picklescan.scan_stream(io.BytesIO(payload)),
+                  modelaudit_picklescan.scan_file(path),
+              ):
+                  assert report.status.value == "complete", report
+                  assert report.verdict.value == "clean", report
+                  assert not any(notice.code == "engine_fallback" for notice in report.notices)
+
+          malicious = modelaudit_picklescan.scan_bytes(b"cos\nsystem\n(S'echo unexpected'\ntR.")
+          assert malicious.verdict.value == "malicious", malicious
+          assert any(finding.rule_code == "DANGEROUS_CALL" for finding in malicious.findings), malicious
+          truncated = modelaudit_picklescan.scan_bytes(b"\x80\x04")
+          assert truncated.status.value != "complete", truncated
+          assert truncated.verdict.value != "clean", truncated
+          import string
+
+          # Qualify normal lazy-pattern initialization after importing the scanner.
+          string.Template("warm").substitute({})
+          template = modelaudit_picklescan.scan_bytes(
+              b"\x80\x04cstring\nTemplate.substitute\ncstring\nTemplate\n\x8c\x05plain\x85R}\x86R."
+          )
+          assert template.status.value == "complete", template
+          assert template.verdict.value == "clean", template
+          assert any(
+              invocation.get("template_receiver_state_unmodified") is True
+              for invocation in template.metadata.get("callable_invocations", ())
+          ), template
+          if sys.version_info >= (3, 14):
+              for method in ("Template.is_valid", "Template.get_identifiers"):
+                  payload = b"\x80\x04cstring\n" + method.encode() + b"\ncstring\nTemplate\n\x8c\x05plain\x85R\x85R."
+                  helper = modelaudit_picklescan.scan_bytes(payload)
+                  assert helper.status.value == "complete", helper
+                  assert helper.verdict.value == "clean", helper
+          print(f"standalone wheel API passed on {sys.version}")
           PY
           )
 
@@ -983,6 +1106,7 @@ jobs:
         uv-lock-check,
         type-check,
         windows-tests,
+        python314-platform-smoke,
         test,
         slow-tests,
         coverage,
@@ -1015,6 +1139,7 @@ jobs:
           LICENSE_RESULT="${{ needs.license-check.result }}"
           UV_LOCK_RESULT="${{ needs.uv-lock-check.result }}"
           TYPE_CHECK_RESULT="${{ needs.type-check.result }}"
+          PYTHON314_SMOKE_RESULT="${{ needs.python314-platform-smoke.result }}"
           WINDOWS_RESULT="${{ needs.windows-tests.result }}"
           TEST_RESULT="${{ needs.test.result }}"
           SLOW_RESULT="${{ needs.slow-tests.result }}"
@@ -1045,6 +1170,7 @@ jobs:
           echo "  license-check: $LICENSE_RESULT"
           echo "  uv-lock-check: $UV_LOCK_RESULT"
           echo "  type-check: $TYPE_CHECK_RESULT"
+          echo "  python314-platform-smoke: $PYTHON314_SMOKE_RESULT"
           echo "  windows-tests: $WINDOWS_RESULT"
           echo "  test: $TEST_RESULT"
           echo "  slow-tests: $SLOW_RESULT"
@@ -1078,6 +1204,7 @@ jobs:
           require_success "$EXPECT_DEPENDENCY_SURFACE" "$UV_LOCK_RESULT" "uv-lock-check"
           require_success "$EXPECT_CORE_FAST" "$TYPE_CHECK_RESULT" "type-check"
           require_success "$EXPECT_CORE_FAST" "$WINDOWS_RESULT" "windows-tests"
+          require_success "$EXPECT_CORE_FAST" "$PYTHON314_SMOKE_RESULT" "python314-platform-smoke"
           require_success "$EXPECT_TEST" "$TEST_RESULT" "test"
           require_success "$EXPECT_SLOW" "$SLOW_RESULT" "slow-tests"
           require_success "$EXPECT_COVERAGE" "$COVERAGE_RESULT" "coverage"

modelaudit-0.2.55/.release-please-manifest.json

@@ -0,0 +1,4 @@
+{
+  ".": "0.2.55",
+  "packages/modelaudit-picklescan": "0.1.13"
+}

{modelaudit-0.2.54 → modelaudit-0.2.55}/AGENTS.md

@@ -18,7 +18,7 @@ This repo publishes **two PyPI packages with independent versions**:
 | `modelaudit`            | `./` (root)                       | `pyproject.toml` + `uv.lock`    | `CHANGELOG.md`                                |
 | `modelaudit-picklescan` | `packages/modelaudit-picklescan/` | `pyproject.toml` + `Cargo.toml` | `packages/modelaudit-picklescan/CHANGELOG.md` |
 
-Root `modelaudit` hard-requires `modelaudit-picklescan>=0.1.11,<0.2.0` — when the sibling crosses `0.2.0`, bump the constraint in the same PR or the next `modelaudit` release is uninstallable. Both packages are driven by a single `release-please` workflow (`.github/workflows/release-please.yml`) with components defined in `release-please-config.json` and current versions in `.release-please-manifest.json`. Full publishing details — trusted publishing, manual `workflow_dispatch` recovery (`root_version` / `picklescan_version`), and yank procedure — are in [`docs/agents/release-process.md`](docs/agents/release-process.md). For work inside the picklescan package, start from [`packages/modelaudit-picklescan/AGENTS.md`](packages/modelaudit-picklescan/AGENTS.md).
+Root `modelaudit` hard-requires `modelaudit-picklescan>=0.1.13,<0.2.0` — when the sibling crosses `0.2.0`, bump the constraint in the same PR or the next `modelaudit` release is uninstallable. Both packages are driven by a single `release-please` workflow (`.github/workflows/release-please.yml`) with components defined in `release-please-config.json` and current versions in `.release-please-manifest.json`. Full publishing details — trusted publishing, manual `workflow_dispatch` recovery (`root_version` / `picklescan_version`), and yank procedure — are in [`docs/agents/release-process.md`](docs/agents/release-process.md). For work inside the picklescan package, start from [`packages/modelaudit-picklescan/AGENTS.md`](packages/modelaudit-picklescan/AGENTS.md).
 
 ## Mission & Principles
 
@@ -106,7 +106,7 @@ PROMPTFOO_DISABLE_TELEMETRY=1 uv run pytest -n auto -m "not slow and not integra
 
 ## Coding & Style Guardrails
 
-- **Python:** 3.10–3.13 supported. Classes PascalCase, functions/vars snake_case, constants UPPER_SNAKE_CASE, always type hints.
+- **Python:** 3.10–3.14 supported. Classes PascalCase, functions/vars snake_case, constants UPPER_SNAKE_CASE, always type hints.
 - **Comments:** Use sparingly to explain intent, not mechanics.
 - **Docs/Markdown:** Keep concise; when formatting markdown/json/yaml, use `npm ci --ignore-scripts && npx prettier --write "**/*.{md,yaml,yml,json}"` if instructed or if formatting drifts.
 - **Dependencies:** Do not add new packages without explicit approval and updating `pyproject.toml`/locks.
@@ -117,7 +117,7 @@ PROMPTFOO_DISABLE_TELEMETRY=1 uv run pytest -n auto -m "not slow and not integra
 - Preserve or strengthen detections; test both benign and malicious samples.
 - Follow existing scanner patterns and update registries, CLI wiring, and docs as needed.
 - Add comprehensive tests, including edge cases and regression coverage.
-- Ensure compatibility across Python 3.10–3.13 and handle missing optional deps gracefully.
+- Ensure compatibility across Python 3.10–3.14 and handle missing optional deps gracefully.
 
 ## Testing & Routing Guardrails
 

{modelaudit-0.2.54 → modelaudit-0.2.55}/CHANGELOG.md

@@ -5,8 +5,94 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.55](https://github.com/promptfoo/modelaudit/compare/v0.2.54...v0.2.55) (2026-11-06)
+
+### Features
+
+- **metadata:** make directory table display limits configurable ([#1896](https://github.com/promptfoo/modelaudit/issues/1896)) ([df49ca9](https://github.com/promptfoo/modelaudit/commit/df49ca90c5a10095ea405e4d769f0a18eb09210a))
+- **python:** support standard CPython 3.14 in ModelAudit ([#1908](https://github.com/promptfoo/modelaudit/issues/1908)) ([58a6784](https://github.com/promptfoo/modelaudit/commit/58a67841beb8eab124dcfad457bb281597d50e75))
+
+### Bug Fixes
+
+- **ci:** restore Click 8.5 scanning and Windows fixtures ([#1906](https://github.com/promptfoo/modelaudit/issues/1906)) ([f996f12](https://github.com/promptfoo/modelaudit/commit/f996f12c7f3b3f338844a4380639cadc095a9c1f))
+- **ci:** run branch coverage on Python 3.11 ([#1921](https://github.com/promptfoo/modelaudit/issues/1921)) ([8220211](https://github.com/promptfoo/modelaudit/commit/8220211638eca66875f73eb80d7eaa07c976a7eb))
+- **deps:** update rust crate pyo3 to 0.30.0 ([#1914](https://github.com/promptfoo/modelaudit/issues/1914)) ([415819f](https://github.com/promptfoo/modelaudit/commit/415819fa0b58d097dd201c0fa3f41eba33431c78))
+- **gguf:** recognize the remaining ggml tensor types ([#1909](https://github.com/promptfoo/modelaudit/issues/1909)) ([a5cbeca](https://github.com/promptfoo/modelaudit/commit/a5cbeca11d6ad3e2c9a93dd7501eddf339a36dbf))
+- **gguf:** validate interleaved row groups per matrix ([#1920](https://github.com/promptfoo/modelaudit/issues/1920)) ([6a6bdba](https://github.com/promptfoo/modelaudit/commit/6a6bdba5c13def3b3368a1198bbbfde0d6d4b666))
+- improve scanner coverage and preserve per-member diagnostics ([#1942](https://github.com/promptfoo/modelaudit/issues/1942)) ([71aa359](https://github.com/promptfoo/modelaudit/commit/71aa359096c83f84b8fc3831171f63ccb6a60d47))
+- **metadata:** keep YAML fallback warnings out of JSON stdout ([#1895](https://github.com/promptfoo/modelaudit/issues/1895)) ([c25b6ee](https://github.com/promptfoo/modelaudit/commit/c25b6ee3b3640f7707469e930a2b319ee0f61e76))
+- **metadata:** preserve extraction errors in filtered and directory output ([#1888](https://github.com/promptfoo/modelaudit/issues/1888)) ([3873627](https://github.com/promptfoo/modelaudit/commit/3873627dc8644797eb39127e3a859e5f23d6d2e7))
+- **onnx:** preserve bounded control-flow weight coverage ([#1848](https://github.com/promptfoo/modelaudit/issues/1848)) ([3cdd9e0](https://github.com/promptfoo/modelaudit/commit/3cdd9e05c07593c6c68f86f214b192354877d943))
+- **picklescan:** restore Click 8.5 detection and Windows test portability ([#1864](https://github.com/promptfoo/modelaudit/issues/1864)) ([2838c99](https://github.com/promptfoo/modelaudit/commit/2838c9978c2254ae699c63712b311b2491d047a7))
+- **picklescan:** support standard CPython 3.14 ([#1907](https://github.com/promptfoo/modelaudit/issues/1907)) ([5cda52b](https://github.com/promptfoo/modelaudit/commit/5cda52b0698109e479d10394579cf2128bf3d577))
+- **results:** report completed scans with security findings as successful ([#1941](https://github.com/promptfoo/modelaudit/issues/1941)) ([d37d506](https://github.com/promptfoo/modelaudit/commit/d37d506844d3a2107dd4c4a1a4d120a375f2821e))
+- **routing:** avoid pickle false positives on license text ([#1911](https://github.com/promptfoo/modelaudit/issues/1911)) ([6128247](https://github.com/promptfoo/modelaudit/commit/6128247b084f3bb64724706ab037c7de8ab242f5))
+
 ## [Unreleased]
 
+### Added
+
+- Support standard CPython 3.14 with native pickle and H5 scanner validation across Linux, macOS, and Windows.
+- Add `metadata --table-limit` to control the number of file entries displayed in directory tables.
+
+### Changed
+
+- Require Rust 1.85 or newer for source builds of the native pickle scanner and use Rust 1.85 in Docker builds for PyO3 0.30 compatibility.
+
+### Fixed
+
+- Report completed scans as successful in the Python API even when a security check raises a warning.
+- Upgrade APT packages in all Docker runtime images to include Debian security fixes.
+- Distinguish reshape dimensions from activation data when tracing both inputs of an ONNX attention contraction. Dynamically transformed weights retain their coverage gaps.
+
+- Preserve individual pickle coverage notices and member locations in consolidated scan results.
+- Validate PyTorch storage references alongside wide RNG state tuples and track up to 2,048 dictionary entries in pickle state analysis.
+- Recognize standalone Tekken vocabulary JSON without routing token spellings to model checkpoint parsers. Filtered domain-shaped code tokens in model cards no longer consume the network evidence classification budget.
+
+- Exclude weight consumers in proven-unreachable Loop and Scan bodies while retaining operator security checks and coverage for uncertain execution.
+- Resolve bound function attributes during finite ONNX replay and ignore unrelated dead transforms without dropping live weight consumers.
+- Bound duplicate singular fields during ONNX control preflight and preserve findings and explicit incomplete coverage when admission stops.
+- Preserve finite-loop vector proofs when ONNX Concat combines carried state with known constant operands, while retaining incomplete coverage for unknown operands.
+
+- Separate physical ONNX weight-storage checks from logical expanded-view admission, preserving per-view and cumulative limits without repeatedly copying source payloads.
+- Preserve immutable constants captured by effective ONNX function graph bindings during recurrent weight proofs, including defaults, overrides and forwarded graphs.
+- Reuse successful and rejected ONNX vector-control proofs across Expand, axes and Reshape analysis, including recurrent state proofs, so each immutable tensor payload is read once.
+- Bound primary Einsum weight orientation with the shared literal-equation cache before decoding, including resolved Expand and repeated function consumers.
+- Require immutable or proven Scan-8 batch extents and admit typed, budgeted body-local constants before finite weight replay.
+- Preserve trusted runtime-input types through ONNX loop replay and function scopes without trusting shadowed names or unknown operands.
+- Bound and reuse parsed ONNX Einsum equations during repeated shape inference, and reuse capture proofs for equivalent scalar bindings without weakening type checks.
+- Exclude unused function graph arguments from finite ONNX replay while retaining unknown results for unresolved used bindings and scopes.
+- Keep unknown Cast targets and unproven pooling samples from suppressing ONNX weight-coverage gaps.
+- Bound retained ONNX function opset maps before construction and preserve incomplete coverage when a scope exceeds the aggregate budget.
+- Reject unresolved ONNX function overrides and invalid Squeeze rank proofs without consuming capture budgets for unused graph arguments across reentry, dependency, and reachability traversal.
+- Keep local-function graph captures reachable during ONNX weight analysis, and prevent invalid transform bindings from establishing weight-coverage exclusions.
+- Bound and reuse ONNX repeated Constant attribute copies and opset environments, and resolve caller-bound weight-transform attributes while preserving findings and incomplete-coverage outcomes.
+- Reuse ONNX local-function default maps and bound copying them into call environments.
+- Avoid false ONNX weight-coverage gaps for empty Scan-8 batches while retaining downstream coverage for returned states and output dimensions.
+- Charge each distinct ONNX weight-analysis view against the cumulative byte budget while preserving accepted findings and reporting incomplete coverage for skipped views.
+- Preserve ONNX training-normalization and loop-exit weight coverage when entry shapes are unproven or state ranks later increase.
+- Apply ONNX output rank and type semantics to deferred numeric provenance, and retain coverage when pooling or convolution turns dimensions into numeric coefficients.
+- Retain nested ONNX Loop control dependencies despite unused captures, promote deferred BatchNormalization parameter coverage to matrix outputs, and require proven entry ranks before suppressing recurrent weight gaps.
+- Preserve ONNX weight coverage across unknown broadcast ranks, including runtime values with only shape-control provenance, unproven branch and Reshape dimensions, captured runtime inputs, and repeated loop state changes, including initializer-backed states, cumulative scalar rank growth, repeated body consumers, and final transformed weights without stale first-iteration shapes or fabricated products of symbolic dimensions; distinguish builtin operators from exact local-function overloads in weight roles, transforms, and shape proofs while retaining unmatched builtin overloads; avoid false coverage gaps for unchanged shape-control values and provenance, separately captured constants, and fixed-shape single-step Scans including shared sequence extents beside symbolic inputs and feature widths, no-op shape-restoring loops, unchanged Scan-8 batch views, and padded Scan-8 outputs with omitted sequence lengths only for builtin Scan producers.
+- Preserve ONNX coverage through successive, replacement, and sibling loop-state transfers without feeding stacked Scan outputs back into independent sequence slices, including independent Constant and initializer replacements, deferred gaps and retained matrix lineages, activation recurrences with independently analyzed opposite weight views through nested graph and function calls, including constant-initialized activations and invariant carried weights, without suppressing later weight uses or sibling transfers, and nested branch, skipped-loop, and caller-bound shape and graph attributes; preserve optional control-flow output positions, distinguish immutable caller bindings, use initial state for provably skipped Loops and zero-extent modern Scans, preserve invariant modern Scan shape values and the invariant entry condition, and honor independent immutable Loop bounds, sliced Shape attributes, and prove single-iteration termination with caller-bound attributes only for builtin operators, excluding local Constant call attributes from immutable control proofs, and materialize bounded Scan input slices and stacked Loop and Scan weight views with their actual axes only when their values remain invariant; preserve proven axes of partially known Loop stacks without widening iteration replay or concrete-shape metadata; use proven per-iteration input shapes for nested Scan bounds, recurrence, and GatherND indices without trusting intermediate shape declarations or unresolved source-lineage shapes, preserve separately proven recurrent hidden/cell state shapes, and keep Scan-8 sequence lengths and batch axes separate from body transforms, preserve initial states for immutable zero lengths, and fail closed for unmaterialized final-state, sequence-input, and stacked views without analyzing unused Scan-8 padding as a weight.
+- Exclude empty weight views before statistical reductions, enforce per-tensor and cumulative ONNX budgets on expanded weight views in both scanner routes, and bound and reuse successful or failed scalar-control decoding before dimension allocation, shared condition-producer indexes, invocation-local Scan axis decoding and bounded lineage-name views, repeated graph and sibling-state traversal while excluding unreferenced function graph arguments, constant-context copying and aggregate cache-key construction after excluding shadowed and nonconstant bindings and reusing only relevant immutable attribute environments, dependency-closure work, inferred ranks, rank-only permutations, aggregate shape dimensions, and analysis-cache retention; keep inferred dimension arithmetic within signed 64-bit bounds; retain traversal-exhaustion evidence independently of model value names and invalidate Scan slices that exceed the transform budget; reuse Scan repetition proofs across sibling states, reject copying reshapes, and preserve independent weight findings and budget capacity when another view cannot be prepared.
+- Avoid incomplete ONNX weight analysis when mixed shape and activation bookkeeping fanout does not feed generated weights.
+- Preserve ONNX lineage coverage when zero-length Scan paths, overridable shape defaults, or capped rank-promotable values can hide generated weights.
+- Bound ONNX repeated-state reentry work while preserving local-function, shape, and lineage coverage.
+- Preserve caller-bound ONNX Loop conditions over body initializer defaults and reuse local-function analysis across unused attribute values.
+- Preserve early TAR findings after sparse-file probing and enforce SafeTensors JSON nesting limits consistently across Python versions.
+- Keep complete streamed pickle analysis available for oversized remote source URLs across Python versions, preserving SBOM findings and source associations.
+- Validate retired interleaved GGUF row groups within each matrix, so incomplete groups cannot pass by combining rows across higher dimensions.
+- Send metadata YAML fallback warnings to stderr so they do not contaminate JSON output.
+- Preserve metadata extraction errors with `--security-only` and display them in directory table output.
+- Avoid treating ordinary license text such as `Microsoft.` as a pickle stream when its apparent opcodes have an invalid stack. Preserve valid streams with residual stack values or overwritten memo entries, nested payload detection, and completed executable prefixes with malformed trailing data.
+- Recognize the remaining GGUF tensor types that ggml defines (IQ1_S, IQ1_M, IQ2_XXS, IQ2_XS, IQ2_S, IQ3_XXS, IQ4_NL, I8, I16, I32, I64, F64, TQ1_0, TQ2_0, MXFP4, NVFP4, Q1_0, and Q2_0) and the retired Q4_0_4_4, Q4_0_4_8, and Q4_0_8_8 layouts that published files still use, so GGUF files that use them get tensor bounds validation instead of an inconclusive scan. Other retired and unknown type IDs remain inconclusive.
+- Check GGUF block alignment per tensor row, as ggml does, so a block-quantized tensor whose first dimension is not a multiple of its block size is flagged even when its total element count is. The retired Q4_0 layouts must also hold whole groups of rows.
+- Detect invoked class constructors returned by source-backed module compatibility hooks, including Click 8.5's legacy LazyFile export.
+- Preserve annotated and conditional compatibility aliases and use consistent, depth-bounded constant-branch analysis. Check metaclasses during returned-class member lookup with a bounded traversal that reuses shared ancestors, and retain dangerous paths across incomplete alternatives and separate pickle invocations. Report incomplete analysis for export deletion, class-method compatibility hooks, returned functions or function-local classes, unresolved member paths, loop or context-manager bindings, and unproven metaclasses. Skip provably unreachable deletions and retain existing possible paths for uncertain export bindings. Preserve resolved hooks and independent findings when source or metaclass analysis reaches a limit. Continue supplemental stream checks after call-graph coverage gaps, and keep operational failures unsuccessful even with trusted padding.
+- Preserve detection of startup-hook writes through Click 8.5’s legacy `LazyFile` export.
+- Make the nested archive test fixture portable to Windows.
+
 ## [0.2.54](https://github.com/promptfoo/modelaudit/compare/v0.2.53...v0.2.54) (2026-10-06)
 
 ### Security

{modelaudit-0.2.54 → modelaudit-0.2.55}/CONTRIBUTING.md

@@ -6,10 +6,10 @@ Thank you for your interest in contributing to ModelAudit! This guide will help
 
 ### Prerequisites
 
-- Python 3.10-3.13
+- Python 3.10-3.14
 - uv (recommended) or pip
 - Git
-- Rust 1.83+ toolchain with `cargo`, `rustfmt`, and `clippy`; editable installs build the native pickle scanner extension
+- Rust 1.85+ toolchain with `cargo`, `rustfmt`, and `clippy`; editable installs build the native pickle scanner extension
 
 ### Setup
 

{modelaudit-0.2.54 → modelaudit-0.2.55}/Dockerfile

@@ -1,6 +1,6 @@
 ARG PYTHON_IMAGE=python:3.13-slim@sha256:c33f0bc4364a6881bed1ec0cc2665e6c53c87a43e774aaeab88e6f17af105e4f
 # Keep the major/minor version in sync with packages/modelaudit-picklescan/Cargo.toml rust-version.
-ARG PICKLESCAN_RUST_TOOLCHAIN=1.83.0
+ARG PICKLESCAN_RUST_TOOLCHAIN=1.85.0
 ARG RUSTUP_VERSION=1.29.0
 ARG RUSTUP_INIT_X86_64_UNKNOWN_LINUX_GNU_SHA256=4acc9acc76d5079515b46346a485974457b5a79893cfb01112423c89aeb5aa10
 ARG RUSTUP_INIT_AARCH64_UNKNOWN_LINUX_GNU_SHA256=9732d6c5e2a098d3521fca8145d826ae0aaa067ef2385ead08e6feac88fa5792
@@ -34,7 +34,7 @@ WORKDIR /app
 
 RUN apt-get update \
     && apt-get install --yes --no-install-recommends --only-upgrade \
-        bsdutils gzip libc-bin libc6 libblkid1 libcap2 liblastlog2-2 libmount1 libpcre2-8-0 libsmartcols1 libsqlite3-0 \
+        apt bsdutils gzip libapt-pkg7.0 libc-bin libc6 libblkid1 libcap2 liblastlog2-2 libmount1 libpcre2-8-0 libsmartcols1 libsqlite3-0 \
         libssl3t64 libsystemd0 libudev1 libuuid1 login mount perl-base util-linux \
     && apt-get install --yes --no-install-recommends ca-certificates \
     && rm -rf /var/lib/apt/lists/*

{modelaudit-0.2.54 → modelaudit-0.2.55}/Dockerfile.full

@@ -1,6 +1,6 @@
 ARG PYTHON_IMAGE=python:3.13-slim@sha256:c33f0bc4364a6881bed1ec0cc2665e6c53c87a43e774aaeab88e6f17af105e4f
 # Keep the major/minor version in sync with packages/modelaudit-picklescan/Cargo.toml rust-version.
-ARG PICKLESCAN_RUST_TOOLCHAIN=1.83.0
+ARG PICKLESCAN_RUST_TOOLCHAIN=1.85.0
 ARG RUSTUP_VERSION=1.29.0
 ARG RUSTUP_INIT_X86_64_UNKNOWN_LINUX_GNU_SHA256=4acc9acc76d5079515b46346a485974457b5a79893cfb01112423c89aeb5aa10
 ARG RUSTUP_INIT_AARCH64_UNKNOWN_LINUX_GNU_SHA256=9732d6c5e2a098d3521fca8145d826ae0aaa067ef2385ead08e6feac88fa5792
@@ -31,7 +31,7 @@ WORKDIR /app
 
 RUN apt-get update \
     && apt-get install --yes --no-install-recommends --only-upgrade \
-        bsdutils gzip libc-bin libc6 libblkid1 libcap2 liblastlog2-2 libmount1 libpcre2-8-0 libsmartcols1 libsqlite3-0 \
+        apt bsdutils gzip libapt-pkg7.0 libc-bin libc6 libblkid1 libcap2 liblastlog2-2 libmount1 libpcre2-8-0 libsmartcols1 libsqlite3-0 \
         libssl3t64 libsystemd0 libudev1 libuuid1 login mount perl-base util-linux \
     && apt-get install --yes --no-install-recommends ca-certificates \
     && rm -rf /var/lib/apt/lists/*

{modelaudit-0.2.54 → modelaudit-0.2.55}/Dockerfile.tensorflow

@@ -1,6 +1,6 @@
 ARG PYTHON_IMAGE=python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1
 # Keep the major/minor version in sync with packages/modelaudit-picklescan/Cargo.toml rust-version.
-ARG PICKLESCAN_RUST_TOOLCHAIN=1.83.0
+ARG PICKLESCAN_RUST_TOOLCHAIN=1.85.0
 ARG RUSTUP_VERSION=1.29.0
 ARG RUSTUP_INIT_X86_64_UNKNOWN_LINUX_GNU_SHA256=4acc9acc76d5079515b46346a485974457b5a79893cfb01112423c89aeb5aa10
 ARG RUSTUP_INIT_AARCH64_UNKNOWN_LINUX_GNU_SHA256=9732d6c5e2a098d3521fca8145d826ae0aaa067ef2385ead08e6feac88fa5792
@@ -36,7 +36,7 @@ WORKDIR /app
 # Pull in current Debian security fixes from the configured apt sources.
 RUN apt-get update \
     && apt-get install --yes --no-install-recommends --only-upgrade \
-        bsdutils gzip libc-bin libc6 libblkid1 liblastlog2-2 libmount1 libpcre2-8-0 libsmartcols1 libsqlite3-0 libssl3t64 \
+        apt bsdutils gzip libapt-pkg7.0 libc-bin libc6 libblkid1 liblastlog2-2 libmount1 libpcre2-8-0 libsmartcols1 libsqlite3-0 libssl3t64 \
         libuuid1 login mount perl-base util-linux \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/*