mscs 2.3.0__tar.gz → 2.4.1__tar.gz

{mscs-2.3.0 → mscs-2.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mscs
-Version: 2.3.0
+Version: 2.4.1
 Summary: Safe, fast serialization for Python — a secure replacement for pickle with HMAC authentication, native numpy/PyTorch support.
 Project-URL: Homepage, https://github.com/ElEscribanoSilente/MSC-Serial
 Project-URL: Repository, https://github.com/ElEscribanoSilente/MSC-Serial
@@ -41,7 +41,7 @@ Description-Content-Type: text/markdown
 
 # MSCS — Safe Serialization for Python
 
-**v2.3.0** | [Changelog](CHANGELOG.md) | [PyPI](https://pypi.org/project/mscs/)
+**v2.4.1** | [Changelog](CHANGELOG.md) | [PyPI](https://pypi.org/project/mscs/)
 
 > **Status: Beta** — API is stable but the format may evolve. Not yet battle-tested in large-scale production.
 
@@ -208,13 +208,13 @@ mscs.loads(unsigned_data, hmac_key=key)  # MSCSecurityError: anti-downgrade prot
 |------|-------|
 | `None`, `bool`, `int`, `float`, `complex` | Ints up to 8192 bytes (~19,700 digits) |
 | `str`, `bytes`, `bytearray` | UTF-8, ref-tracked |
-| `list`, `tuple`, `dict`, `set`, `frozenset` | Circular refs supported |
+| `list`, `tuple`, `dict`, `set`, `frozenset`, `deque` | Circular refs supported; `deque` preserves `maxlen` |
 | `datetime`, `date`, `time`, `timedelta` | ISO 8601 |
 | `Decimal`, `UUID`, `Path` | Lossless |
 | `Enum` | Must be registered |
 | `numpy.ndarray` | dtype whitelist enforced |
 | `torch.Tensor` | Auto CPU transfer, preserves requires_grad |
-| `dataclass`, `__slots__`, `__dict__` objects | Must be registered |
+| `dataclass` (incl. `frozen`), `__slots__`, `__dict__` objects | Must be registered |
 
 ## Performance
 
@@ -242,10 +242,10 @@ mscs provides a **defense-in-depth** approach, but it is **not a sandbox**. Unde
 2. **Explicit registry**: Custom classes must be registered before deserialization; unregistered classes raise `MSCSecurityError`
 3. **NumPy dtype whitelist**: Blocks `object`, `void`, and structured dtypes that could execute code
 4. **Configurable limits**: `MAX_DEPTH=256`, `MAX_SIZE=512MB`, `MAX_COLLECTION=10M`, `MAX_INT_BYTES=8192`
-5. **Anti zip-bomb**: `load_compressed` validates both compressed and decompressed sizes with bounded reads
+5. **Anti zip-bomb**: `load_compressed` caps the compressed input and decompresses **incrementally** against a hard `MAX_SIZE` limit, aborting as soon as it is crossed — a bomb cannot exhaust memory before the size check
 6. **Path null byte rejection**: Paths containing null bytes are rejected
 7. **CRC32 corruption detection**: Optional checksum to detect accidental data corruption (not cryptographic — an attacker can forge CRC32)
-8. **HMAC-SHA256 authentication**: Optional cryptographic signature to detect intentional tampering. Anti-downgrade protection prevents stripping the HMAC flag.
+8. **HMAC-SHA256 authentication**: Optional cryptographic signature to detect intentional tampering. Anti-downgrade protection rejects any payload lacking a valid HMAC when a key is supplied — including the legacy **v1** format — so an attacker cannot strip or version-downgrade the signature.
 9. **Trailing bytes rejection**: Payloads with unexpected bytes after the serialized object are rejected
 10. **Integer size limit**: Ints larger than `MAX_INT_BYTES` (8192 bytes, ~19,700 digits) are rejected to prevent CPU exhaustion attacks
 
@@ -303,6 +303,7 @@ CRC32 and HMAC are mutually exclusive (HMAC is strictly superior).
 | 0x17 | Path | `<I>` str len + UTF-8 path string |
 | 0x18 | Tensor | str(meta) + `<I>` data size + raw buffer |
 | 0x19 | timedelta2 | `<iiI>` days, seconds, microseconds |
+| 0x1A | deque | `<i>` maxlen (-1 if None) + `<I>` item count + items |
 
 **ndarray meta**: `"{dtype}|{shape}"` where shape is `"dim0xdim1x..."` (e.g., `"float32|100x100"`).
 

{mscs-2.3.0 → mscs-2.4.1}/README.md

@@ -1,6 +1,6 @@
 # MSCS — Safe Serialization for Python
 
-**v2.3.0** | [Changelog](CHANGELOG.md) | [PyPI](https://pypi.org/project/mscs/)
+**v2.4.1** | [Changelog](CHANGELOG.md) | [PyPI](https://pypi.org/project/mscs/)
 
 > **Status: Beta** — API is stable but the format may evolve. Not yet battle-tested in large-scale production.
 
@@ -167,13 +167,13 @@ mscs.loads(unsigned_data, hmac_key=key)  # MSCSecurityError: anti-downgrade prot
 |------|-------|
 | `None`, `bool`, `int`, `float`, `complex` | Ints up to 8192 bytes (~19,700 digits) |
 | `str`, `bytes`, `bytearray` | UTF-8, ref-tracked |
-| `list`, `tuple`, `dict`, `set`, `frozenset` | Circular refs supported |
+| `list`, `tuple`, `dict`, `set`, `frozenset`, `deque` | Circular refs supported; `deque` preserves `maxlen` |
 | `datetime`, `date`, `time`, `timedelta` | ISO 8601 |
 | `Decimal`, `UUID`, `Path` | Lossless |
 | `Enum` | Must be registered |
 | `numpy.ndarray` | dtype whitelist enforced |
 | `torch.Tensor` | Auto CPU transfer, preserves requires_grad |
-| `dataclass`, `__slots__`, `__dict__` objects | Must be registered |
+| `dataclass` (incl. `frozen`), `__slots__`, `__dict__` objects | Must be registered |
 
 ## Performance
 
@@ -201,10 +201,10 @@ mscs provides a **defense-in-depth** approach, but it is **not a sandbox**. Unde
 2. **Explicit registry**: Custom classes must be registered before deserialization; unregistered classes raise `MSCSecurityError`
 3. **NumPy dtype whitelist**: Blocks `object`, `void`, and structured dtypes that could execute code
 4. **Configurable limits**: `MAX_DEPTH=256`, `MAX_SIZE=512MB`, `MAX_COLLECTION=10M`, `MAX_INT_BYTES=8192`
-5. **Anti zip-bomb**: `load_compressed` validates both compressed and decompressed sizes with bounded reads
+5. **Anti zip-bomb**: `load_compressed` caps the compressed input and decompresses **incrementally** against a hard `MAX_SIZE` limit, aborting as soon as it is crossed — a bomb cannot exhaust memory before the size check
 6. **Path null byte rejection**: Paths containing null bytes are rejected
 7. **CRC32 corruption detection**: Optional checksum to detect accidental data corruption (not cryptographic — an attacker can forge CRC32)
-8. **HMAC-SHA256 authentication**: Optional cryptographic signature to detect intentional tampering. Anti-downgrade protection prevents stripping the HMAC flag.
+8. **HMAC-SHA256 authentication**: Optional cryptographic signature to detect intentional tampering. Anti-downgrade protection rejects any payload lacking a valid HMAC when a key is supplied — including the legacy **v1** format — so an attacker cannot strip or version-downgrade the signature.
 9. **Trailing bytes rejection**: Payloads with unexpected bytes after the serialized object are rejected
 10. **Integer size limit**: Ints larger than `MAX_INT_BYTES` (8192 bytes, ~19,700 digits) are rejected to prevent CPU exhaustion attacks
 
@@ -262,6 +262,7 @@ CRC32 and HMAC are mutually exclusive (HMAC is strictly superior).
 | 0x17 | Path | `<I>` str len + UTF-8 path string |
 | 0x18 | Tensor | str(meta) + `<I>` data size + raw buffer |
 | 0x19 | timedelta2 | `<iiI>` days, seconds, microseconds |
+| 0x1A | deque | `<i>` maxlen (-1 if None) + `<I>` item count + items |
 
 **ndarray meta**: `"{dtype}|{shape}"` where shape is `"dim0xdim1x..."` (e.g., `"float32|100x100"`).
 

{mscs-2.3.0 → mscs-2.4.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "mscs"
-version = "2.3.0"
+version = "2.4.1"
 description = "Safe, fast serialization for Python — a secure replacement for pickle with HMAC authentication, native numpy/PyTorch support."
 readme = "README.md"
 license = "MIT"