pyblastradius 0.4.2__tar.gz → 0.4.3__tar.gz

{pyblastradius-0.4.2 → pyblastradius-0.4.3}/CHANGELOG.md

@@ -5,6 +5,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.3] - 2026-10-18
+
+### Security
+- Upgrade `rustls` to `0.23.46`, resolving `RUSTSEC-2026-0346`, `0347`, `0348`, and `0349` (RECHECK-031).
+
+### Fixed
+- Update `README.md` discovery table to reflect the real Rust-backed `AirflowDiscoverer` implementation (RECHECK-008).
+
 ## [0.4.2] - 2026-10-17
 
 ### Fixed

{pyblastradius-0.4.2 → pyblastradius-0.4.3}/Cargo.lock

@@ -1828,7 +1828,7 @@ dependencies = [
 
 [[package]]
 name = "pyblastradius"
-version = "0.4.1"
+version = "0.4.3"
 dependencies = [
  "anyhow",
  "backtrace",
@@ -2153,9 +2153,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.45"
+version = "0.23.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
+checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
 dependencies = [
  "once_cell",
  "rustls-pki-types",

{pyblastradius-0.4.2 → pyblastradius-0.4.3}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "pyblastradius"
-version = "0.4.1"
+version = "0.4.3"
 edition = "2021"
 rust-version = "1.70"
 description = "Operational Blast Radius Intelligence Platform - Predict cascading failures and quantify business impact"

{pyblastradius-0.4.2 → pyblastradius-0.4.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pyblastradius
-Version: 0.4.2
+Version: 0.4.3
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers
@@ -99,10 +99,10 @@ Working today, backed by the real Rust engine (`pyblastradius._core`):
 - **Terraform discovery** — `TerraformDiscoverer` (used by `pyblastradius scan terraform://path=...`, `type: terraform` in `blastradius.yml`, and directly as `pyblastradius.TerraformDiscoverer`) parses real `.tf` files via `hcl-rs`, discovers any `resource "type" "name" { ... }` block (not limited to a handful of hardcoded AWS types), and derives real dependency edges from actual resource references found in each resource's own attribute values (`aws_db_instance.x.endpoint` bare traversals, and `"${aws_db_instance.x.endpoint}"` interpolated strings) — not a hardcoded example dependency list. Benchmarked in `benches/large_graph.rs` on graphs up to 1,000 nodes.
 - **Kubernetes discovery** — `KubernetesDiscoverer` (used by `pyblastradius scan kubernetes://manifests_dir=...`, `type: kubernetes` in `blastradius.yml`, and directly as `pyblastradius.KubernetesDiscoverer`) parses real Service/Deployment/StatefulSet/DaemonSet YAML manifests (`---`-separated multi-document files supported) and infers edges from container env var values that reference other discovered workload names. `kubeconfig`/`context` are accepted for interface compatibility but have no effect — there is no live-cluster API client, only local manifest parsing; `namespaces` is likewise accepted but not yet used to filter.
 - **OTLP trace discovery** — `OtelDiscoverer` (used by `pyblastradius scan otlp://endpoint=...`, `type: otlp` in `blastradius.yml`, and directly as `pyblastradius.OtelDiscoverer`) runs a real OTLP/gRPC trace *receiver* (the standard `TraceService.Export` RPC) bound to `endpoint`, collects whatever spans instrumented services actually push to it during the collection window, and builds edges from real cross-service parent/child span pairs with observed latency and error status. **This is a receiver you bind, not a client that connects to an existing collector** — `endpoint` must be a literal `ip:port` listen address (e.g. `"0.0.0.0:4317"`), and your services need to be configured to export to it.
+- **Airflow DAG discovery** — `AirflowDiscoverer` (used by `pyblastradius scan airflow://dag_folder=...`, `type: airflow` in `blastradius.yml`, and directly as `pyblastradius.AirflowDiscoverer`) parses Python DAG files on disk (`src/discovery/airflow.rs`) to extract DAGs, tasks, `>>`/`<<`/`set_downstream`/`set_upstream`/`chain(...)` dependencies, and external system references (`conn_id`/SQL tables).
 
 Not yet implemented (present as scaffolding/placeholders, listed here so you don't spend time debugging them):
 
-- **Airflow discovery** — `AirflowDiscoverer` (used by `pyblastradius scan`) currently always returns an empty graph. There is no DAG parsing or Airflow API connection behind it yet. (Terraform/Kubernetes/OTLP discovery are real — see Features above.)
 - **Hidden Dependency Detection / Anomaly Detection** — `HiddenDependencyDetector` and `AnomalyDetector` always return empty results; they are not wired to any metrics/trace source.
 - **`pyblastradius.integrations`** — `OtelCollectorClient` and `StatGuardianClient` are placeholders that return empty/fake data; `DbtManifestParser` genuinely parses a dbt `manifest.json` you already have on disk and is real.
 - **GraphQL API** — not exposed anywhere; the Rust crate has a query-string builder (`src/api/graphql.rs`) that nothing serves or executes.
@@ -310,7 +310,7 @@ Discovery source integration status (i.e. what `pyblastradius scan` /
 |-----------------|--------|----------|
 | Kubernetes | **Real** | `discover()` parses real Service/Deployment/StatefulSet/DaemonSet YAML manifests and infers edges from container env var references (see Features above); `kubeconfig`/`context`/live-cluster API access are not implemented |
 | Terraform | **Real** | `discover()` parses actual `.tf` files via `hcl-rs` and derives real dependency edges from resource references (see Features above) |
-| Airflow | Not implemented | `discover()` always returns an empty graph |
+| Airflow | **Real** | `discover()` parses Python DAG files under `dag_folder` and extracts task dependency graphs and external `conn_id`/SQL references (local source analysis; no Airflow REST API client) |
 | OpenTelemetry | **Real** | `discover()` runs a real OTLP/gRPC trace receiver and derives edges from actually-observed cross-service span pairs (see Features above) — it's a receiver you bind, not a client connecting to an existing collector |
 | dbt | Partial | `DbtManifestParser` genuinely parses a local `manifest.json` for column lineage |
 | StatGuardian | Not implemented | `StatGuardianClient` returns empty/hardcoded fake data |

{pyblastradius-0.4.2 → pyblastradius-0.4.3}/README.md

@@ -46,10 +46,10 @@ Working today, backed by the real Rust engine (`pyblastradius._core`):
 - **Terraform discovery** — `TerraformDiscoverer` (used by `pyblastradius scan terraform://path=...`, `type: terraform` in `blastradius.yml`, and directly as `pyblastradius.TerraformDiscoverer`) parses real `.tf` files via `hcl-rs`, discovers any `resource "type" "name" { ... }` block (not limited to a handful of hardcoded AWS types), and derives real dependency edges from actual resource references found in each resource's own attribute values (`aws_db_instance.x.endpoint` bare traversals, and `"${aws_db_instance.x.endpoint}"` interpolated strings) — not a hardcoded example dependency list. Benchmarked in `benches/large_graph.rs` on graphs up to 1,000 nodes.
 - **Kubernetes discovery** — `KubernetesDiscoverer` (used by `pyblastradius scan kubernetes://manifests_dir=...`, `type: kubernetes` in `blastradius.yml`, and directly as `pyblastradius.KubernetesDiscoverer`) parses real Service/Deployment/StatefulSet/DaemonSet YAML manifests (`---`-separated multi-document files supported) and infers edges from container env var values that reference other discovered workload names. `kubeconfig`/`context` are accepted for interface compatibility but have no effect — there is no live-cluster API client, only local manifest parsing; `namespaces` is likewise accepted but not yet used to filter.
 - **OTLP trace discovery** — `OtelDiscoverer` (used by `pyblastradius scan otlp://endpoint=...`, `type: otlp` in `blastradius.yml`, and directly as `pyblastradius.OtelDiscoverer`) runs a real OTLP/gRPC trace *receiver* (the standard `TraceService.Export` RPC) bound to `endpoint`, collects whatever spans instrumented services actually push to it during the collection window, and builds edges from real cross-service parent/child span pairs with observed latency and error status. **This is a receiver you bind, not a client that connects to an existing collector** — `endpoint` must be a literal `ip:port` listen address (e.g. `"0.0.0.0:4317"`), and your services need to be configured to export to it.
+- **Airflow DAG discovery** — `AirflowDiscoverer` (used by `pyblastradius scan airflow://dag_folder=...`, `type: airflow` in `blastradius.yml`, and directly as `pyblastradius.AirflowDiscoverer`) parses Python DAG files on disk (`src/discovery/airflow.rs`) to extract DAGs, tasks, `>>`/`<<`/`set_downstream`/`set_upstream`/`chain(...)` dependencies, and external system references (`conn_id`/SQL tables).
 
 Not yet implemented (present as scaffolding/placeholders, listed here so you don't spend time debugging them):
 
-- **Airflow discovery** — `AirflowDiscoverer` (used by `pyblastradius scan`) currently always returns an empty graph. There is no DAG parsing or Airflow API connection behind it yet. (Terraform/Kubernetes/OTLP discovery are real — see Features above.)
 - **Hidden Dependency Detection / Anomaly Detection** — `HiddenDependencyDetector` and `AnomalyDetector` always return empty results; they are not wired to any metrics/trace source.
 - **`pyblastradius.integrations`** — `OtelCollectorClient` and `StatGuardianClient` are placeholders that return empty/fake data; `DbtManifestParser` genuinely parses a dbt `manifest.json` you already have on disk and is real.
 - **GraphQL API** — not exposed anywhere; the Rust crate has a query-string builder (`src/api/graphql.rs`) that nothing serves or executes.
@@ -257,7 +257,7 @@ Discovery source integration status (i.e. what `pyblastradius scan` /
 |-----------------|--------|----------|
 | Kubernetes | **Real** | `discover()` parses real Service/Deployment/StatefulSet/DaemonSet YAML manifests and infers edges from container env var references (see Features above); `kubeconfig`/`context`/live-cluster API access are not implemented |
 | Terraform | **Real** | `discover()` parses actual `.tf` files via `hcl-rs` and derives real dependency edges from resource references (see Features above) |
-| Airflow | Not implemented | `discover()` always returns an empty graph |
+| Airflow | **Real** | `discover()` parses Python DAG files under `dag_folder` and extracts task dependency graphs and external `conn_id`/SQL references (local source analysis; no Airflow REST API client) |
 | OpenTelemetry | **Real** | `discover()` runs a real OTLP/gRPC trace receiver and derives edges from actually-observed cross-service span pairs (see Features above) — it's a receiver you bind, not a client connecting to an existing collector |
 | dbt | Partial | `DbtManifestParser` genuinely parses a local `manifest.json` for column lineage |
 | StatGuardian | Not implemented | `StatGuardianClient` returns empty/hardcoded fake data |

{pyblastradius-0.4.2 → pyblastradius-0.4.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "pyblastradius"
-version = "0.4.2"
+version = "0.4.3"
 description = "Operational Blast Radius Intelligence Platform - Predict cascading failures and quantify business impact"
 readme = "README.md"
 requires-python = ">=3.10"

{pyblastradius-0.4.2 → pyblastradius-0.4.3}/python/pyblastradius/__init__.py

@@ -16,7 +16,7 @@ Quick start:
     print(f"Blast radius score: {result.blast_radius_score:.1f}/100")
 """
 
-__version__ = "0.4.2"
+__version__ = "0.4.3"
 __author__ = "Georgi Mammen Mullassery"
 __email__ = "mullassery@gmail.com"
 __license__ = "Apache-2.0"