pyproject-api 1.12.2__tar.gz → 1.12.4__tar.gz

pyproject_api-1.12.4/.github/SECURITY.md

@@ -0,0 +1,51 @@
+# Security policy
+
+pyproject-api is a Python library that drives a project's PEP 517 build backend from a separate process. This policy
+says how to report a security problem and how we decide whether a report is one.
+
+## Reporting a vulnerability
+
+**Do not open a public issue for a security problem.** Use
+[GitHub's private vulnerability reporting](https://github.com/tox-dev/pyproject-api/security/advisories/new). If neither
+works for you, email [gaborjbernat@gmail.com](mailto:gaborjbernat@gmail.com).
+
+Include what the attacker controls and what they gain, the steps or a proof of concept, and the versions and platform
+you tested. Write the report yourself; unreviewed tool or model output takes longer to triage.
+
+## What to expect
+
+Volunteers maintain pyproject-api, with no on-call rotation. We aim to acknowledge a report within **5 working days**
+and assess it within **15 working days**. Fixes are developed in a private fork attached to the draft advisory, ship in
+a new release, and the advisory, with a CVE requested through GitHub, goes out with that release. The default embargo is
+**90 days** from the report; we agree any change with the reporter. We credit reporters in the advisory under the name
+they choose, or not at all. There is no bug bounty.
+
+## Supported versions
+
+Only the latest release receives fixes. Confirm the problem reproduces on it before reporting.
+
+## Vulnerability or bug
+
+A report is a vulnerability when an attacker who controls only an input that the [threat model](THREAT_MODEL.md) lists
+as untrusted breaks a guarantee pyproject-api makes. A report that first needs control of something the threat model
+trusts, such as the project being built and its build backend, is a bug: we fix it in the open and publish no advisory.
+Classify by who supplies the dangerous input, not by how bad the outcome sounds.
+
+**In scope**
+
+- A `build-system.backend-path` entry that resolves outside the project being accepted as an import location.
+- A frontend call writing a result or artifact outside the directory the caller named, including while extracting
+  `.dist-info` from a built wheel.
+- Clearing a metadata directory deleting the project root, one of its ancestors, or anything reached through a symlink
+  inside it.
+- A hook result naming a path outside its output directory, returned to the caller as the artifact or metadata path.
+- Results of one backend call being read as another call's, for example through a predictable result file.
+
+**Out of scope**
+
+- Code a build backend runs: building a project runs its backend, so building untrusted source runs untrusted code, as
+  PEP 517 intends.
+- What the backend writes into the artifacts it returns.
+- The interpreter, environment and `requires` the caller provisions for the backend.
+
+If you cannot tell which side a finding falls on, report it privately and we will decide.

pyproject_api-1.12.4/.github/THREAT_MODEL.md

@@ -0,0 +1,101 @@
+# Threat model
+
+This model says what pyproject-api trusts, where untrusted input enters, and which guarantees hold at each boundary, so
+a report can be classified as a vulnerability or a bug. [SECURITY.md](SECURITY.md) covers reporting; if the two
+disagree, SECURITY.md wins and we fix this file.
+
+## How pyproject-api works
+
+A frontend such as tox points pyproject-api at a project folder. pyproject-api reads `[build-system]` from
+`pyproject.toml`, checks that every `backend-path` entry stays inside the project, and starts the backend in a
+subprocess of the interpreter the caller chose: `SubprocessFrontend` starts a fresh one per call, while other frontends,
+such as tox's, can keep one alive across calls (`reuse_backend`). Each hook call (`build_wheel`,
+`prepare_metadata_for_build_wheel` and so on) goes to the backend's stdin as JSON, and the backend writes its answer to
+a temporary JSON file that the frontend reads back. Without a metadata hook, pyproject-api builds a wheel and extracts
+its `.dist-info` into the caller's metadata directory.
+
+```mermaid
+flowchart LR
+    fe["Frontend, e.g. tox<br/>(trusted)"] -->|project dir, python| api["pyproject-api"]
+    api -->|"reads [build-system]"| proj[("Project source")]
+    api -->|"spawn, JSON over stdin"| be["Backend subprocess<br/>runs project-chosen code"]
+    be -->|"result JSON in temp file,<br/>artifacts in output dir"| api
+    classDef trusted fill:#cfe4ff,stroke:#1f6feb,color:#0b1f3a;
+    classDef boundary fill:#ffe3a3,stroke:#d29200,color:#3a2c00;
+    class fe,api trusted;
+    class proj,be boundary;
+```
+
+## Compared with similar tools
+
+We drew the boundary where comparable projects in other ecosystems draw theirs. The shared rule, stated by the
+[Node.js threat model](https://github.com/nodejs/node/blob/main/SECURITY.md#the-nodejs-threat-model), is that a report
+which first needs a trusted element compromised is out of scope; the first triage question, as
+[DOMPurify](https://github.com/cure53/DOMPurify/blob/main/SECURITY.md#what-we-consider-a-vulnerability) puts it, is what
+the attacker controls.
+
+| Project                                                                             | Language   | Where it draws the line                                                                                                                                                  |
+| ----------------------------------------------------------------------------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| [Cargo build scripts](https://doc.rust-lang.org/cargo/reference/build-scripts.html) | Rust       | A package's `build.rs` runs with full rights during a build; building a crate means trusting it.                                                                         |
+| [Hatch](https://github.com/pypa/hatch/security/policy)                              | Python     | Assumes the user has full control over the build environment.                                                                                                            |
+| [pnpm](https://github.com/pnpm/pnpm/security/policy)                                | JavaScript | Draws its boundary at filesystem permissions: the store, project, lockfile and configuration are trusted, and running it in a repository means trusting that repository. |
+
+## Trusted
+
+An attacker who controls any of these already has what pyproject-api could give them:
+
+- The frontend and the project folder, interpreter, environment and output directories it passes.
+- The project's build backend and its `requires`; the backend runs with the user's rights.
+- The filesystem and temporary directory.
+
+## Untrusted inputs
+
+| Input                                        | Comes from                          | What pyproject-api guarantees                                                                                                       |
+| -------------------------------------------- | ----------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
+| `build-system.backend-path`                  | The project's `pyproject.toml`      | Each entry must be relative and resolve inside the project; otherwise the call fails.                                               |
+| Backend stdout and stderr                    | The backend and anything it imports | Captured and returned to the caller as text; hook results come only from the result file.                                           |
+| Malformed `[build-system]`                   | The project's `pyproject.toml`      | Wrong types raise a `ValueError` naming the key; a missing table falls back to the legacy setuptools backend, as PEP 517 specifies. |
+| Members of a built wheel                     | The backend                         | Only members under a top-level `.dist-info` directory are extracted, through `zipfile`'s path sanitizing.                           |
+| Entries inside a metadata directory to clear | Earlier builds, or the backend      | Refused when it is the project root or one of its ancestors; symlinks inside it are unlinked, never followed.                       |
+
+## Threats and controls
+
+| STRIDE                 | Threat                                                                  | Control                                                            |
+| ---------------------- | ----------------------------------------------------------------------- | ------------------------------------------------------------------ |
+| Tampering              | `backend-path = ["../other"]` loads a backend from outside the project. | Entries outside the project are rejected.                          |
+| Spoofing               | Backend output printed to stdout is taken as a hook's result.           | Results travel through a per-call temporary JSON file, not stdout. |
+| Elevation of privilege | A backend runs code during a build.                                     | Accepted by design; PEP 517 builds run the project's code.         |
+
+## Release chain
+
+Releases run on the shared [tox-dev/github-workflows](https://github.com/tox-dev/github-workflows) pipeline. A release
+App, not a person, pushes the release commit and tag; the build installs its tools from a hash-checked `pylock.toml`
+resolved with a seven-day upload cooldown by default; PyPI receives the files through
+[trusted publishing](https://docs.pypi.org/trusted-publishers/) with attestations, and the GitHub Release is immutable.
+Every workflow pins third-party actions to a commit SHA.
+
+## Vulnerability or bug
+
+| Report                                                               | Verdict                                              | Why                                                          |
+| -------------------------------------------------------------------- | ---------------------------------------------------- | ------------------------------------------------------------ |
+| `backend-path` with `../` imports a module from the parent directory | Vulnerability                                        | The in-tree guarantee of PEP 517 is broken.                  |
+| Building a malicious sdist runs its `setup.py`                       | Not a vulnerability                                  | The backend is trusted; build untrusted source in a sandbox. |
+| A backend that prints JSON confuses `get_requires_for_build_wheel`   | Bug, or vulnerability if the result file is bypassed | Results must come only from the result file.                 |
+
+## Severity
+
+- **High:** a frontend call deletes or writes outside the directory the caller named, or clearing a metadata directory
+  removes the project or follows a symlink inside it.
+- **Medium:** a `backend-path` outside the project is accepted, a hook's returned path escapes its directory, or one
+  call's result is read as another's.
+- **Low:** a malformed backend response crashes or hangs the frontend instead of failing with an error.
+
+## Accepted risks
+
+- Every hook call runs project code; isolation from the host is the caller's job.
+- The backend subprocess inherits the environment the caller passes, secrets included.
+
+## Keeping this current
+
+Revisit this model when pyproject-api gains a new input source, network access, a new way to run code, or a new place it
+writes to, and whenever an advisory is published.

pyproject_api-1.12.4/.github/workflows/check.yaml

@@ -0,0 +1,59 @@
+name: 🧪 check
+on:
+  workflow_dispatch:
+  push:
+    branches: ["main"]
+    tags-ignore: ["**"]
+  pull_request:
+    types: [opened, synchronize, reopened]
+  schedule:
+    - cron: "0 8 * * *"
+concurrency:
+  group: check-${{ github.ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+jobs:
+  test:
+    name: 🧪 Test
+    uses: tox-dev/github-workflows/.github/workflows/check.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
+    permissions:
+      contents: read
+    with:
+      include: |
+        [
+          {"env": "3.15"},
+          {"env": "3.15t", "python": "3.15t"},
+          {"env": "3.14", "python": "3.14"},
+          {"env": "3.13", "python": "3.13"},
+          {"env": "3.12", "python": "3.12"},
+          {"env": "3.11", "python": "3.11"},
+          {"env": "type"},
+          {"env": "dev"},
+          {"env": "pkg_meta"},
+          {"env": "3.15", "os": "windows-2025-vs2026"},
+          {"env": "3.15t", "python": "3.15t", "os": "windows-2025-vs2026"},
+          {"env": "3.14", "python": "3.14", "os": "windows-2025-vs2026"},
+          {"env": "3.13", "python": "3.13", "os": "windows-2025-vs2026"},
+          {"env": "3.12", "python": "3.12", "os": "windows-2025-vs2026"},
+          {"env": "3.11", "python": "3.11", "os": "windows-2025-vs2026"},
+          {"env": "type", "os": "windows-2025-vs2026"},
+          {"env": "dev", "os": "windows-2025-vs2026"},
+          {"env": "pkg_meta", "os": "windows-2025-vs2026"},
+          {"env": "3.15", "os": "macos-26"},
+          {"env": "3.15t", "python": "3.15t", "os": "macos-26"},
+          {"env": "3.14", "python": "3.14", "os": "macos-26"},
+          {"env": "3.13", "python": "3.13", "os": "macos-26"},
+          {"env": "3.12", "python": "3.12", "os": "macos-26"},
+          {"env": "3.11", "python": "3.11", "os": "macos-26"}
+        ]
+  gate:
+    name: 🚦 ${{ github.event_name == 'pull_request' && 'Required checks pass' || 'Non-PR checks pass' }}
+    if: ${{ !cancelled() }} # codespell:ignore cancelled
+    needs: [test]
+    runs-on: ubuntu-26.04
+    steps:
+      - name: 🚦 Require all needed jobs to pass
+        uses: tox-dev/github-workflows/required-checks@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
+        with:
+          needs: ${{ toJSON(needs) }}

pyproject_api-1.12.4/.github/workflows/codeql.yaml

@@ -0,0 +1,22 @@
+name: 🛡️ CodeQL
+on:
+  workflow_dispatch:
+  push:
+    branches: ["main"]
+  pull_request:
+  schedule:
+    - cron: "0 9 * * 2"
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+permissions: {}
+jobs:
+  analyze:
+    name: 🛡️ Analyze
+    uses: tox-dev/github-workflows/.github/workflows/codeql.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
+    permissions:
+      contents: read
+      security-events: write
+    with:
+      languages: '["actions","python"]'
+      paths-ignore: '["tests"]'

{pyproject_api-1.12.2 → pyproject_api-1.12.4}/.github/workflows/news.yaml

@@ -2,9 +2,6 @@ name: 📝 Changelog
 on:
   pull_request:
     types: [opened, reopened, synchronize, labeled, unlabeled]
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
 permissions:
   contents: read
   pull-requests: read
@@ -19,15 +16,15 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: 🐍 Install uv
-        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           version: latest-known
           python-version: "3.15"
           enable-cache: false
       - name: 📦 Install locked release tools
-        uses: tox-dev/github-workflows/install-locked-tools@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
+        uses: tox-dev/github-workflows/install-locked-tools@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
         with:
           groups: release-news
           venv: ${{ runner.temp }}/release-tools
       - name: 🔍 Validate news fragments
-        uses: tox-dev/github-workflows/validate-news@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
+        uses: tox-dev/github-workflows/validate-news@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0

{pyproject_api-1.12.2 → pyproject_api-1.12.4}/.github/workflows/prepare-release.yaml

@@ -16,7 +16,7 @@ permissions: {}
 jobs:
   prepare:
     name: 🏷️ Prepare Towncrier release
-    uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
+    uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
     permissions:
       contents: read
       pull-requests: read

pyproject_api-1.12.4/.github/workflows/release.yaml

@@ -0,0 +1,56 @@
+name: 🚀 Release to PyPI
+on:
+  push:
+    tags: ["*"]
+permissions:
+  contents: read
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+jobs:
+  build:
+    name: 🏗️ Build
+    uses: tox-dev/github-workflows/.github/workflows/validate-python-release.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
+    permissions:
+      contents: read
+  github-notes:
+    name: 📝 Render GitHub Release notes
+    uses: tox-dev/github-workflows/.github/workflows/release-notes.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
+    permissions:
+      contents: read
+    with:
+      tag: ${{ github.ref_name }}
+      changelog: docs/changelog.rst
+      artifact-url: https://pypi.org/project/pyproject-api/${{ github.ref_name }}/
+  release:
+    name: 🚀 Publish to PyPI
+    needs: [build, github-notes]
+    runs-on: ubuntu-26.04
+    environment:
+      name: release
+      url: https://pypi.org/project/pyproject-api/${{ github.ref_name }}
+    permissions:
+      id-token: write
+    steps:
+      - name: 📩 Download distributions
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          artifact-ids: ${{ needs.build.outputs.distributions-artifact-id }}
+          path: dist/
+      - name: 🚀 Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
+        with:
+          packages-dir: dist
+          attestations: true
+  github-release:
+    name: 🚀 Publish GitHub Release
+    needs: [build, release, github-notes]
+    uses: tox-dev/github-workflows/.github/workflows/github-release.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
+    permissions:
+      contents: write
+    with:
+      project: pyproject-api
+      version: ${{ github.ref_name }}
+      tag: ${{ github.ref_name }}
+      artifact-pattern: python-package-distributions
+      notes-artifact-id: ${{ needs.github-notes.outputs.artifact-id }}

pyproject_api-1.12.4/.github/workflows/scorecard.yaml

@@ -0,0 +1,26 @@
+name: 🛡️ scorecard
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: "30 7 * * 2"
+  push:
+    branches: ["main"]
+  workflow_dispatch:
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+permissions: {}
+jobs:
+  analysis:
+    name: 🛡️ Scorecard analysis
+    if: github.repository == 'tox-dev/pyproject-api'
+    permissions:
+      actions: read # read workflow runs for the Packaging check
+      checks: read # read check runs for the CI-Tests and SAST checks
+      contents: read # check out and scan the repository
+      id-token: write # authenticate the results published to the scorecard API
+      issues: read # read issue activity for the Maintained check
+      pull-requests: read # read reviews for the Code-Review check
+      security-events: write # upload the SARIF results to code scanning
+      statuses: read # read commit statuses for the CI-Tests check
+    uses: tox-dev/github-workflows/.github/workflows/scorecard.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0

{pyproject_api-1.12.2 → pyproject_api-1.12.4}/.github/workflows/upgrade-release-tools.yaml

@@ -10,7 +10,7 @@ concurrency:
 jobs:
   upgrade:
     name: 🔀 Upgrade release tools
-    uses: tox-dev/github-workflows/.github/workflows/upgrade-release-tools.yaml@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1
+    uses: tox-dev/github-workflows/.github/workflows/upgrade-release-tools.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
     permissions:
       contents: read
     secrets:

{pyproject_api-1.12.2 → pyproject_api-1.12.4}/.pre-commit-config.yaml

@@ -9,7 +9,7 @@ repos:
       - id: end-of-file-fixer
       - id: trailing-whitespace
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 0494aa7fa1314e98913a41227d8f0a515b2c1049 # frozen: 0.38.2
+    rev: a76b92851fc9eede9f9bc4073eb55202f34eb0df # frozen: 0.39.0
     hooks:
       - id: check-github-workflows
         args: ["--verbose"]
@@ -30,7 +30,7 @@ repos:
     hooks:
       - id: pyproject-fmt
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: "38bfb07c0c64c304f47eb52090f8288150c77730" # frozen: v0.17.1
+    rev: "25bcf95026b96e2dd3c0aec3090c3d6ef6ca2e6c" # frozen: v0.17.3
     hooks:
       - id: ruff-format
       - id: ruff
@@ -44,7 +44,7 @@ repos:
           ^docs/changelog[.]rst$  # Only the generated release history.
         args: ["-l", "120", "--preserve-adornments"]
         additional_dependencies:
-          - "sphinx==9.1.1"
+          - "sphinx==9.2.0"
   - repo: https://github.com/zizmorcore/zizmor-pre-commit
     rev: c92afdf2c6ca336aaa8f39e2bd8d48f62dbd8e1f # frozen: v1.31.1
     hooks:

{pyproject_api-1.12.2 → pyproject_api-1.12.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pyproject-api
-Version: 1.12.2
+Version: 1.12.4
 Import-Name: pyproject_api
 Summary: API to interact with the python pyproject.toml based projects
 Project-URL: Changelog, https://github.com/tox-dev/pyproject-api/blob/main/docs/changelog.rst
@@ -29,13 +29,14 @@ Requires-Python: >=3.11
 Requires-Dist: packaging>=26.3
 Description-Content-Type: text/markdown
 
-# [`pyproject-api`][RTD]
+# [`pyproject-api`][rtd]
 
 [![PyPI](https://img.shields.io/pypi/v/pyproject-api?style=flat-square)](https://pypi.org/project/pyproject-api/)
-[![Supported Python
-versions](https://img.shields.io/pypi/pyversions/pyproject-api.svg)](https://pypi.org/project/pyproject-api/)
+[![Supported Python versions](https://img.shields.io/pypi/pyversions/pyproject-api.svg)](https://pypi.org/project/pyproject-api/)
 [![Downloads](https://static.pepy.tech/badge/pyproject-api/month)](https://pepy.tech/project/pyproject-api)
 [![check](https://github.com/tox-dev/pyproject-api/actions/workflows/check.yaml/badge.svg)](https://github.com/tox-dev/pyproject-api/actions/workflows/check.yaml)
-[![Documentation Status](https://readthedocs.org/projects/pyproject-api/badge/?version=latest)][RTD]
+[![Documentation Status](https://readthedocs.org/projects/pyproject-api/badge/?version=latest)][rtd]
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/tox-dev/pyproject-api/badge)](https://scorecard.dev/viewer/?uri=github.com/tox-dev/pyproject-api)
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/16251/badge)](https://www.bestpractices.dev/projects/16251)
 
-[RTD]: https://pyproject-api.rtfd.io
+[rtd]: https://pyproject-api.rtfd.io

pyproject_api-1.12.4/README.md

@@ -0,0 +1,11 @@
+# [`pyproject-api`][rtd]
+
+[![PyPI](https://img.shields.io/pypi/v/pyproject-api?style=flat-square)](https://pypi.org/project/pyproject-api/)
+[![Supported Python versions](https://img.shields.io/pypi/pyversions/pyproject-api.svg)](https://pypi.org/project/pyproject-api/)
+[![Downloads](https://static.pepy.tech/badge/pyproject-api/month)](https://pepy.tech/project/pyproject-api)
+[![check](https://github.com/tox-dev/pyproject-api/actions/workflows/check.yaml/badge.svg)](https://github.com/tox-dev/pyproject-api/actions/workflows/check.yaml)
+[![Documentation Status](https://readthedocs.org/projects/pyproject-api/badge/?version=latest)][rtd]
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/tox-dev/pyproject-api/badge)](https://scorecard.dev/viewer/?uri=github.com/tox-dev/pyproject-api)
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/16251/badge)](https://www.bestpractices.dev/projects/16251)
+
+[rtd]: https://pyproject-api.rtfd.io

{pyproject_api-1.12.2 → pyproject_api-1.12.4}/docs/changelog.rst

@@ -5,6 +5,24 @@ Release History
 
 .. towncrier release notes start
 
+.. _release-1-12-4:
+
+v1.12.4 (2026-11-04)
+--------------------
+
+.. _release-1-12-3:
+
+v1.12.3 (2026-11-02)
+--------------------
+
+.. _release-1-12-3-fixed:
+
+Fixed
+^^^^^
+
+- Clear stale files from reused ``.dist-info`` directories when building wheel or editable metadata (:pr:`345`) by
+  :user:`subotac` and :user:`gaborbernat`.
+
 .. _release-1-12-2:
 
 v1.12.2 (2026-10-28)