robustrep 0.1.1__tar.gz → 0.1.2__tar.gz

{robustrep-0.1.1 → robustrep-0.1.2}/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to robustrep are recorded here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); the project is pre-1.0,
 so a `0.x` bump may change published numbers without changing the API.
 
+## [0.1.2] — 2026-10-03
+
+A dependency security release. No API, CLI or scoring changes.
+
+### Security — Fixed
+
+- **urllib3 floor raised to 2.8.** urllib3 2.6–2.7 can enter an infinite loop
+  on a chunked deflate stream (PYSEC-2026-4176) and buffer an unbounded
+  chunk-size line into memory (PYSEC-2026-4177). Both are reachable from
+  `fetch`, which reads responses from attacker-chosen evidence hosts, so a
+  hostile URI could hang or exhaust the fetcher. 2.8 also fixes HTTPS-proxy TLS
+  settings being ignored (PYSEC-2026-4175). The CI pin moves to 2.8.0 as well.
+
 ## [0.1.1] — 2026-09-15
 
 A security release: it closes every finding of an external security review of
@@ -114,5 +127,6 @@ no longer rescales a group by its own extremes.
 Initial release on PyPI: the scoring library, the Base ERC-8004 adapter, and the
 reproducible report.
 
+[0.1.2]: https://github.com/iamdongwang/robustrep/compare/v0.1.1...v0.1.2
 [0.1.1]: https://github.com/iamdongwang/robustrep/compare/v0.1.0...v0.1.1
 [0.1.0]: https://github.com/iamdongwang/robustrep/releases/tag/v0.1.0

{robustrep-0.1.1/robustrep.egg-info → robustrep-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: robustrep
-Version: 0.1.1
+Version: 0.1.2
 Summary: Robust, transport-agnostic reputation scoring for AI agents
 Author: Dong Wang
 License: Apache-2.0
@@ -25,7 +25,7 @@ Requires-Dist: numpy>=1.24
 Requires-Dist: eth-abi>=5.0
 Requires-Dist: eth-hash[pycryptodome]>=0.5
 Requires-Dist: requests>=2.31
-Requires-Dist: urllib3>=2.6
+Requires-Dist: urllib3>=2.8
 Requires-Dist: tabulate>=0.9
 Requires-Dist: matplotlib>=3.7
 Requires-Dist: typer>=0.12

{robustrep-0.1.1 → robustrep-0.1.2}/constraints.txt

@@ -98,7 +98,7 @@ typer==0.27.2
 typing-inspection==0.4.4
 typing_extensions==4.16.0
 tzdata==2026.4
-urllib3==2.7.0
+urllib3==2.8.0
 zipp==4.1.0
 # -- hand-added (not emitted by `pip freeze` on the dev box) -----------------
 # pip itself: freeze omits it. CI installs this version explicitly before the

{robustrep-0.1.1 → robustrep-0.1.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "robustrep"
-version = "0.1.1"
+version = "0.1.2"
 description = "Robust, transport-agnostic reputation scoring for AI agents"
 readme = "README.md"
 license = { text = "Apache-2.0" }
@@ -31,7 +31,10 @@ dependencies = [
   # decompression bomb (`max_length` on urllib3's decoders) first exists in
   # 2.6.0. On 2.0-2.5 the same call decompresses the whole body before
   # truncating -- measured at a 455 MB peak against 0.8 MB on 2.7.
-  "urllib3>=2.6",
+  # >=2.8: 2.6-2.7 can loop forever on a chunked deflate stream and buffer an
+  # unbounded chunk-size line (PYSEC-2026-4176/4177), both reachable from an
+  # attacker-chosen evidence host.
+  "urllib3>=2.8",
   "tabulate>=0.9",
   "matplotlib>=3.7",
   "typer>=0.12",

{robustrep-0.1.1 → robustrep-0.1.2/robustrep.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: robustrep
-Version: 0.1.1
+Version: 0.1.2
 Summary: Robust, transport-agnostic reputation scoring for AI agents
 Author: Dong Wang
 License: Apache-2.0
@@ -25,7 +25,7 @@ Requires-Dist: numpy>=1.24
 Requires-Dist: eth-abi>=5.0
 Requires-Dist: eth-hash[pycryptodome]>=0.5
 Requires-Dist: requests>=2.31
-Requires-Dist: urllib3>=2.6
+Requires-Dist: urllib3>=2.8
 Requires-Dist: tabulate>=0.9
 Requires-Dist: matplotlib>=3.7
 Requires-Dist: typer>=0.12

{robustrep-0.1.1 → robustrep-0.1.2}/robustrep.egg-info/requires.txt

@@ -3,7 +3,7 @@ numpy>=1.24
 eth-abi>=5.0
 eth-hash[pycryptodome]>=0.5
 requests>=2.31
-urllib3>=2.6
+urllib3>=2.8
 tabulate>=0.9
 matplotlib>=3.7
 typer>=0.12

{robustrep-0.1.1 → robustrep-0.1.2}/tests/e2e/test_live.py

@@ -132,14 +132,14 @@ def rpc_available():
 def test_live_recent_blocks(tmp_path):
     cfg = Config()
     rpc = RpcClient(cfg.rpc_urls, user_agent=cfg.user_agent)
-    store = Store(tmp_path / "live.db")
-    with rpc_available():
-        head = int(rpc.call("eth_blockNumber", []), 16)
-        base.sync_feedback(store, rpc, chunk=2000, start_block=head - 3999, end_block=head)
-    assert store.get_sync("last_block") == str(head)
-    with rpc_available():
-        base.fill_block_timestamps(store, rpc)
-    assert store.missing_block_ts() == []
+    with Store(tmp_path / "live.db") as store:
+        with rpc_available():
+            head = int(rpc.call("eth_blockNumber", []), 16)
+            base.sync_feedback(store, rpc, chunk=2000, start_block=head - 3999, end_block=head)
+        assert store.get_sync("last_block") == str(head)
+        with rpc_available():
+            base.fill_block_timestamps(store, rpc)
+        assert store.missing_block_ts() == []
 
 
 @pytest.mark.live