fix: 4.5.0 release-review fixes — detection parity, changelog, release metadata#149
Merged
Conversation
Two silent behavior regressions found in the 4.5.0 pre-release review: - The SSN pattern had gained (?<!DE) lookbehinds to stop German VAT IDs double-matching as SSNs, but the pattern is always active, so default (no-locale) users silently lost detection of nine-digit runs preceded by 'DE', 'DE ', or 'DE-'. Restore the exact v4.4.0 pattern and let the engine's span-overlap suppression resolve the DE_VAT_ID overlap only when German locale support is active. - DataFog.detect() pre-populated its result dict from the full LABELS list, adding seven always-empty DE_* keys for every caller. Scope the keys to the labels active under the configured locales via a new RegexAnnotator.active_labels_for() classmethod. Both changes are covered by new regression tests pinning the default (v4.4.0-parity) behavior.
Release-readiness cleanups from the 4.5.0 pre-release review: - Date the 4.5.0 changelog entry and add a 'Behavior Changes Since 4.4.0' section covering the guardrail helpers' regex default (with engine="smart" migration guidance), the locale-scoped detect() output shape, and the intentional Python <3.14 cap. - Fix the stale claim that German VAT IDs/IBANs are detected by default (all German labels are locale-gated) in the changelog and the release readiness doc, and fix the stale 4.4.0a5 version-alignment note. - Document the regex default on Guardrail and the sanitize/scan_prompt/ filter_output helpers, and pin the defaults with a regression test so they cannot drift silently again. - Sync .bumpversion.cfg current_version (4.4.0a5 -> 4.5.0b5) with __about__.py.
The lint job started failing because prettier now reformats docs/audit/01-coverage-baseline.md, a UTF-16LE-encoded captured test log committed as a historical audit artifact (#121). The file hasn't changed since the last green run on dev, so this is hook-environment drift on the runner, not a content change. Exclude docs/audit/ from the prettier hook: these are quarantined historical artifacts and letting prettier rewrite a UTF-16 test log would corrupt it. Verified pre-commit run --all-files passes locally.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes from the pre-release code review of the v4.4.0 → 4.5.0 diff. Two silent detection regressions plus release-metadata cleanups, all blocking or recommended-before-stable.
Detection parity (HIGH)
(?<!DE)/(?<!DE\s)/(?<!DE-)lookbehinds (added to stop German VAT IDs double-matching as SSNs), but the pattern is always active — so default (no-locale) users silently lost SSN detection for inputs likeDE 123456789. The exact v4.4.0 pattern is restored; the DE_VAT_ID overlap is instead resolved by the engine's existing span-overlap suppression, which only applies whenlocales=["de"]is active. Regression tests pin both behaviors.DataFog.detect()output keys to configured locales. Previously returned seven always-emptyDE_*keys for every caller; now returns the 7 base keys by default and includesDE_*keys only when constructed withlocales=["de"](matching the documented backward-compatible v4.4.0 shape). Implemented via a newRegexAnnotator.active_labels_for()classmethod.Guardrail engine default — documented, not reverted
The
smart→regexdefault change onsanitize/scan_prompt/filter_output/create_guardrail/Guardrailis kept (it aligns with the top-levelscan/redact/protectdefaults and the no-network core design gates), but it is no longer silent:engine="smart"migration guidanceGuardrailand all three helpersRelease metadata
docs/v45-release-readiness.rst; fixed stale4.4.0a5version-alignment note.bumpversion.cfgsynced to4.5.0b5to match__about__.py<3.14cap documented as intentional in the behavior-changes sectionTest plan
scan("Reference DE 123456789")→ SSN by default /DE_VAT_IDwithlocales=["de"];detect()returns 7 keys default, 14 with German locale; core-path helpers emit zero warnings