Fix the security audit and adversarial hunt findings against 4.6.0

.github/workflows/release.yml

@@ -10,6 +10,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build distributions
@@ -18,15 +21,71 @@ jobs:
       - uses: actions/checkout@v6
         with:
           ref: ${{ inputs.ref || github.ref }}
+      - name: Verify the ref is a release tag matching __version__
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          EVENT_REF: ${{ github.ref }}
+          INPUT_REF: ${{ inputs.ref }}
+        run: |
+          set -euo pipefail
+          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
+            ref="$INPUT_REF"
+          else
+            ref="$EVENT_REF"
+          fi
+          case "$ref" in
+            refs/tags/v*) tag="${ref#refs/tags/}" ;;
+            v*)
+              if [ "$EVENT_NAME" != "workflow_dispatch" ]; then
+                echo "::error::ref '$ref' is not a tag ref"
+                exit 1
+              fi
+              tag="$ref"
+              ;;
+            *)
+              echo "::error::ref '$ref' is not a v* release tag"
+              exit 1
+              ;;
+          esac
+          if ! [[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+[0-9A-Za-z.+-]*$ ]]; then
+            echo "::error::tag '$tag' does not look like vX.Y.Z"
+            exit 1
+          fi
+          version="$(sed -n -E "s/^__version__(: *str)? = ['\"]([^'\"]*)['\"].*/\2/p" progressbar/__about__.py)"
+          if [ -z "$version" ]; then
+            echo "::error::could not read __version__ from progressbar/__about__.py"
+            exit 1
+          fi
+          if [ "$tag" != "v$version" ]; then
+            echo "::error::tag '$tag' does not match __version__ '$version'"
+            exit 1
+          fi
+          tag_commit="$(git rev-parse --verify --quiet "refs/tags/$tag^{commit}")" || {
+            echo "::error::tag '$tag' is not present in the checkout"
+            exit 1
+          }
+          if [ "$tag_commit" != "$(git rev-parse HEAD)" ]; then
+            echo "::error::checked-out commit is not the commit of tag '$tag'"
+            exit 1
+          fi
+          echo "Releasing $tag ($tag_commit)"
       - name: Install uv
         uses: astral-sh/setup-uv@v7
       - name: Build sdist and wheel
         run: uv build --no-sources
-      - name: Verify wheel contains only the progressbar package
+      - name: Verify distribution contents
         run: |
+          set -euo pipefail
           unpacked="$(unzip -Z1 dist/*.whl | cut -d/ -f1 | sort -u)"
           echo "$unpacked"
           test "$(echo "$unpacked" | grep -cvE '^progressbar$|^progressbar2-.*\.dist-info$')" -eq 0
+          sdist="$(tar tzf dist/*.tar.gz)"
+          echo "$sdist"
+          stray_pattern='\.sync-conflict-|\.(orig|rej|bak)$'
+          if { unzip -Z1 dist/*.whl; echo "$sdist"; } | grep -E "$stray_pattern"; then
+            echo "::error::distribution contains stray conflict or backup files"
+            exit 1
+          fi
       - uses: actions/upload-artifact@v6
         with:
           name: dist

.gitignore

@@ -48,3 +48,11 @@ docs/_build/
 
 # Built at docs build time for the in-browser console
 docs/_static/wheels/
+
+# Local secrets and environments
+.env
+.env.*
+.venv/
+*.pem
+*.key
+.pypirc

.pre-commit-config.yaml

@@ -5,6 +5,8 @@ repos:
     rev: v6.0.0
     hooks:
     -   id: end-of-file-fixer
+        # Preserve the upstream bytes copied by the vendor update command.
+        exclude: '^docs/_static/vendor/xterm\.js$'
     -   id: trailing-whitespace
     -   id: check-yaml
     -   id: check-added-large-files

CHANGES.rst

@@ -2,6 +2,39 @@
 Changelog
 =========
 
+Unreleased
+----------
+
+The ``progressbar`` and ``bar`` commands, and ``python -m progressbar``,
+now exit with status 130 after Ctrl-C interrupts a transfer. Previously
+they exited with status 0. Scripts that check the exit status can now
+distinguish an interrupted transfer from a completed copy.
+
+Captured output now survives a drain failure on the other stream, and
+unwrapping restores the original stream even when its capture buffer is
+closed. Built-in ``StringIO`` capture writes and drains remain atomic.
+Caller-replaced buffers keep their method overrides, which run without
+stream locks. As in 4.6.0, callers synchronise concurrent writes and drains
+on those custom buffers. A capture-hook failure now retains the other
+stream's exception in the primary failure's context chain.
+
+Specialised format templates retain their escaping and result types.
+Their field paths, including nested format specifications, are checked
+before calling the application's formatter.
+
+MultiBar expiry keeps a replacement registered under the same exact
+``str`` label. Assignment, update, in-place union and ordinary removal
+methods share its membership guard. Lifecycle tracking uses bar identity
+without calling application hash or equality methods, and the guard resets
+after fork.
+Custom label objects retain their hash and equality hooks and their
+identity as dictionary keys. Using one for mutation or indexing switches
+that MultiBar instance permanently to the 4.6.0 concurrency contract:
+callers synchronise concurrent mutation and rendering, including expiry.
+These hooks run without the membership guard, even for later exact
+``str`` lookups. Clearing the instance does not reset this mode. Direct
+calls to ``dict`` base-class mutation methods bypass this protocol.
+
 For the most recent changes to the Python Progressbar please look at the Git
 releases or the commit log:
 

CONTRIBUTING.rst

@@ -118,14 +118,20 @@ Ready to contribute? Here's how to set up `python-progressbar` for local develop
 
    Now you can make your changes locally.
 
-5. When you're done making changes, check that your changes pass the
-   linter and the tests, including other Python versions with tox::
+5. Before committing, format the changed Python files, then check the
+   whole tree and run the tests, including other Python versions with tox::
 
-    $ uv run ruff check progressbar tests
+    $ uvx ruff@latest format path/to/changed.py
+    $ uvx ruff@latest check .
+    $ uvx ruff@latest format --check .
     $ uv run pytest
     $ uv run tox
 
-   The ``uv sync`` from step 3 already installed all of these.
+   Stage the formatted changes before committing. A checkout-local
+   pre-commit gate, when installed, checks the staged snapshot with current
+   Ruff and the configured pre-commit hooks, including the CI-pinned Ruff
+   version. It leaves partially staged files untouched. Configured fixes
+   run only in the disposable snapshot and cause the commit to be rejected.
 
 6. Commit your changes and push your branch to GitHub with `git-flow-avh`_::
 

benchmarks/results.json

@@ -114,4 +114,4 @@
       }
     }
   }
-}
+}