From 20a9df07e251bf08f4c3248aaa3b7b46e43a1d77 Mon Sep 17 00:00:00 2001 From: Renn F Date: Mon, 12 Oct 2026 16:54:15 +0200 Subject: [PATCH 1/3] release(3.2.3): version reporting fix, lockstep with the engines at 4.3.3 --- .mike.yml | 3 ++- CHANGELOG.md | 10 ++++++++++ docs/release-notes.md | 10 ++++++++++ docs/versions/versions.json | 3 ++- guard_agent/_version.py | 2 +- pyproject.toml | 2 +- 6 files changed, 26 insertions(+), 4 deletions(-) diff --git a/.mike.yml b/.mike.yml index 8c8b89f..2341fa2 100644 --- a/.mike.yml +++ b/.mike.yml @@ -2,6 +2,7 @@ version_selector: true title_switch: true versions_file: docs/versions/versions.json versions: + - 3.2.3 - 3.2.2 - 3.2.1 - 3.2.0 @@ -32,4 +33,4 @@ versions: - 0.0.1 - latest aliases: - latest: 3.2.2 + latest: 3.2.3 diff --git a/CHANGELOG.md b/CHANGELOG.md index 476f01d..4a1a49e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,16 @@ Release Notes ___ +v3.2.3 (2026-10-12) +------------------- + +Version reporting fix +--------------------- + +The 3.2.2 wheel shipped `guard_agent/_version.py` at 3.2.1, so 3.2.2 installs reported 3.2.1 to the Guard SaaS. Every version location now reads 3.2.3. Lockstep release with the agent family at 3.2.3. + +___ + v3.2.2 (2026-10-08) ------------------- diff --git a/docs/release-notes.md b/docs/release-notes.md index 572c255..2c8f162 100644 --- a/docs/release-notes.md +++ b/docs/release-notes.md @@ -21,6 +21,16 @@ The parity release: agent feature surface locked across all four language ports ___ +v3.2.3 (2026-10-12) +------------------- + +Version reporting fix +--------------------- + +The 3.2.2 wheel shipped `guard_agent/_version.py` at 3.2.1, so 3.2.2 installs reported 3.2.1 to the Guard SaaS. Every version location now reads 3.2.3. Lockstep release with the agent family at 3.2.3. + +___ + v3.2.2 (2026-10-08) ------------------- diff --git a/docs/versions/versions.json b/docs/versions/versions.json index 01f4f0e..850c588 100644 --- a/docs/versions/versions.json +++ b/docs/versions/versions.json @@ -1,4 +1,5 @@ { + "3.2.3": "3.2.3", "3.2.2": "3.2.2", "3.2.1": "3.2.1", "3.2.0": "3.2.0", @@ -27,5 +28,5 @@ "0.1.1": "0.1.1", "0.1.0": "0.1.0", "0.0.1": "0.0.1", - "latest": "3.2.2" + "latest": "3.2.3" } diff --git a/guard_agent/_version.py b/guard_agent/_version.py index b2d37d6..70991b2 100644 --- a/guard_agent/_version.py +++ b/guard_agent/_version.py @@ -1,3 +1,3 @@ """Single source of truth for the package version, importable without side-effects.""" -__version__ = "3.2.2" +__version__ = "3.2.3" diff --git a/pyproject.toml b/pyproject.toml index fffa218..ebddcd9 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "guard-agent" -version = "3.2.2" +version = "3.2.3" description = "Framework-agnostic telemetry and monitoring agent for the Guard security ecosystem (fastapi-guard, flaskapi-guard, djangoapi-guard, tornadoapi-guard)" authors = [ {name = "Renzo Franceschini", email = "rennf93@guard-core.com"} From 2e255335891a4353ef57e5ef5f83641dd2669849 Mon Sep 17 00:00:00 2001 From: Renn F Date: Mon, 12 Oct 2026 19:11:51 +0200 Subject: [PATCH 2/3] ci(release): fail the publish unless the tag, pyproject and _version.py agree --- .github/workflows/release.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index aea5b51..c36627a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -22,6 +22,23 @@ jobs: with: python-version: '3.10' + - name: Verify release version consistency + env: + EVENT_NAME: ${{ github.event_name }} + TAG_NAME: ${{ github.event.release.tag_name }} + run: | + PYPROJECT_VERSION=$(sed -n 's/^version = "\(.*\)"$/\1/p' pyproject.toml | head -n 1) + MODULE_VERSION=$(sed -n 's/^__version__ = "\(.*\)"$/\1/p' guard_agent/_version.py) + echo "pyproject.toml=$PYPROJECT_VERSION guard_agent/_version.py=$MODULE_VERSION tag=${TAG_NAME:-n/a}" + if [[ -z "$PYPROJECT_VERSION" || "$PYPROJECT_VERSION" != "$MODULE_VERSION" ]]; then + echo "::error::pyproject.toml and guard_agent/_version.py disagree" + exit 1 + fi + if [[ "$EVENT_NAME" == "release" && "${TAG_NAME#v}" != "$PYPROJECT_VERSION" ]]; then + echo "::error::release tag $TAG_NAME does not match version $PYPROJECT_VERSION" + exit 1 + fi + - name: Install dependencies run: | python -m pip install --upgrade pip From 9c3ed13e0a168a4d4e047ed0098416e9b06f0296 Mon Sep 17 00:00:00 2001 From: Renn F Date: Mon, 12 Oct 2026 19:37:36 +0200 Subject: [PATCH 3/3] test(encryption): flip the last byte instead of overwriting it so the tamper is never a no-op --- tests/test_encryption.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/test_encryption.py b/tests/test_encryption.py index bb568e5..1f4f6f2 100644 --- a/tests/test_encryption.py +++ b/tests/test_encryption.py @@ -121,7 +121,7 @@ def test_decrypt_tampered_payload(self, encryptor: PayloadEncryptor) -> None: # Tamper with the encrypted data encrypted_bytes = base64.urlsafe_b64decode(encrypted.encode()) - tampered = encrypted_bytes[:-1] + b"X" # Change last byte + tampered = encrypted_bytes[:-1] + bytes([encrypted_bytes[-1] ^ 0xFF]) tampered_str = base64.urlsafe_b64encode(tampered).decode() with pytest.raises(EncryptionError, match="Invalid or tampered payload"):