- __version__ was stuck at 0.8.2 after the 0.8.3 release, so every ratings
and manifest artifact carried the wrong pipeline_version; bumped to match
pyproject.toml and added a regression test pinning the two together.
- fetch_article_text followed an RSS entry's <link> wherever it pointed,
including through redirects, with no check on the resolved address. A
compromised or malicious feed could aim it at an internal address (cloud
metadata, LAN service). The host and every redirect hop are now resolved
and rejected if they land on a private, loopback, link-local, or otherwise
non-public range.
- artifacts.write_json wrote the target path in place, so serve.py (a
separate process reading the same releases volume) could read a partially
written or truncated artifact. It now writes to a temp file in the same
directory and swaps it into place with os.replace.
flan
6a27bd1654