v1.0.1 - Bug fixes and dependencies bump

• Fix for _stream_to_temp_file does not seek original UploadFile back to position #3
• Dependencies bump

v1.0.0 - First stable release

This is the first stable release of safeuploads, marking the library as production-ready. Since v0.1.2, every layer of the validation pipeline has been significantly expanded, hardened, and documented.

New Features

Activity & Gzip File Validation

• New validate_activity_file method on FileValidator for safe processing of GPS/fitness file uploads (GPX, TCX, FIT).
• New validate_gzip_file method with decompression-bomb detection via GzipContentInspector.
• XmlSecurityValidator using defusedxml to block XXE, DTD, and entity-expansion attacks in XML-based activity files.

Audit Logging

• Structured audit logging via SecurityAuditLogger, AuditEvent, and AuditEventType.
• Per-request correlation IDs (log_extra helpers) to trace events end-to-end.
• Configurable via enable_audit_logging flag in FileSecurityConfig.

Content Security Inspector

• New ContentSecurityInspector for deep content analysis: malware signature scanning, script/webshell marker detection, and polyglot file detection.
• Controlled by enable_content_analysis and content_scan_max_size (default 50 MB) in SecurityLimits.
• Wired into FileValidator for image and ZIP content scans when enabled.

Nested ZIP Complexity Checks

• Recursive ZIP inspection with cumulative entry, depth, hash, and timing checks.
• Archive quine and ZIP-of-ZIPs complexity detection.
• New max_total_entries_recursive limit in SecurityLimits.

Security Hardening

• Streaming file size enforcement: FileValidator reads files in chunks (using chunk_size) to prevent memory exhaustion when Content-Length is absent.
• ZIP inspection tightened: null-byte filename detection, monotonic timer for timeout checks, content scanning regardless of entry size (reads only first 512 bytes), error messages sanitised to avoid leaking internals.
• Compression validator: respects allow_nested_archives config, monotonic timer for timeouts.
• MIME cache hardened: LRU cache reduced (256 → 64) and MIME derived from file extension only, preventing attacker-controlled filename cache bloat.
• defusedxml added as a runtime dependency to prevent XML-based attacks.
• dev server binding: FastAPI example bound to 127.0.0.1 instead of 0.0.0.0.

Performance Improvements

• FileSecurityConfig now exposes pre-computed frozenset collections for O(1) membership checks.
• ExtensionSecurityValidator, UnicodeSecurityValidator, and ZipContentInspector cache their lookup sets at initialization time.
• LRU-cached _guess_mime_by_name wrapper avoids repeated mimetypes.guess_type calls.

Test Coverage

• Hypothesis-based fuzz tests across config, filenames, images, and ZIP inputs.
• Integration test suites for validate_activity_file and validate_gzip_file.
• Expanded edge-case tests for ZIP/gzip/content inspectors and the compression validator.
• Improved test determinism across the full suite.

CI / Infrastructure

• GitHub Actions workflows: lint & test, fuzzing, docs deploy, and PyPI publish.
• Dependabot configuration for automated dependency updates.
• CODEOWNERS file added.
• pip-audit export uses --no-emit-project to avoid false positives.

Documentation

• New security documentation: threat model, architecture overview, and integration checklist.
• README and docs updated to cover all new validators, inspectors, streaming limits, content analysis, and audit logging.
• MkDocs navigation updated to include security docs.

v0.1.2 - Added missing import in init.py

• Added BinaryFileCategory to the list of imported enums in safeuploads/init.py to make it available for external use.

v0.1.1 - Make max files of same type in ZIP configurable and added new BinaryFileCategory enum

• Added max_number_files_same_type to SecurityLimits in config.py and updated zip_inspector.py to use this configurable limit instead of a hardcoded value when checking for excessive files of the same type in ZIP archives
• Introduces the BinaryFileCategory enum to categorize binary file extensions, starting with fitness files (e.g., '.fit'). Updates the ZipContentInspector to skip script content checks for files with extensions in BinaryFileCategory, improving handling of binary files in zip archives

v0.1.0 - Initial release

Features

Security Validation:

• Filename Security: Unicode normalization, directory traversal protection, Windows reserved names blocking
• Extension Validation: Configurable allow/block lists with dangerous extension detection
• ZIP Bomb Protection: Compression ratio limits, nested archive inspection, size constraints
• MIME Type Verification: Magic number validation for common file types

Developer Experience:

• Framework-agnostic async validation (FastAPI, Flask, etc.)
• Rich exception hierarchy with machine-readable error codes
• Zero configuration required - secure defaults out of the box
• Full type hints and async support