From 3a659ededc49d3abf60eca55a560b95cc98c3e90 Mon Sep 17 00:00:00 2001 From: Victor Kuznetsov Date: Tue, 21 Jul 2026 18:35:04 -0700 Subject: [PATCH] chore(release): v0.16.0 --- docs/release-and-distribution.md | 3 ++- docs/verification-plan.md | 11 ++++------- pyproject.toml | 2 +- src/remove_ai_watermarks/__init__.py | 2 +- uv.lock | 8 ++++---- 5 files changed, 12 insertions(+), 14 deletions(-) diff --git a/docs/release-and-distribution.md b/docs/release-and-distribution.md index ba98c9f..4da176d 100644 --- a/docs/release-and-distribution.md +++ b/docs/release-and-distribution.md @@ -35,4 +35,5 @@ The standing `uv-secure` gate in `maintain.sh` is clean; this is the changelog o - **idna** bumped 3.11 -> 3.16, fixing GHSA-65pc-fj4g-8rjx. - **aiohttp** bumped 3.13.5 -> 3.14.0 via `uv lock --upgrade-package aiohttp`, fixing GHSA-hg6j-4rv6-33pg + GHSA-jg22-mg44-37j8. - **basicsr** Dependabot alert GHSA-86w8-vhw6-q9qq is resolved by removal: the experimental `restore` extra was retired and basicsr is no longer anywhere in the dependency tree. -- **torch** Dependabot alert **GHSA-rrmf-rvhw-rf47** (`torch.jit.script` memory corruption, vulnerable `<= 2.12.0`) is **dismissed as `not_used`** (2026-06-10): torch is a transitive dep of the optional `gpu` extra only, the codebase never calls `torch.jit` (grep-verified), and **no patched torch version exists** (`first_patched_version` is null), so at the time it could not be closed by an upgrade. **Superseded 2026-07-20:** a patched **torch 2.13.0** now exists and the alert range moved to `<= 2.12.1`, so the "no patched version" half of that reasoning is gone -- the alert is open again and needs either a bump or a re-dismissal on the `not_used` grounds alone. See the open-items table in `docs/verification-plan.md`. +- **torch** Dependabot alert **GHSA-rrmf-rvhw-rf47** (`torch.jit.script` memory corruption, alert range `<= 2.12.1`) was dismissed `not_used` on 2026-06-10 (torch is a transitive dep of the optional `gpu` extra only and the codebase never calls `torch.jit`) and **resolved by upgrade on 2026-07-21**: the lock carries torch **2.13.0**, above the patched floor, so `uv-secure` is clean. If the GitHub alert has not auto-closed on the lock bump, close it manually as fixed. +- **setuptools** bumped 81.0.0 -> 83.0.0 (2026-07-21), fixing PYSEC-2026-3447. diff --git a/docs/verification-plan.md b/docs/verification-plan.md index 6959e92..4f5128b 100644 --- a/docs/verification-plan.md +++ b/docs/verification-plan.md @@ -930,13 +930,10 @@ detector change, never on its own. ### Dependency alert -`GHSA-rrmf-rvhw-rf47` (torch, `torch.jit.script` memory corruption) is open again and -**the reason it was dismissed no longer holds**. It was dismissed `not_used` on 2026-06-10 -partly because no patched version existed; a patched **torch 2.13.0** now does, and the -current alert range is `<= 2.12.1`. `docs/release-and-distribution.md` still says "no -patched torch version exists -- do not re-triage it", which is now stale. Either bump torch -(it is transitive from the optional `gpu` extra) or re-dismiss on the remaining grounds -(the codebase never calls `torch.jit`, grep-verified) and correct that note. +RESOLVED 2026-07-21. `GHSA-rrmf-rvhw-rf47` (torch, `torch.jit.script` memory corruption, +alert range `<= 2.12.1`) is closed by the torch **2.13.0** bump (the lock already carried it; +`uv-secure` no longer flags torch). The Dependabot alert itself may still need a manual +close in the GitHub UI if it has not auto-resolved on the lock bump. ### Where detection work should go next diff --git a/pyproject.toml b/pyproject.toml index 663e997..e06f749 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "remove-ai-watermarks" -version = "0.15.3" +version = "0.16.0" description = "AI watermark remover: strip visible and invisible AI watermarks (Gemini / Nano Banana sparkle, SynthID) and provenance metadata (C2PA, EXIF) from images" readme = "README.md" requires-python = ">=3.10" diff --git a/src/remove_ai_watermarks/__init__.py b/src/remove_ai_watermarks/__init__.py index 6ca1fef..10ce5e8 100644 --- a/src/remove_ai_watermarks/__init__.py +++ b/src/remove_ai_watermarks/__init__.py @@ -25,7 +25,7 @@ _os.environ.setdefault("TRANSFORMERS_VERBOSITY", "error") _warnings.filterwarnings("ignore", message=r".*ImageProcessorFast.*") -__version__ = "0.15.3" +__version__ = "0.16.0" __all__ = ["__version__", "remove_visible", "visible_provenance"] diff --git a/uv.lock b/uv.lock index 675c648..d13675a 100644 --- a/uv.lock +++ b/uv.lock @@ -2759,7 +2759,7 @@ wheels = [ [[package]] name = "remove-ai-watermarks" -version = "0.15.3" +version = "0.16.0" source = { editable = "." } dependencies = [ { name = "c2pa-python" }, @@ -2945,11 +2945,11 @@ wheels = [ [[package]] name = "setuptools" -version = "81.0.0" +version = "83.0.0" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/0d/1c/73e719955c59b8e424d015ab450f51c0af856ae46ea2da83eba51cc88de1/setuptools-81.0.0.tar.gz", hash = "sha256:487b53915f52501f0a79ccfd0c02c165ffe06631443a886740b91af4b7a5845a", size = 1198299, upload-time = "2026-02-06T21:10:39.601Z" } +sdist = { url = "https://files.pythonhosted.org/packages/34/26/f5d29e25ffdb535afef2d35cdb55b325298f96debd670da4c325e08d70f4/setuptools-83.0.0.tar.gz", hash = "sha256:025bccbbf0fa05b6192bc64ae1e7b16e001fd6d6d4d5de03c97b1c1ade523bef", size = 1154254, upload-time = "2026-07-04T15:31:22.699Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/e1/e3/c164c88b2e5ce7b24d667b9bd83589cf4f3520d97cad01534cd3c4f55fdb/setuptools-81.0.0-py3-none-any.whl", hash = "sha256:fdd925d5c5d9f62e4b74b30d6dd7828ce236fd6ed998a08d81de62ce5a6310d6", size = 1062021, upload-time = "2026-02-06T21:10:37.175Z" }, + { url = "https://files.pythonhosted.org/packages/5d/40/e1e72872c6354b306daef1703549e8e83b4d43cfea356311bf722a043752/setuptools-83.0.0-py3-none-any.whl", hash = "sha256:29b23c360f22f414dc7336bb39178cc7bcbf6021ed2733cde173f09dba19abb3", size = 1008090, upload-time = "2026-07-04T15:31:20.885Z" }, ] [[package]]