[sergiobe-itx]

Closes #31

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Python Release Preview

• Workspace release strategy: locked-step
• cerbia: 0.3.0 -> 0.4.0
• cerbia-cli: 0.3.0 -> 0.4.0
• cerbia-core: 0.3.0 -> 0.4.0
• cerbia-ml: 0.3.0 -> 0.4.0
• cerbia-presidio: 0.3.0 -> 0.4.0
• cerbia-protectai: 0.3.0 -> 0.4.0
• Release type: minor
• Expected merge strategy: Squash and merge

Changes

Added

• Optional checksum validation and custom validators for PiiScanner, disabled
  by default (Add algorithmic checksum validation to pii scanner #25) (thanks @jmcaamanog).
• FastAPI BIM guardrail example with input and output security gates (Add fastapi bim cde guardrail for retail store roll-outs #24) (thanks @jmcaamanog).
• LangChain agent guardrail example with middleware and callbacks for prompts,
  responses, and tool inputs and outputs (feat(examples): add langchain agent guardrail callback and example #26) (thanks @jmcaamanog).
• Third-party dependency notices and license texts (chore(oss-release): add third-party notices  #28).

Fixed

• Restored the code-uv_python-release-core workflow to its golden bytes after
  a release attempt clobbered it (chore(ci-governance): restore release-core workflow to golden bytes #13).
• Hardened the docouture-* workflows to least-privilege tokens, resolving
  the Scorecard Token-Permissions alerts on main (fix(security): least-privilege tokens in docouture workflows #20).
• Corrected CLI errors when a configuration path is a directory on Windows (Handle directory paths and path assertions gracefully on windows #23) (thanks @jmcaamanog).
• Matched IBANs using country-specific formats without consuming following
  text (Add algorithmic checksum validation to pii scanner #25) (thanks @jmcaamanog).

Security

• Updated locked urllib3 to 2.8.0 for HTTPS proxy TLS and streaming security
  fixes (chore(deps): bump urllib3 from 2.7.0 to 2.8.0 #14).
• Updated locked virtualenv to 21.7.13 for activation command-injection
  fixes (chore(deps): bump virtualenv from 21.7.0 to 21.7.13 #21).
• Updated documentation dependency handlebars to 4.7.10 for upstream security
  fixes (Bump handlebars from 4.7.9 to 4.7.10 in /docs #29).
• Updated locked certifi to 2026.10.19 and repository uv pins to 0.13.4 to
  mitigate the eMudhra CA compromise ([Feature] Update certifi after eMudhra CA compromise #31).