release: prep v0.7.0 for PyPI publication#57
Merged
Merged
Conversation
Three coordinated changes that unblock the first \"pip install aicertify\".
## langfair: git URL -> PyPI
PyPI rejects packages whose install_requires contain direct git URLs.
The previous dep
langfair @ git+https://github.com/mantric/langfair-mantric.git@python-3.12-support
was a stand-in for upstream not yet supporting Python 3.12. That has since
landed in upstream langfair 0.8.0 (requires-python <3.14,>=3.9), so we can
switch to the PyPI release:
langfair >=0.8.0,<1.0
AICertify's actual API surface against langfair is small (counterfactual,
stereotype, and toxicity metrics under langfair.metrics) and is stable in
the upstream 0.8.x line.
## rich: align with langfair's pin
langfair 0.8.0 pins rich==13.8.0 strictly. The previous AICertify pin
(>=13.9.4) conflicted. Relax to >=13.8.0,<14.0.0 — the rich APIs we use
(Console, Progress, Spinner, Live, Panel, Text) are stable across both.
## langchain-openai: de-duplicate
The dep appeared twice (once in the main list, once in the transitive-pin
block). PyPI accepts duplicate Requires-Dist lines but it shows up
awkwardly on the project page. Kept the single entry with the explicit
security floor (>=1.1.14, image-token-counting DNS-rebind SSRF fix).
## CHANGELOG
Restructured the [0.7.0] section into a single comprehensive entry dated
2026-05-14 (first PyPI release). The release notes cover:
- Everything previously in [Unreleased] (skills, AGENTS.md, diagrams,
translations, marketing overhaul, SECURITY.md, why-aicertify.md, demo
PDF, forkable examples, repo metadata, labels, issues)
- The reporting subsystem + quickstart + pluggable evaluators
- The gopal migration
- ~95 Dependabot advisory fixes (direct + transitive bumps, CodeQL false
positives dismissed, workflow permissions added)
## Verified
- poetry lock --regenerate: clean resolve
- poetry build: aicertify-0.7.0-py3-none-any.whl (265 KB) +
aicertify-0.7.0.tar.gz (195 KB)
- twine check dist/*: PASSED on both
- pip install dist/...whl into a clean venv 3.12: succeeds
- aicertify --help: works
- from aicertify import regulations, application: works
github-actions
Bot
added
📝 documentation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three coordinated changes that unblock the first `pip install aicertify`.
What this PR does
langfair @ git+...langfair-mantric.git→langfair>=0.8.0,<1.0rich >=13.9.4→rich >=13.8.0,<14.0.0rich==13.8.0strictly; this relaxes our floor to match. The rich APIs AICertify uses (Console, Progress, Spinner, Live, Panel, Text) are stable across 13.8 → 13.9.langchain-openaidepCHANGELOG.mdv0.7.0 sectionVerified locally
poetry lock --regeneratesucceeded — clean resolve, LangChain 1.x stack preservedpoetry build→dist/aicertify-0.7.0-py3-none-any.whl(265 KB) +dist/aicertify-0.7.0.tar.gz(195 KB)twine check dist/*→ PASSED on both wheel and sdistpip install dist/aicertify-0.7.0-py3-none-any.whlin a fresh Python 3.12 venv: succeedsaicertify --helpprints the CLI usagefrom aicertify import regulations, applicationworks (the canonical README pattern)[project.urls]block, theaicertifyconsole-script entry point, and zero git URLs anywhere in the requires-dist listAfter merge
Next steps (separate from this PR):
v0.7.0on the post-mergemaincommit[0.7.0]section as the bodytwine upload dist/*— needs yourPYPI_API_TOKEN. I'll print the exact command after this merges so you can run it under your account.