The current major release line (currently 3.x) receives security updates.

Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.

Report vulnerabilities privately via GitHub's private vulnerability reporting feature.

You should receive an initial acknowledgement within 72 hours. If the issue is confirmed, we will work with you on a coordinated disclosure and release a patch as quickly as is practical.

restgdf releases are published to PyPI via Trusted Publishing (OIDC — no long-lived API tokens) and every release artifact is signed with Sigstore. The .sigstore bundles are attached to the corresponding GitHub release and can be verified with the sigstore CLI:

python -m pip install sigstore
python -m sigstore verify identity \
  --cert-identity "https://github.com/joshuasundance-swca/restgdf/.github/workflows/publish_on_pypi.yml@refs/tags/<TAG>" \
  --cert-oidc-issuer "https://token.actions.githubusercontent.com" \
  <file>