Logged from the 0.1.3 post-release review (verdict: SHIP; ride these with the next substantive release, not a 0.1.4).
[low] safe_markdown_url() can crash the briefing on malformed URLs
urllib.parse.urlsplit(candidate) in examples/_example_utils.py is not wrapped in try/except. Inputs with unmatched netloc brackets (e.g. https://[bad) raise ValueError per Python docs, which would propagate out of build_output() and kill the run. Fix: return None on parse failure, and check parts.hostname (not just parts.netloc).
[low] YYYY-MM-DD strictness is Python-version dependent
datetime.date.fromisoformat() accepts extra forms (20191240-style compact, ISO week dates) only on Python 3.11+; 3.8–3.10 accept strict YYYY-MM-DD only. Since we support 3.8–3.12, undocumented inputs parse differently per interpreter. If strictness matters, gate with ^\\d{4}-\\d{2}-\\d{2}$ before calling fromisoformat().
[nit] spaces: rejected, not encoded
safe_markdown_url() rejects any whitespace before the .replace(" ", "%20") line runs, so that replacement is unreachable. Behavior is safe either way; align comment/docstring with implementation.
[nit] test-count wording
test_briefing_security.py has 12 tests (not 13). 0.1.3 totals: 66 tests = 15 new (12 security + 3 client) + 51 pre-existing.
Operational note (no code)
master is not branch-protected (protected: false, no rulesets). "Hygiene" to date = branch deletion discipline, not GitHub enforcement. Setting up protection/rulesets is a repo-admin decision, tracked here for visibility.
Logged from the 0.1.3 post-release review (verdict: SHIP; ride these with the next substantive release, not a 0.1.4).
[low]
safe_markdown_url()can crash the briefing on malformed URLsurllib.parse.urlsplit(candidate)inexamples/_example_utils.pyis not wrapped in try/except. Inputs with unmatched netloc brackets (e.g.https://[bad) raiseValueErrorper Python docs, which would propagate out ofbuild_output()and kill the run. Fix: returnNoneon parse failure, and checkparts.hostname(not justparts.netloc).[low]
YYYY-MM-DDstrictness is Python-version dependentdatetime.date.fromisoformat()accepts extra forms (20191240-style compact, ISO week dates) only on Python 3.11+; 3.8–3.10 accept strictYYYY-MM-DDonly. Since we support 3.8–3.12, undocumented inputs parse differently per interpreter. If strictness matters, gate with^\\d{4}-\\d{2}-\\d{2}$before callingfromisoformat().[nit] spaces: rejected, not encoded
safe_markdown_url()rejects any whitespace before the.replace(" ", "%20")line runs, so that replacement is unreachable. Behavior is safe either way; align comment/docstring with implementation.[nit] test-count wording
test_briefing_security.pyhas 12 tests (not 13). 0.1.3 totals: 66 tests = 15 new (12 security + 3 client) + 51 pre-existing.Operational note (no code)
masteris not branch-protected (protected: false, no rulesets). "Hygiene" to date = branch deletion discipline, not GitHub enforcement. Setting up protection/rulesets is a repo-admin decision, tracked here for visibility.