* drop testing and support for Python3.8, add Python 3.13, change document to reflect this. * implement safe_getattr and safe_format functions; fix bugs in UNSAFE_ATTRS and UNSAFE_ATTRS_DTYPES usage * make all procedure attributes private to curb access to AST nodes, which can be exploited * improvements to error messages, including use ast functions to construct better error messages * remove import of `numpy.linalg`, as documented * update doc description for security advisory
Special thanks to SteakEnthusiast for the security-related fixes
1.0.5
bugfix:
* more work on handling errors, including fixing 133 and adding more comprehensive tests for 129 and 132
1.0.4
bugfix:
* fix error handling that might result in null exception
1.0.3
bug fixes, a few feature enhancements:
* functions ("Procedures") defined within asteval have a ` _signature()` method, now use in repr * add support for deleting subscript * nested symbol tables now have a Group() function * update coverage config * cleanups of exception handling : errors must now have an exception * several related fixes to suppress repeated exceptions: see GH 132 and 129 * make non-boolean return values from comparison operators behave like Python - not immediately testing as bool
1.0.2
bug fixes: * fix NameError handling in expression code * make exception messages more Python-like
1.0.1
security fixes, based on audit by Andrew Effenhauser, Ayman Hammad, and Daniel Crowley, IBM X-Force Security Research division
* remove numpy modules polynomial, fft, linalg by default for security concerns * disallow string.format(), improve security of f-string evaluation