Repository navigation
Release 4.6.0 - #277
Merged
Merged
Release 4.6.0#277
Conversation
Pasting an indicator straight out of a threat-intel report (hxxps[:]//evil[.]com, 127[.]0[.]0[.]1) never matched a search, and scan url / sandbox url rejected it as an invalid URL. The SDK now refangs the URL/domain/IP inputs of its endpoint methods; the new root --refang/--no-refang flag (default on) is passed through as refang_iocs. Where the CLI handles the value itself - the is_url validation in scan url and sandbox url, and the CLI-owned submit_url request behind metadata analyze-ip - it applies the SDK's refang_ioc via utils.refang_input, so a defanged URL is validated in the form that is actually submitted. Raise the SDK floor to 4.6.0, which introduces the surface.
Capture the built request at PolyswarmSession.execute, the documented session customization point, instead of patching _paginate/_single and rebuilding the request with _to_request. Add the --no-refang rejection case for sandbox url and the known add/update host cases.
…o the SDK's opt-in refang
…yped URL in validation errors
Also narrow the spec's no-CLI-code list to the --url-file lines of scan url; positional scan/sandbox URLs are refanged in the CLI before validation.
…with_artifacts=) CI installs the SDK from the same-named branch archive, so the floor names the version the paired SDK change declares: 4.7.0, the next version above the 4.6.0 the SDK's develop already declares for refanging. It is mergeable once that change is on the SDK's develop, and releasable once 4.7.0 is on PyPI.
…tadata `search ioc <ip|domain|ttp|imphash> <value>` prints bare sha256s. With `--with-artifacts` it asks the server for each artifact's metadata-search row and renders it with the `metadata` formatter, the block `search metadata` prints, so the text, json and hash output formats all apply. `output.ioc` cannot render these rows (it indexes IOC keys a metadata row lacks). Without the flag the SDK call is unchanged. On the sha256/sha1/md5 forward lookup the flag is refused as a usage error rather than silently ignored. Tests mock at the SDK boundary with autospec, so each call is a signature check against the SDK the floor installs.
…rows Drive sha256, sha1 and md5 through the metadata formatter on an artifact row, and name the reverse search in the command's short help.
feat(search): ioc --with-artifacts returns the matching artifacts' metadata
|
Not mergeable yet. These are gitflow/release blockers; the code and specs are clean.
Code, tests (Style 4 transport mocks, autospec signature checks) and spec updates all match AGENTS.md and |
vhmartinezm
requested review from
mjbradford89 and
sbneto
and removed request for
sbneto
October 6, 2026 17:15
sbneto
approved these changes
Oct 6, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release 4.6.0
--no-refangopts out.polyswarm search ioc --with-artifacts(feat(search): ioc --with-artifacts returns the matching artifacts' metadata #275): returns the matching artifacts' metadata instead of bare sha256s. Without the flag nothing changes.Requires — merge order is hard
Bump version: 4.5.0 → 4.6.0) must merge into develop first. Until it does, this PR promotes 4.5.0 a second time.polyswarm_api>=4.7.0; until it is on the index, an install from PyPI cannot satisfy it.