release(3.2.3): version reporting fix, lockstep with the engines at 4.3.3

.github/workflows/release.yml

@@ -22,6 +22,23 @@ jobs:
         with:
           python-version: '3.10'
 
+      - name: Verify release version consistency
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          TAG_NAME: ${{ github.event.release.tag_name }}
+        run: |
+          PYPROJECT_VERSION=$(sed -n 's/^version = "\(.*\)"$/\1/p' pyproject.toml | head -n 1)
+          MODULE_VERSION=$(sed -n 's/^__version__ = "\(.*\)"$/\1/p' guard_agent/_version.py)
+          echo "pyproject.toml=$PYPROJECT_VERSION guard_agent/_version.py=$MODULE_VERSION tag=${TAG_NAME:-n/a}"
+          if [[ -z "$PYPROJECT_VERSION" || "$PYPROJECT_VERSION" != "$MODULE_VERSION" ]]; then
+            echo "::error::pyproject.toml and guard_agent/_version.py disagree"
+            exit 1
+          fi
+          if [[ "$EVENT_NAME" == "release" && "${TAG_NAME#v}" != "$PYPROJECT_VERSION" ]]; then
+            echo "::error::release tag $TAG_NAME does not match version $PYPROJECT_VERSION"
+            exit 1
+          fi
+
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip

.mike.yml

@@ -2,6 +2,7 @@ version_selector: true
 title_switch: true
 versions_file: docs/versions/versions.json
 versions:
+  - 3.2.3
   - 3.2.2
   - 3.2.1
   - 3.2.0
@@ -32,4 +33,4 @@ versions:
   - 0.0.1
   - latest
 aliases:
-  latest: 3.2.2
+  latest: 3.2.3

CHANGELOG.md

@@ -3,6 +3,16 @@ Release Notes
 
 ___
 
+v3.2.3 (2026-10-12)
+-------------------
+
+Version reporting fix
+---------------------
+
+The 3.2.2 wheel shipped `guard_agent/_version.py` at 3.2.1, so 3.2.2 installs reported 3.2.1 to the Guard SaaS. Every version location now reads 3.2.3. Lockstep release with the agent family at 3.2.3.
+
+___
+
 v3.2.2 (2026-10-08)
 -------------------
 

docs/release-notes.md

@@ -21,6 +21,16 @@ The parity release: agent feature surface locked across all four language ports
 
 ___
 
+v3.2.3 (2026-10-12)
+-------------------
+
+Version reporting fix
+---------------------
+
+The 3.2.2 wheel shipped `guard_agent/_version.py` at 3.2.1, so 3.2.2 installs reported 3.2.1 to the Guard SaaS. Every version location now reads 3.2.3. Lockstep release with the agent family at 3.2.3.
+
+___
+
 v3.2.2 (2026-10-08)
 -------------------
 

docs/versions/versions.json

@@ -1,4 +1,5 @@
 {
+    "3.2.3": "3.2.3",
     "3.2.2": "3.2.2",
     "3.2.1": "3.2.1",
     "3.2.0": "3.2.0",
@@ -27,5 +28,5 @@
     "0.1.1": "0.1.1",
     "0.1.0": "0.1.0",
     "0.0.1": "0.0.1",
-    "latest": "3.2.2"
+    "latest": "3.2.3"
 }

guard_agent/_version.py

@@ -1,3 +1,3 @@
 """Single source of truth for the package version, importable without side-effects."""
 
-__version__ = "3.2.2"
+__version__ = "3.2.3"

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "guard-agent"
-version = "3.2.2"
+version = "3.2.3"
 description = "Framework-agnostic telemetry and monitoring agent for the Guard security ecosystem (fastapi-guard, flaskapi-guard, djangoapi-guard, tornadoapi-guard)"
 authors = [
     {name = "Renzo Franceschini", email = "rennf93@guard-core.com"}

tests/test_encryption.py

@@ -121,7 +121,7 @@ def test_decrypt_tampered_payload(self, encryptor: PayloadEncryptor) -> None:
 
         # Tamper with the encrypted data
         encrypted_bytes = base64.urlsafe_b64decode(encrypted.encode())
-        tampered = encrypted_bytes[:-1] + b"X"  # Change last byte
+        tampered = encrypted_bytes[:-1] + bytes([encrypted_bytes[-1] ^ 0xFF])
         tampered_str = base64.urlsafe_b64encode(tampered).decode()
 
         with pytest.raises(EncryptionError, match="Invalid or tampered payload"):