release(4.3.3): parity release, lockstep core engines at 4.3.3

.github/workflows/release.yml

@@ -22,6 +22,22 @@ jobs:
         with:
           python-version: '3.10'
 
+      - name: Verify release version consistency
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          TAG_NAME: ${{ github.event.release.tag_name }}
+        run: |
+          PYPROJECT_VERSION=$(sed -n 's/^version = "\(.*\)"$/\1/p' pyproject.toml | head -n 1)
+          echo "pyproject.toml=$PYPROJECT_VERSION tag=${TAG_NAME:-n/a}"
+          if [[ -z "$PYPROJECT_VERSION" ]]; then
+            echo "::error::pyproject.toml has no version"
+            exit 1
+          fi
+          if [[ "$EVENT_NAME" == "release" && "${TAG_NAME#v}" != "$PYPROJECT_VERSION" ]]; then
+            echo "::error::release tag $TAG_NAME does not match version $PYPROJECT_VERSION"
+            exit 1
+          fi
+
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip

.mike.yml

@@ -2,6 +2,7 @@ version_selector: true
 title_switch: true
 versions_file: docs/versions/versions.json
 versions:
+  - 4.3.3
   - 4.3.2
   - 4.3.1
   - 4.3.0
@@ -51,4 +52,4 @@ versions:
   - 0.1.0
   - latest
 aliases:
-  latest: 4.3.2
+  latest: 4.3.3

CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to this project will be documented in this file.
 
 ___
 
+v4.3.3 (2026-10-12)
+-------------------
+
+Parity release (v4.3.3)
+-----------------------
+
+A parity release with no functional change: the engine moves to 4.3.3 so all five core engines (Python, TypeScript, Rust, Go, PHP) ship the same version.
+
+The release workflow now fails before publishing unless the release tag matches the pyproject.toml version.
+
+The deptry configuration now lists `run_fixtures` (the specs fixture tooling module) as first party, which clears the DEP001 report on `specs/fixtures/tools/generate_cost_cases.py`.
+
+___
+
 v4.3.2 (2026-10-08)
 -------------------
 

docs/release-notes.md

@@ -10,6 +10,18 @@ Release Notes
 
 ___
 
+v4.3.3 (2026-10-12)
+-------------------
+
+Parity release (v4.3.3)
+-----------------------
+
+A parity release with no functional change: the engine moves to 4.3.3 so all five core engines (Python, TypeScript, Rust, Go, PHP) ship the same version.
+
+The deptry configuration now lists `run_fixtures` (the specs fixture tooling module) as first party, which clears the DEP001 report on `specs/fixtures/tools/generate_cost_cases.py`.
+
+___
+
 v4.3.2 (2026-10-08)
 -------------------
 

docs/versions/versions.json

@@ -1,4 +1,5 @@
 {
+    "4.3.3": "4.3.3",
     "4.3.2": "4.3.2",
     "4.3.1": "4.3.1",
     "4.3.0": "4.3.0",
@@ -47,5 +48,5 @@
     "1.0.1": "1.0.1",
     "1.0.0": "1.0.0",
     "0.1.0": "0.1.0",
-    "latest": "4.3.2"
+    "latest": "4.3.3"
 }

guard_core/.agents/skills/guard-core/SKILL.md

@@ -7,7 +7,7 @@ description: Guard Core best practices and conventions for the framework-agnosti
 
 Official guard-core skill to write code with best practices, keeping up to date with the real installed surface (introspect the package, do not rely on model memory of it).
 
-Current as of guard-core 4.3.2.
+Current as of guard-core 4.3.3.
 
 guard-core is the framework-agnostic security engine powering the Guard ecosystem. Framework adapters (fastapi-guard, flaskapi-guard, djapi-guard, tornadoapi-guard) implement three protocols and get the full pipeline, detection engine, Redis state, and telemetry for free.
 

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "guard-core"
-version = "4.3.2"
+version = "4.3.3"
 description = "Framework-agnostic security engine for the Guard ecosystem."
 authors = [
     {name = "Renzo Franceschini", email = "rennf93@guard-core.com"}
@@ -281,7 +281,7 @@ ignore = []
 
 [tool.deptry]
 extend_exclude = ['vulture_whitelist\.py', 'docs', 'conftest\.py', '\.claude', 'interop']
-known_first_party = ["guard_core"]
+known_first_party = ["guard_core", "run_fixtures"]
 per_rule_ignores = { "DEP002" = [
     "bandit",
     "deptry",