trungdong/prov: 2.5.4

Published November 8, 2026 | Version 2.5.4

Software Open

Security: the PROV-O reader raises ProvException for a relation that repeats a formal attribute, so write one relation per value. 2.5.3 read one record per combination of the values without a warning, so a few hundred bytes of crafted RDF could exhaust memory (GHSA-pp6h-3q6w-xr98).
Namespace's name cache holds at most 10,000 names, so the shared prov and xsd namespaces stop growing with every distinct name read (#694).
Resolving a full IRI no longer scans every registered namespace and source binding, so reading RDF that declares no prefixes and has one directory per record spends less time in prov. The time left grows with rdflib's own prefix minting (#691).
Added prov.model.GenerationRef, the correctly spelled name for the GenrationRef type alias used in the generation parameter's annotation on wasDerivedFrom/wasRevisionOf/wasQuotedFrom/hadPrimarySource (#345). The misspelling remains importable as an alias for the correct name, so existing annotations keep resolving; master renames it outright for 3.0.
Python 3.15 is supported and tested in CI, so 2.x covers CPython 3.10 to 3.15 and PyPy 3.11. No code changes were needed (#542).

Files

Name	Size
trungdong/prov-2.5.4.zip md5:0f658203f89534c73ca12b42e65a928a	1.1 MB	Preview Download

Is supplement to: Software: https://github.com/trungdong/prov/tree/2.5.4 (URL)