v2.1.0

[2.1.0] - 2026-07-23

Features

• typing: ship PEP 561 type information — a py.typed marker plus .pyi stubs covering the full public API, so mypy (strict) and pyright resolve MaskOps out of the box; a gating CI job type-checks a usage snippet on every push.

Bug Fixes

• fpe: mode="ff3" is now conformant NIST FF3-1 (single AES-256 with REVB conventions, 56-bit tweak split, verified against an independent FF3-1 implementation). Tokens are now interoperable with other FF3-1 libraries and the FF3-1 minimum domain is enforced.
• pipeline: digit PII is no longer encrypted twice when two families match the same span (e.g. Argentine DNI re-matched by pe_dni, bare CPF re-matched by pesel) — FPE rotation stays reversible and consistent output stays stable.
• rekey: rekey_pii_fpe now rotates separator-bearing tokens (SSN, phone, RUT, ...) instead of silently returning them under the old key, and raises rather than passing a cell through unrotated.
• patterns: unknown pattern names and unsupported mask_pii mode values now raise instead of being silently ignored (which previously returned data unmasked).
• iban: IBANs are validated with ISO 7064 mod-97, detected in the spaced print format, and accepted up to the full 34-character length.
• ip: compressed and letter-only IPv6 addresses (2001:db8::1, fe80::1) are now detected and masked.
• healthcare: MBI character classes corrected to the CMS format (alphanumeric position 6, alpha-only positions 8–9).
• latam: pe_dni masks 8-digit numbers only near DNI context words in the default pipeline (explicit patterns=["pe_dni"] still masks every 8-digit number), ending silent corruption of dates and order numbers.

Breaking Changes

• FF3-1 output differs from previous releases; data encrypted with an older version must be decrypted with that version before re-masking. FPE now rejects digit runs shorter than 6 (the FF3-1 minimum domain). Unknown patterns= entries, unknown mode values, and CPF/CNPJ/card FPE output formatting (now format-preserving) all change behavior relative to 2.0.

v2.0.0

2.0.0 (2026-06-08)

Features

• api: unify configurable patterns= across the structured-output expressions — extract_pii and mask_pii_audit now accept the same family selection as mask_pii, completing the enterprise surface (configurable patterns + structured output + audit)
• docs: add the v2.0 migration guide — 2.0 is a drop-in upgrade; documents the unified API, the FF1 / key-management / MEA additions, and the stable 2.x surface

Notes

• 2.0 is API-stable for the 2.x line. The only behavioral change from 1.x is that mask_pii_fpe now rejects weak keys (non-32-byte, or a single repeated byte) with ValueError — see the migration guide.

v1.9.0

1.9.0 (2026-06-08)

Features

• mea: add South African ID (13-digit, Luhn + date-of-birth + citizenship validation, POPIA) — asterisk / FPE / consistent modes
• mea: add Israeli ID / Teudat Zehut (9-digit weighted checksum, PPL) — asterisk / FPE / consistent modes; a no-adjacent-dash guard keeps it from masking the digit run inside dash-formatted IDs (e.g. Colombian NIT)

v1.8.0

1.8.0 (2026-06-08)

Features

• fpe: add FF1 mode (NIST SP 800-38G) as an alternative to FF3-1 — mask_pii_fpe(..., mode="ff1"); both modes are reversible and length-preserving
• fpe: add rekey_pii_fpe — rotate the FPE key on a column of FPE tokens (decrypt-old + encrypt-new in one pass, plaintext never materialises as a column)
• keys: add derive_key / derive_tweak (HKDF-SHA256 / HMAC-SHA256) for deterministic, offline per-tenant key and tweak derivation from one master secret
• keys: add validate_key / validate_tweak — length checks plus a weak-key guard that rejects single-repeated-byte keys; now enforced by mask_pii_fpe

v1.7.0

1.7.0 (2026-06-08)

Features

• latam: add Brazilian CNPJ (legal-entity) detection and masking — two mod-11 check digits, asterisk / FPE / consistent modes
• manifest: add masking_manifest + write_manifest — per-column PII inventory with match counts, built-in family→regulation mapping, and mask mode; exports a JSON RAT / data-processing register

Bug Fixes

• latam: stop Colombian cédula / Argentine DNI patterns from masking the XX.XXX.XXX prefix of a CNPJ-shaped value — a /dddd-dd tail now exempts the match

v1.6.0

1.6.0 (2026-06-08)

Features

• audit: add mask_pii_audit expression — masked value plus per-family validated match counts in a single pass, returned as a nested Struct (masked + counts)

v1.5.1

1.5.1 (2026-06-07)

Features

• consistent: cross-column referential integrity — same value + same salt produces identical masked output across any number of columns

v1.5.0

Install

pip install maskops==1.5.0

See CHANGELOG for details.

v0.14.1

Install

pip install maskops==0.14.1

See CHANGELOG for details.

v0.14.0

Install

pip install maskops==0.14.0

See CHANGELOG for details.