Merge branch 'main' into feat/wildguard-scorer

Author: romanlutz

.azuredevops/component-governance.yml

@@ -9,25 +9,27 @@ pool:
   vmImage: "ubuntu-latest"
 
 steps:
-  # Component Governance does not support pyproject.toml yet.
-  # For that reason, use toml-to-requirements to export the
-  # dependencies into a requirements.txt file.
-  - script: pip install --upgrade setuptools pip
-    name: UpgradePip
-
-  - script: pip install toml-to-requirements
-
-  - script: toml-to-req --toml-file pyproject.toml
-
   - task: ComponentGovernanceComponentDetection@0
-    env:
-      PIP_INDEX_URL: https://pypi.python.org/simple
+    displayName: Detect components
 
   - task: notice@0
     displayName: Generate NOTICE file
     inputs:
       outputfile: $(System.DefaultWorkingDirectory)/obj/NOTICE
       outputformat: text
+      additionaldata: $(System.DefaultWorkingDirectory)/THIRD_PARTY_NOTICES.txt
 
   - publish: $(System.DefaultWorkingDirectory)/obj/NOTICE
     artifact: NOTICE
+    displayName: Publish generated NOTICE
+
+  - bash: |
+      checked_in="$(System.DefaultWorkingDirectory)/NOTICE.txt"
+      generated="$(System.DefaultWorkingDirectory)/obj/NOTICE"
+
+      if diff --brief --strip-trailing-cr "$checked_in" "$generated" > /dev/null; then
+        echo "NOTICE.txt matches the generated artifact."
+      else
+        echo "NOTICE.txt differs from the generated artifact. The updated file is available in the NOTICE artifact."
+      fi
+    displayName: Compare NOTICE file

.github/ISSUE_TEMPLATE/bug_report.md

@@ -42,7 +42,7 @@ Sample code to reproduce the problem
 Please provide the following information:
 - OS: [e.g. Windows]
 - Browser (if you're reporting a bug in jupyter): [e.g. Edge, Firefox, Chrome, Safari]
-- Python version: [e.g. 3.10.11]
+- Python version: [e.g. 3.11.9]
 - PyRIT version: [e.g. 0.1.0 or installed from main branch in editable mode]
 - version of Python packages: please run the following snippet and paste the output:
   ```python

.github/docs-versions.yml

@@ -9,13 +9,16 @@
 # after `latest`, and update `default:` / `stable:` if the new release should become the
 # landing page. The picker renders this list in file order, so the newest release goes first.
 
-default: "1.0.1"  # served at the site root (microsoft.github.io/PyRIT/)
-stable: "1.0.1"   # served at /stable/ and shown as "(stable)" in the picker
+default: "1.1.0"  # served at the site root (microsoft.github.io/PyRIT/)
+stable: "1.1.0"   # served at /stable/ and shown as "(stable)" in the picker
 
 versions:
   - slug: latest
     name: "latest (dev, main)"
     ref: main
+  - slug: "1.1.0"
+    name: "1.1.0"
+    ref: releases/v1.1.0
   - slug: "1.0.1"
     name: "1.0.1"
     ref: releases/v1.0.1

.github/instructions/frontend-test.instructions.md

@@ -325,6 +325,10 @@ The following are already mocked globally in `src/setupTests.ts` — do NOT re-m
 - `Element.prototype.scrollTo` / `scrollIntoView`
 - `URL.createObjectURL` / `revokeObjectURL`
 - `import.meta.env` variables (`VITE_API_URL`, `MODE`)
+- JSDOM focus layout (`offsetParent` and viewport-sized body bounds). Disconnected elements and `display: none` ancestors have no simulated layout; visibility and disabled checks remain intact. This does not simulate positioning or actual dimensions.
+
+For modal timer regressions, use fake timers with `userEvent.setup({ advanceTimers: jest.advanceTimersByTime })` and advance timers inside `act`. Keep normal accessible-role queries; querying hidden dialogs or extending timeouts can mask focus-management failures.
+After navigating from a modal, wait for an accessible element on the destination page, not just a test ID. Restoring background accessibility is also deferred.
 
 ## What to Test
 

.github/instructions/output.instructions.md

@@ -26,7 +26,7 @@ When reviewing: reject any `CentralMemory` import in a non-leaf file (`pretty.py
 
 ### Sinks must use async I/O
 
-Sink implementations must not block the event loop. Use `asyncio.to_thread()` or native async libraries for I/O operations. `FileSink` uses an `asyncio.Lock` to prevent concurrent write races.
+Sink implementations must not block the event loop. Use `asyncio.to_thread()` or native async libraries for I/O operations. `FileSink` uses a `threading.Lock` inside its worker thread to prevent concurrent write races, including when one sink is reused across event loops.
 
 When reviewing: reject synchronous `open()`, `write()`, or network calls inside a sink's `write_async`.
 

.github/instructions/style-guide.instructions.md

@@ -87,7 +87,7 @@ def validate_input(self, data: dict) -> None:  # Should be private
 - **EVERY** function MUST declare its return type
 - Use `None` for functions that don't return a value
 
-### Modern Type Syntax (Python 3.10+)
+### Modern Type Syntax
 - Use built-in generics and union syntax:
   - `list[str]` not `List[str]`
   - `dict[str, Any]` not `Dict[str, Any]`
@@ -210,17 +210,17 @@ Within the same package, import from the specific file to avoid circular imports
 
 ### Typing Backports (`typing_extensions`)
 
-For typing features that don't exist on every supported Python (`Self`,
-`override`, `TypeAlias`, `Unpack`, `NotRequired`, etc.), import from
-``typing_extensions`` rather than ``typing``. `typing_extensions` is already a
-transitive dependency (pulled in by ``pydantic``) and works across all supported
-Python versions, so this avoids per-version branching and ``# type: ignore`` noise.
+Import typing features from ``typing`` when they exist on every supported Python
+version. For newer features, import from ``typing_extensions``. It is already a
+transitive dependency (pulled in by ``pydantic``), so this avoids per-version
+branching and ``# type: ignore`` noise.
 
 ```python
-# CORRECT — works on 3.10+
-from typing_extensions import Self, override
+# CORRECT — works on every supported Python version
+from typing import Self
+from typing_extensions import override
 
-# INCORRECT — `Self` is 3.11+, `override` is 3.12+, breaks on older runtimes
+# INCORRECT — `override` is 3.12+ and breaks on Python 3.11
 from typing import Self, override
 ```
 

.github/instructions/test.instructions.md

@@ -27,7 +27,11 @@ Most tests should be unit tests. Integration and end-to-end tests are for testin
 - Group tests in classes prefixed with `Test`
 - Use `@pytest.mark.usefixtures("patch_central_database")` on classes touching Central Memory
 - Reuse `tests/unit/mocks.py` helpers: `MockPromptTarget`, `get_sample_conversations`, `get_mock_target_identifier`, `openai_chat_response_json_dict`
-- Key fixtures from `tests/unit/conftest.py`: `patch_central_database`, `sqlite_instance`
+- Key memory fixtures from `tests/unit/conftest.py`:
+  - Use `patch_central_database` for tests that access `CentralMemory` or construct targets, scorers, or attacks. Declare it explicitly even in constructor, validation, or identifier tests that do not directly query memory.
+  - Use `sqlite_instance` when the test needs to interact with the real isolated SQLite backend.
+  - Do not rely on memory or singleton state left behind by another test. Each test must declare its own memory dependency.
+- When changing shared memory fixtures, install all optional dependencies with `uv sync --extra all` and run `make unit-test`. Optional component tests must also exercise fixture isolation.
 - No network calls should ever happen in unit tests, but file access is okay
 - Unit tests should be fast and can be run in parallel.
 

.github/workflows/build_and_test.yml

@@ -90,7 +90,7 @@ jobs:
       fail-fast: true
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
-        python: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+        python: ["3.11", "3.12", "3.13", "3.14"]
         package_name: ["pyrit"]
         package_extras: ["dev", "dev_all"]
     runs-on: ${{ matrix.os }}

.github/workflows/diff_cover.yml

@@ -49,6 +49,8 @@ jobs:
         run: uv sync --extra all
 
       - name: Run unit tests with coverage (fail under 78%)
+        env:
+          COVERAGE_CORE: sysmon
         run: make unit-test-cov-xml
 
       - name: Code Coverage Report

.github/workflows/docs.yml

@@ -248,4 +248,4 @@ jobs:
 
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1