Changes
- Preserves sensitive text fragments when PII or denylist matches overlap existing secret placeholders, preventing masking gaps in
/api/maskand proxy flows. - Retains uncovered semantic detector fragments when deterministic or checksum detections overlap them.
- Refreshes the pinned Chainguard Python images and PostCSS override to remove known high and critical security findings.
- Adds provider-neutral detector regression coverage and a reliable default Conductor development run.
Upgrade
Pull ghcr.io/sgasser/pasteguard:0.8.3 or ghcr.io/sgasser/pasteguard:latest.