gffbase 0.2.0

gffbase 0.2.0

on Python PyPI

Genuine gffutils 0.14 API and CLI parity, first-class support for discontinuous (multipart) GFF3 features, a compat/strict mode axis, transactional storage, and a release pipeline gated on validation.

pip install --upgrade gffbase

abi3 wheels for Linux (x86_64, aarch64), macOS (Intel, Apple Silicon) and Windows (x86_64) cover CPython 3.10 through 3.14; no Rust toolchain is needed.

Security — upgrade from 0.1.0

0.2.0 fixes two SQL injection vulnerabilities in 0.1.0, through FeatureDB order_by and set_pragmas: GHSA-5f5g-g3v5-prrg, High (CVSS 3.1 8.1). Applications that pass untrusted input to either parameter are affected. If you cannot upgrade yet, the advisory documents a mitigation. 0.1.0 stays on PyPI rather than being yanked, because 0.2.0 contains breaking changes.

Breaking changes

Read the migration guide before upgrading. Highlights:

• Minimum Python is now 3.10.
• merge_strategy="error" is the real default for duplicate IDs, as in gffutils.
• Ordered queries have a total order; order_by="score" sorts numerically; order_by takes multiple keys, with reverse applying to each.
• FeatureDB.schema is a method again.

The full list is under Changed (breaking) in the changelog.

Performance, as measured

Across five whole-genome human annotations, ingest ranges from 1.21× to 0.69× against gffutils — faster where per-feature overhead dominates, slower on attribute-dense files. The durable advantages are batched extraction, spatial indexing and SQL over the whole corpus. Every figure is generated from a committed measurement file, with correctness signatures matching before any ratio is published: performance · methodology.

How this release was verified

• Qualified in CI on Linux, macOS and Windows across Python 3.10–3.14, on both spatial index paths, plus a five-corpus correctness gate that ingests and fully validates every real annotation.
• 0.2.0rc1, the same content, was published to TestPyPI and verified from there first.
• The binaries attached here are byte-identical to the files on PyPI.

Docs: https://khchao.com/gffbase/ · Changelog: CHANGELOG.md