PackageTrack

PyPI

ioc-fanger

5.1.1ioc-fang/ioc-fanger ↗

Python package to defang and fang indicators of compromise from text.

Release timeline

41 releases since 2017
20172026

One column per quarter.

Releases

  1. 5.1.117 Jun 2026
    Release notes

    Fixed

    • Fixed ReDoS catastrophic backtracking in fang() (#149). Thirteen patterns used \ *[brackets]\ * — two unbounded space quantifiers around a bracket class — which an adversarial run of spaces could force into super-polynomial backtracking (a ~400-byte input pinned a CPU core for seconds), reachable through the public fang() API on untrusted text. The flanking spaces are now bounded to \ {0,3}, keeping matching linear while preserving capture-group numbering and match semantics.
    Open source →
  2. 5.1.011 Jun 2026
    Release notes

    Performance improvements

    Open source →
    Additional notes

    Changed

    • Faster fang() on text without defang markers by skipping literal-keyed regex passes (DOT, dot/punto/punkt, AT/ET/ARROBA, xxxx://) when none of the trigger substrings are present — the same idea as the existing bracket short-circuit, generalized to a per-mapping requires_any literal gate. Output is unchanged. Roughly 1.8x faster on bracket-free input and ~4x faster on plain prose; bracket-heavy input also benefits when it defangs with brackets rather than the literal words.
    Open source →
  3. 5.0.013 May 2026
    Release notes

    Python version upgrade and improvements

    Open source →
    Additional notes

    Added

    • Python 3.10, 3.11, 3.12, 3.13, and 3.14 support

    Changed

    • Migrated from pip/setuptools to uv for dependency management and packaging
    • Switched build backend from setuptools to hatchling
    • Replaced flake8, black, isort, and pylint with ruff for linting and formatting
    • Faster fang() by skipping bracket-related regex passes when the input contains no brackets
    • Faster defang() by replacing the regex-mapping loop with direct str.replace calls for http/https and two precompiled regexes for . and @

    Fixed

    • fang() no longer mistakes literal dot/DOT text inside URL hostnames for a defanged separator (#112). Lowercase dot is now only fanged when bordered by brackets or by hyphens on both sides (so accounts.dot-example.online is preserved). Bare uppercase DOT is only fanged when it sits inside a token with no real . and is not adjacent to other uppercase letters (so WWW.MDOT.EXAMPLE.VIP/pay is preserved while fooDOTcom still fangs to foo.com).
    • Constrained the comma-separated IP fang regex (a,b,c,d) to require each octet to be in the valid IPv4 range 0-255, so strings like 999,999,999,999 no longer match the IPv4 fang pattern (#121)

    Removed

    • Support for Python 3.7, 3.8, and 3.9 (minimum is now 3.10)
    • setup.py, setup.cfg, and mypy.ini (configuration consolidated into pyproject.toml)
    • bump2version (versions are managed directly in pyproject.toml and ioc_fanger/__init__.py)
    • Docker-based local development; uv is now the supported way to test/lint/develop. Docker is retained only to generate and compare a Linux benchmark baseline that matches CI.
    • requirements.txt and requirements_dev.txt (use uv sync --locked --group dev to set up a dev environment)
    Open source →
  4. 4.2.127 Sept 2022
    Release notes

    Bump version: 4.2.0 → 4.2.1

    Open source →
    Additional notes

    Fixed

    • Fixed incorrect find regex producing overly broad fanging of any character preceeded with a \ (#99)
    Open source →
  5. 4.2.017 Sept 2022
    Release notes

    Bump version: 4.1.0 → 4.2.0

    Open source →
    Additional notes

    Changed

    • (Internal) Moving regexes from json files to Python files for improved readability (#50)
    Open source →
  6. 4.1.013 Sept 2022
    Release notes

    Bump version: 4.0.0 → 4.1.0

    Open source →
    Additional notes

    Changed

    • Simplifying regexes which find surrounding brackets to only fang characters surrounded by brackets on both sides (#85)
      • e.g. With previous versions of this library, this: a.]b was fanged as: a.b. Now, a.]b will not be changed when fanging.
    Open source →
  7. 4.0.014 Jul 2022
    Release notes

    Bump version: 3.4.1 → 4.0.0

    Open source →
    Additional notes

    Fixed

    • Refined parsing so schemes like ldap are properly preserved
      • We have dropped support for fanging certain, uncommon fanging strategies like http!://example.com/test.php; if you are regularly seeing this fanging strategy used and would like this to be readded, please raise an issue

    Removed

    • Support for Python < 3.7
    Open source →
  8. 3.4.123 Feb 2022
    Release notes

    Bump version: 3.4.0 → 3.4.1

    Open source →
    Additional notes

    Fixed

    • IP address fanging so that we fang only comma separated numbers bordered by whitespace or the start/end of a line (#71)
    Open source →
  9. 3.4.04 Feb 2022
    Release notes

    Bump version: 3.3.0 → 3.4.0

    Open source →
    Additional notes

    Removed

    • Removed pyparsing as a requirement (#61)
    Open source →
  10. 3.3.017 Apr 2021
    Release notes

    Bump version: 3.2.3 → 3.3.0

    Open source →
    Additional notes

    Added

    • Adding fanging for <.> (#52)
    Open source →
  11. 3.2.39 Apr 2021
    Release notes

    Fixed

    • Limited replacement of characters between http(s) and :// by changing (https?)(?!s)\\S*?:// to (https?)\\S{0,2}?:// (#53)
    • Not replacing http:// or https:// in URL paths/query strings (#53)
    Open source →
  12. 3.2.27 Apr 2021
    Release notes

    Fixed

    • Reduced false positives by not fanging periods and commas with spaces after them (#47) (e.g. previously a. [b] was fanged as a.b] - we've updated this to prevent false positives so that a. [b] is not fanged)
    Open source →
  13. 3.2.16 Apr 2021
    Release notes

    Fixed

    • Fixing lint errors
    • Improving handling of "http" surrounded by angle brackets (#48)
    Open source →
  14. 3.2.09 Mar 2021
    Release notes

    Added

    Changed

    • Reverting to use regexes rather than grammars (for the sake of performance) (#38)
    Open source →
  15. 3.1.422 Jan 2021

    Nothing published for this version

  16. 3.1.328 Sept 2020

    Nothing published for this version

  17. 3.1.228 Aug 2020

    Nothing published for this version

  18. 3.1.126 Feb 2020

    Nothing published for this version

  19. 3.1.010 Feb 2020

    Nothing published for this version

  20. 3.0.182 Jan 2020

    Nothing published for this version

  21. 3.0.1625 Sept 2019

    Nothing published for this version

  22. 3.0.154 Jun 2019

    Nothing published for this version

  23. 3.0.144 Jun 2019

    Nothing published for this version

  24. 3.0.1212 Apr 2019

    Nothing published for this version

  25. 3.0.112 Apr 2019

    Nothing published for this version

  26. 3.0.927 Mar 2019

    Nothing published for this version

  27. 3.0.826 Mar 2019

    Nothing published for this version

  28. 3.0.69 Mar 2019

    Nothing published for this version

  29. 3.0.530 Jan 2019

    Nothing published for this version

  30. 3.0.428 Jan 2019

    Nothing published for this version

  31. 3.0.312 Dec 2018

    Nothing published for this version

  32. 3.0.22 Dec 2018

    Nothing published for this version

  33. 3.0.114 Nov 2018

    Nothing published for this version

  34. 3.0.013 Aug 2018

    Nothing published for this version

  35. 2.0.412 Mar 2018

    Nothing published for this version

  36. 2.0.312 Mar 2018

    Nothing published for this version

  37. 2.0.224 Jan 2018

    Nothing published for this version

  38. 2.0.124 Jan 2018

    Nothing published for this version

  39. 1.0.012 Dec 2017

    Nothing published for this version

  40. 0.1.216 Oct 2017

    Nothing published for this version

  41. 0.1.110 Oct 2017

    Nothing published for this version