v2.0.0

2.0.0 (2026-06-08)

Features

• api: unify configurable patterns= across the structured-output expressions — extract_pii and mask_pii_audit now accept the same family selection as mask_pii, completing the enterprise surface (configurable patterns + structured output + audit)
• docs: add the v2.0 migration guide — 2.0 is a drop-in upgrade; documents the unified API, the FF1 / key-management / MEA additions, and the stable 2.x surface

Notes

• 2.0 is API-stable for the 2.x line. The only behavioral change from 1.x is that mask_pii_fpe now rejects weak keys (non-32-byte, or a single repeated byte) with ValueError — see the migration guide.

v1.9.0

1.9.0 (2026-06-08)

Features

• mea: add South African ID (13-digit, Luhn + date-of-birth + citizenship validation, POPIA) — asterisk / FPE / consistent modes
• mea: add Israeli ID / Teudat Zehut (9-digit weighted checksum, PPL) — asterisk / FPE / consistent modes; a no-adjacent-dash guard keeps it from masking the digit run inside dash-formatted IDs (e.g. Colombian NIT)

v1.8.0

1.8.0 (2026-06-08)

Features

• fpe: add FF1 mode (NIST SP 800-38G) as an alternative to FF3-1 — mask_pii_fpe(..., mode="ff1"); both modes are reversible and length-preserving
• fpe: add rekey_pii_fpe — rotate the FPE key on a column of FPE tokens (decrypt-old + encrypt-new in one pass, plaintext never materialises as a column)
• keys: add derive_key / derive_tweak (HKDF-SHA256 / HMAC-SHA256) for deterministic, offline per-tenant key and tweak derivation from one master secret
• keys: add validate_key / validate_tweak — length checks plus a weak-key guard that rejects single-repeated-byte keys; now enforced by mask_pii_fpe

v1.7.0

1.7.0 (2026-06-08)

Features

• latam: add Brazilian CNPJ (legal-entity) detection and masking — two mod-11 check digits, asterisk / FPE / consistent modes
• manifest: add masking_manifest + write_manifest — per-column PII inventory with match counts, built-in family→regulation mapping, and mask mode; exports a JSON RAT / data-processing register

Bug Fixes

• latam: stop Colombian cédula / Argentine DNI patterns from masking the XX.XXX.XXX prefix of a CNPJ-shaped value — a /dddd-dd tail now exempts the match

v1.6.0

1.6.0 (2026-06-08)

Features

• audit: add mask_pii_audit expression — masked value plus per-family validated match counts in a single pass, returned as a nested Struct (masked + counts)

v1.5.1

1.5.1 (2026-06-07)

Features

• consistent: cross-column referential integrity — same value + same salt produces identical masked output across any number of columns

v1.5.0

Install

pip install maskops==1.5.0

See CHANGELOG for details.

v0.14.1

Install

pip install maskops==0.14.1

See CHANGELOG for details.

v0.14.0

Install

pip install maskops==0.14.0

See CHANGELOG for details.

v0.13.0

Install

pip install maskops==0.13.0

See CHANGELOG for details.