removing useless modules

.github/workflows/release.yml

@@ -31,6 +31,16 @@ jobs:
           CIBW_ARCHS_MACOS: "x86_64 arm64"
           CIBW_SKIP: "pp* *-win32 *i686 *musllinux*"
           CIBW_PRERELEASE_PYTHONS: "0"
+          # Fail the build if a wheel is ever produced without the compiled
+          # Cython extension (asyncdb/utils/types.*.so / .pyd). This prevents
+          # publishing a broken wheel that raises "No module named
+          # 'asyncdb.utils.types'" at import time.
+          CIBW_TEST_COMMAND: >-
+            python -c "import glob, os, sysconfig;
+            d = os.path.join(sysconfig.get_paths()['platlib'], 'asyncdb', 'utils');
+            ext = glob.glob(os.path.join(d, 'types.*.so')) + glob.glob(os.path.join(d, 'types.*.pyd'));
+            assert ext, 'compiled Cython extension missing in ' + d;
+            print('compiled Cython extension present:', ext[0])"
         run: |
           cibuildwheel --output-dir dist
 

MANIFEST.in

@@ -5,16 +5,24 @@ include SECURITY.md
 include INSTALL.md
 include README.md
 include Makefile
+include pyproject.toml
+include setup.py
 
-graft asyncdb
-graft tests
+# Ship only the sources needed to build the package.
+# (Compiled .so/.pyd are produced at build time by build_ext, not shipped in the sdist.)
+recursive-include asyncdb *.py *.pyx *.pxd *.pyi
+include asyncdb/py.typed
 
-# Exclude tests, settings, env, examples, and bin folders
-global-exclude *.pyc
+# --- Never ship build artifacts, caches or compiled blobs in the sdist ---
+global-exclude *.pyc *.pyo *.pyd *.so *.o *.obj
+global-exclude *.cpp
+global-exclude *.c
+recursive-exclude * __pycache__
+
+# Exclude tests, settings, env, examples, docs and bin folders
 prune docs
 prune settings
 prune env
 prune examples
 prune bin
-recursive-exclude */__pycache__
-prune */__pycache__
+prune tests

SECURITY.md

@@ -10,6 +10,23 @@ receiving such patches depend on the CVSS v3.0 Rating:
 | 9.0-10.0  | Releases within the previous three months |
 | 4.0-8.9   | Most recent release                       |
 
+## Known Accepted Risks
+
+### asyncmy (optional `mysql` extra) — GHSA-qhqw-rrw9-25rm
+
+`asyncmy` (used only by the optional `mysql` driver) is affected by a SQL
+injection issue via crafted dictionary keys, and there is **no patched upstream
+release** (all versions `<= 0.2.11` are affected). We pin the latest available
+version (`0.2.11`) and accept the risk under the following condition:
+
+- **Never pass dictionaries with untrusted / attacker-controlled keys** as query
+  parameters to the MySQL driver. Parameter *values* are escaped correctly; the
+  issue only affects *keys*, which in normal usage are developer-defined column
+  names, not user input.
+
+If your application forwards externally-controlled dict keys into queries, use
+the `mariadb` extra (`aiomysql >= 0.3.2`) or `mysqlclient` instead.
+
 ## Reporting a Vulnerability
 
 Please report (suspected) security vulnerabilities to