feat!: release 2.0.0 — new detections, enforced budgets, docs overhaul

[joaovitoriasilva]

What does this PR do?

Prepares the 2.0.0 release. Two strands of work:

Validation and security (breaking). Adds image decompression bomb detection (PNG IHDR / JPEG SOF headers bounded by the new max_image_pixels), root-element enforcement for activity XML so arbitrary XML can no longer hide behind a .gpx/.tcx name, a max_xml_elements cap with incremental parsing, a gzip_analysis_timeout, and rejection of ZIP entries carrying executable, script, or system-file extensions. The wall-clock budget is now enforced during validation rather than only on completion, so a runaway upload is aborted while it runs. max_validation_memory_mb becomes telemetry unless enforce_memory_limit=True, because it samples process-wide peak RSS and misattributes concurrent work. Fixes log injection (CWE-117) by routing every untrusted filename through safe_label(). Removes public symbols that no code path could produce. Lowers the minimum supported Python from 3.13 to 3.11.

Documentation. Rewrites SECURITY.md around supported versions / scope / reporting / expectations. Brings mkdocs.yml in line with the sibling jasil config — site_url, site_description, theme features, admonitions, TOC permalinks, and the search plugin, which was silently disabled by listing only mkdocstrings. Turns docs/index.md from a near-verbatim copy of README.md into a real landing page, moving the configuration, exception-handling, and release-verification material into the integration checklist. Converts every Markdown heading to sentence case to match jasil. Fixes CONTRIBUTING.md, which was titled "Contributing to Endurain" — the wrong project.

Full detail, including upgrade notes, is in CHANGELOG.md.

Related issue

None. This is the release branch, prepared directly by the maintainer. Happy to open a tracking issue if you would rather have one on record.

Type of change

• Bug fix
• New feature (exception during freeze; link prior discussion/acknowledgment)
• Documentation
• Refactor / code quality
• Translation
• Other — breaking release: removed public symbols and changed a default

Checklist

• This PR is focused on a single concern — no. It is the 2.0.0 release branch and deliberately spans the whole release.
• An issue was opened and acknowledged before writing this code (if not a small fix)
• If this PR introduces a new feature during freeze, it was discussed and explicitly acknowledged first — n/a, not in freeze
• The PR is under ~300 lines changed — no. ~4,100 insertions across 58 files, of which uv.lock is 545.
• Tests have been added or updated where applicable
• Documentation has been updated where applicable
• Commit messages follow Conventional Commits format

Notes for the reviewer

Read the upgrade notes at the top of CHANGELOG.md first. They call out the one change that makes safeuploads accept something it previously rejected — the max_validation_memory_mb default — separately from the four that make it reject more.

Breaking surface, in rough order of blast radius:

1. max_validation_memory_mb no longer fails a validation by default. Anyone relying on it must set enforce_memory_limit=True, and only in a process validating one upload at a time. Config validation warns when the budget is customised but enforcement is off.
2. More uploads are rejected: images whose dimensions cannot be read, arbitrary XML behind an activity extension, and ZIPs with executable/script/system-file entries.
3. The time budget aborts mid-flight, so uploads that previously ran over and still completed now raise ResourceLimitError.
4. Removed symbols raise AttributeError: the validate() alias on every validator, eight unreachable ErrorCode members, three unused ZipThreatCategory members.

Worth a closer look:

• safeuploads/utils.py and safeuploads/file_validator.py carry most of the new logic — safe_label(), image dimension parsing, and ResourceMonitor threading.
• tests/corpus/test_attack_corpus.py asserts that every threat the threat model claims to stop raises the documented error code. Samples are constructed at test time rather than checked in, so the repo carries nothing an antivirus would quarantine.
• The heading re-casing commit is case-only. Anchors are generated by lowercasing and hyphenating, so every published #anchor still resolves; the only anchor that moves is the CONTRIBUTING.md H1.

Verified locally: ruff check, ruff format --check, mypy clean; 749 tests pass at 98.86% coverage; mkdocs build --strict exits 0 with no warnings.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.