build(deps): bump rigour from 2.1.2 to 2.3.1

[dependabot]

Bumps rigour from 2.1.2 to 2.3.1.

Release notes

Sourced from rigour's releases.

Rigour 2.3.1

A data-only patch release: it widens the person-name alias corpus that backs the NAME symbol tagger, mostly for Traditional Chinese renderings and Belarusian forms of Romance and Germanic name particles.

Highlights

Person-name aliases (rust/data/names/person_names.txt)

The corpus feeds the AC name tagger, so an added alias means that surface form now resolves to the same NAME symbol as its other spellings during analyze_names — and therefore matches across scripts and transliterations rather than being compared character by character.

• Traditional Chinese renderings for entries that previously carried only the Simplified form: 馮 (von), 範 (van), 達 (da), 戴爾 (del), 赫爾 (hull), 庫馬爾 (kumar), 格奧爾基耶夫 (georgiev), 尼諾·德 (niño de). Also 德拉 for de la, covering the form written without an interpunct.
• Belarusian forms of name particles, which were absent across the board: дэ and ды (de), дэль (del), дэльі (degli), ля (la), дзю (du).
• New entry for the surname georgiev (Q105531174), alongside the already-present georgiew and georgiewa.
• Merged the duplicate van entry (Q50354059) into the canonical one (Q1258618), which picked up its 來自 alias. "van" and its variants now emit a single NAME symbol instead of two.

Upgrade notes

No API or behaviour change beyond the widened alias set. Names containing the added forms will now produce NAME symbol spans where they previously produced none, which can raise name-matching scores for affected pairs.

Full changelog: v2.3.0...v2.3.1

Rigour 2.3.0

This release changes the timestamp wire format emitted by rigour.time, stops rigour.urls from turning free text into URL-shaped garbage, and expands the abbreviated organisation-type vocabulary used by name matching.

Highlights

Timestamps (rigour.time)

• datetime_iso() now emits the truncated, naive-UTC form 2026-07-29T08:54:49 instead of appending an offset suffix, making it the exact inverse of iso_datetime(). The same logical field was shipping in two shapes across the stack — followthemoney wrote updated_at with +00:00, zavod wrote it without — because callers who wanted the truncated form bypassed datetime_iso() entirely. iso_datetime() reads both forms, so no reader breaks on the transition.
• Aware datetimes in another zone are converted to UTC before truncation, and still warn; dropping a +05:30 offset in place would have silently shifted the timestamp.
• Naive datetimes are now taken to be UTC. Previously they fell into the warn-then-astimezone() branch, which Python resolves against the system local zone, so a naive-UTC value from naive_now() (or zavod's Version.dt) was shifted by the local offset. Fixes #263.

URL cleaning (rigour.urls)

• clean_url() now screens the authority of a parsed URL instead of trusting urlparse, which accepts everything up to the first slash as the host and never rejects free text. A label typed into a spreadsheet's website column — "Social media: http://vk.com/sobolipress" — came back as "http://Social media: http://vk.com/sobolipress", and the dot heuristic made this reachable for any text containing a dot, including prose and decimals. The screen rejects whitespace, requires an extractable hostname and a valid port, accepts IP literals, and requires every label to carry an alphanumeric and stay within the DNS length limit, with a plausible public suffix on dotted hosts. Host labels are matched with a Unicode character class, so a domain is accepted both decoded (пример.рф) and as punycode.
• A supported scheme with no authority now returns None rather than falling through to the dot heuristic, which used to invent a host from the path (mailto:foo@bar.com became http://mailto:foo@bar.com/). Neither mailto: nor file: is supported.

Name matching resources

• Added 72 abbreviated aliases for organisation types and industry domains of the kind found in registry filings and contractual documents: corpn, assn, hldg/hldgs, svc/svcs/srvce/srvces, mgmt/mgt/mngmt, govt/gvt, cmte, agcy, natl, inst, fndn, ctr, grp, auth, proj, prod/prods, soln/solns, inds/indust, trdg, coml/comml, sys, plus sector terms (mfr/mfrs, med, hosp, chem, elec, pwr, telecom/telecoms and their long forms).

Internal

• Modernised type annotations across the package to PEP 585 / 604 (list[str], X | None), matching the >= 3.10 floor, and sorted import blocks and __all__. No behaviour change. One public signature moved with it: __eq__ now takes object rather than Any, matching object.__eq__.
• LangStr.__new__ is bound to a TypeVar, so a subclass constructed through it type-checks as the subclass rather than as LangStr.
• genscripts formats generated tables with ruff instead of black; output is byte-identical, and the generated data files are unchanged.
• Dependency bumps: serde 1.0.229, serde_json 1.0.151, actions/setup-python 7.

Upgrade notes

• datetime_iso() output no longer carries a +00:00 suffix. Consumers comparing serialized timestamps as strings, or asserting on the offset-bearing form, need to adjust. Parsing back through iso_datetime() is unaffected.

... (truncated)

Commits

• f13a181 Bump version: 2.3.0 → 2.3.1
• ad5fdd2 add a few name aliases
• 1eb8292 Bump version: 2.2.3 → 2.3.0
• 0e2d0bc Merge pull request #266 from opensanctions/chore/modernize-typing-annotations
• dc5593a Use set comprehensions over set(genexp)
• 79971b4 Format generated data tables with ruff, drop black
• ca3b069 Add ruff to the dev extra
• f90d45e LangStr.new returns the subclass type; ignore PLC0414
• 55711a6 Apply remaining safe ruff autofixes
• 4e5a645 Modernize type annotations to PEP 585 / 604
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
rigour	[>= 1.2.dev0, < 1.3]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​rigour@​2.1.2 ⏵ 2.3.1	+1

View full report