build(deps): bump followthemoney from 4.9.2 to 4.10.1

[dependabot]

Bumps followthemoney from 4.9.2 to 4.10.1.

Release notes

Sourced from followthemoney's releases.

v4.10.1

What's changed in 4.10.1

Fixes

• Statement serialization: three bugs in followthemoney/statement/serialize.py (#334)
  • Legacy pack files (no header row) silently dropped their first statement — the header-detection branch consumed the first data row.
  • CSV reading turned empty first_seen / last_seen / id columns into "" instead of None, so None did not survive a round-trip and an empty id suppressed key generation.
  • The CSV/pack readers and writers wrapped streams without newline="", which the csv module requires: CR/CRLF inside quoted values was rewritten on read, leaving statement ids inconsistent with their values (and row terminators broken on Windows).
• NumberType.parse no longer silently corrupts common numeric shapes (#331, #332, thanks @​goose-life). The old pattern stripped the configured separator unconditionally and treated any trailing token as a unit, so "1 000 000" truncated to "1", a European decimal comma became a 10x error ("1,5" → "15"), and ranges collapsed to their lower bound with "-" as the unit. Parsing is now a single strict, fully-anchored pattern: grouping separators are only accepted where they split digits into valid western/indian groups, and units are digit-free by construction. Ambiguous or multi-number inputs return (None, None) so callers can warn, rather than a plausible-but-wrong value.
• URLs with prose in the host name are dropped (#339, #341). Source data frequently puts labels into website columns ("Social media: http://vk.com/sobolipress"); older rigour accepted these and emitted URLs with the prose as their host, which showed up as garbage in published exports. The rigour floor is now 2.3.0, which validates the host before accepting a cleaned URL.
• The ontology's dcterms:modified timestamp was malformed and in local time: the format string "%Y-%m-%dT%H:%I:%M" put the 12-hour hour in the minutes position and never emitted seconds. It is now an ISO-formatted, timezone-aware UTC datetime.

Schema & vocabulary

• Topic labels are shorter and no longer repeat the word "entity": sanction → "Sanctioned", sanction.linked → "Sanction-linked", sanction.counter → "Counter-sanctioned", debarment → "Debarred" (#330). The sanction.control relabel shipped in 4.10.0 is reverted to "Sanction ownership or control".
• The JS and Java defaultModel.json dumps pick up rigour's territory rename of "Nauru" to "Naoero".

Tooling

• Python 3.11 is now the minimum (requires-python >= 3.11); the 3.10 classifier is dropped.
• ruff replaces flake8 as the linter (#338), taking ruff's default rule selection as-is with documented exceptions. The sweep brought import sorting, f-strings in place of percent formatting, modern X | None annotations, Self, ClassVar on class-level constants, narrowed except clauses, and closed file handles in tests and contrib.
• Routine dependency updates: svgo in the JS package (#336), jackson-databind in the Java package (#335).

Full changelog: opensanctions/followthemoney@v4.10.0...v4.10.1

v4.10.0

What's changed in 4.10.0

CLI: ftm ref slimmed down for agent context (#316)

The ftm ref model-reference commands now emit much terser JSON, designed to be loaded into LLM agent context without wasting tokens:

• Enum value listings moved into a dedicated ftm ref type-values NAME command (accepts singular or plural type names, e.g. country/countries). ref type and ref prop now report a values_count and point there instead of inlining hundreds of country/language codes.
• All ref JSON is recursively slimmed: redundant fields (maxLength, plural, pivot, false matchable/abstract/enum, labels that merely echo the name) are dropped.
• ref schema is reshaped into a compact field index of {name, type} entries, with hidden and deprecated properties skipped.
• Stub (reverse-edge) properties are now included in ref schema, annotated with the forward property they mirror (e.g. "reverse": "Ownership:owner"). The --stubs flag is gone.

TypeScript library

• Entity now parses and round-trips the entity-level metadata emitted by the Python ValueEntity serialization — caption, datasets, referents, first_seen, last_seen, last_change — which was previously dropped on input and lost on toJSON(). getCaption() prefers the precomputed caption over deriving one from schema caption properties, matching Python precedence. (#328)
• New IStatementDatum interface: a typed mirror of the Python StatementDict statement wire format, including the optional prop_type field added by the OpenSanctions statement API and CSV exports. (#329)
• Removed the phantom required field from IEdgeSpecification, which the Python model never emits.

Schema & vocabulary

• The sanction.control topic is now labelled "Controls sanctioned entity" (was: "Sanction ownership or control"), and its description was clarified — the old wording read as if the sanction itself were being controlled. (#327, thanks @​jbothma)
• Fixed a typo in the Occupancy:constituency description. (#317, thanks @​leonhandreke)

Fixes

• The ontology docs build now runs via python -m to avoid the package's types module shadowing the stdlib under Python 3.13.

Plus routine dependency updates across the JS and Java packages.

Full changelog: opensanctions/followthemoney@v4.9.2...v4.10.0

Commits

• 45bfb89 Bump version: 4.10.0 → 4.10.1
• 128287e Merge pull request #341 from opensanctions/fix/url-junk-hostnames-339
• 01e86d8 Require rigour 2.3.0 for URL host validation (#339)
• 638698d bump lockfile
• 0da6922 Merge pull request #332 from opensanctions/fix/number-parse-silent-corruption...
• 31ff30b Fix NumberType.parse silent corruption of common numeric shapes (#331)
• 244eea1 Add regression tests for number.parse silent corruption (#331)
• 04d6892 Merge pull request #338 from opensanctions/pudo/adopt-ruff
• 0e3f173 Catch AttributeError in to_number again
• 2a66974 Stop loop variables shadowing arguments (PLR1704)
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
followthemoney	[>= 4.2.dev0, < 4.3]

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​followthemoney@​4.9.2 ⏵ 4.10.1

View full report

[dependabot]

Superseded by #1239.