build(deps): bump followthemoney from 4.9.2 to 4.10.2

[dependabot]

Bumps followthemoney from 4.9.2 to 4.10.2.

Release notes

Sourced from followthemoney's releases.

v4.10.2

What's changed in 4.10.2

Phone numbers take their country from format=, not from the entity (#342, #333)

PhoneType used to derive the dialing region from the country properties of the entity a value was being added to. That made the stored number depend on entity state at add() time: adding country after phone dropped the value, any country-typed property counted (including birthCountry), and an entity with several countries picked whichever the set happened to yield first — so the same input could produce different numbers in different processes.

Numbers in national format now take their country through the existing format hint, which every entity write path already threads through:

entity.add("phone", "017623423980", format="de")

The hint resolves through rigour, so alpha-3 codes and subdivisions like gb-eng work; territories with no dialing plan of their own raise InvalidData. It is resolved before parsing, so a bad hint is reported even when the number is already in international format.

Upgrade note: the entity is no longer consulted at all. National-format numbers that used to be rescued by a country property on the entity are now rejected unless a format= hint is passed — as they already were whenever the country happened to be added after the phone number. Dropping the validate() override also means validate() and clean() finally agree: both take format, neither looks at entity state.

StatementEntity.external

A new entity-level external property: an entity is external when every statement backing it is external, i.e. nothing about it has been through verification yet. A single non-external statement means some part of the entity is published data, so the entity as a whole counts as internal. An entity with no statements is not external. The aggregate deliberately skips the synthesized BASE_ID checksum statement, which is never constructed as external. (#357)

external= is also threaded through set() / add() / unsafe_add(), so external entities can be built through the property API rather than only from hand-constructed Statement objects.

Fixes

• Statement.clone() declared self: Self but returned a hardcoded Statement(...), so a subclass calling clone() got a base instance back. It now constructs via type(self)().
• VersionHistory.max_length was only half-wired: append() dropped a custom value (reverting to the default 100 after one append) and to_json() trimmed with the class-level constant. Both now respect self.max_length. Behaviour is unchanged for the default, which is every call site in the stack.
• VersionHistory.from_json parsed the same JSON string twice.

Typing & dependencies (#343)

• Eight classmethods that construct via cls() still returned a quoted class name, so subclasses lost their identity — DataCatalog.from_path hardcoding DataCatalog[DS] was the clearest case. They now return Self. Four siblings keep concrete return types on purpose, where Self would be unsound.
• Optional is gone from the package: 18 annotations (mostly the proxy= parameter repeated across the type modules) plus nine dangling imports, replaced by X | None.
• The pytz dependency is dropped — unreferenced in the tree and unused downstream; it predates zoneinfo and datetime.UTC, both of which we already use.
• networkx is allowed up to <3.7. Routine JS and Java dependency updates (rollup, prettier, eslint, typescript-eslint, replace-in-file 9, junit-bom, maven-jar-plugin).

Tooling

• Added the Python 3.14 classifier, which CI had been testing all along.
• CI no longer runs twice on every pull request (#358). Both workflows triggered on unfiltered push and pull_request, so a branch pushed to this repo ran every workflow twice over identical code — roughly 40% of runs. push is now filtered to main and tags, pull_request covers branch work, and build.yml gained a concurrency group so a fixup push cancels its superseded run (conditional on pull_request, so a tag push can never abort a release mid-upload). The docs workflow's single global pages concurrency group moved down onto the deploy job, which is the only part that needs to serialise. The Python test matrix is reduced to the ends of the supported range, 3.11 and 3.14.

Full changelog: opensanctions/followthemoney@v4.10.1...v4.10.2

v4.10.1

What's changed in 4.10.1

Fixes

• Statement serialization: three bugs in followthemoney/statement/serialize.py (#334)
  • Legacy pack files (no header row) silently dropped their first statement — the header-detection branch consumed the first data row.
  • CSV reading turned empty first_seen / last_seen / id columns into "" instead of None, so None did not survive a round-trip and an empty id suppressed key generation.
  • The CSV/pack readers and writers wrapped streams without newline="", which the csv module requires: CR/CRLF inside quoted values was rewritten on read, leaving statement ids inconsistent with their values (and row terminators broken on Windows).
• NumberType.parse no longer silently corrupts common numeric shapes (#331, #332, thanks @​goose-life). The old pattern stripped the configured separator unconditionally and treated any trailing token as a unit, so "1 000 000" truncated to "1", a European decimal comma became a 10x error ("1,5" → "15"), and ranges collapsed to their lower bound with "-" as the unit. Parsing is now a single strict, fully-anchored pattern: grouping separators are only accepted where they split digits into valid western/indian groups, and units are digit-free by construction. Ambiguous or multi-number inputs return (None, None) so callers can warn, rather than a plausible-but-wrong value.
• URLs with prose in the host name are dropped (#339, #341). Source data frequently puts labels into website columns ("Social media: http://vk.com/sobolipress"); older rigour accepted these and emitted URLs with the prose as their host, which showed up as garbage in published exports. The rigour floor is now 2.3.0, which validates the host before accepting a cleaned URL.
• The ontology's dcterms:modified timestamp was malformed and in local time: the format string "%Y-%m-%dT%H:%I:%M" put the 12-hour hour in the minutes position and never emitted seconds. It is now an ISO-formatted, timezone-aware UTC datetime.

... (truncated)

Commits

• b9418ec Bump version: 4.10.1 → 4.10.2
• 687efce Merge pull request #358 from opensanctions/ci/reduce-duplicate-runs
• 09988de Stop running CI twice on every pull request
• 8c217fd Merge pull request #357 from opensanctions/pudo/entity-external
• 1ca9eca Add an entity-level external property to StatementEntity
• c4c864d Merge pull request #343 from opensanctions/cleanup/post-311-typing-and-pytz
• f7ed7f0 Merge pull request #353 from opensanctions/dependabot/github_actions/actions/...
• e877956 bump and run
• baa5d6b Review follow-ups: extend the sweep to spots it missed
• c1ad8bc Merge pull request #346 from opensanctions/dependabot/maven/java/org.junit-ju...
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
followthemoney	[>= 4.2.dev0, < 4.3]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​followthemoney@​4.9.2 ⏵ 4.10.2

View full report