build(deps): bump rigour from 2.1.2 to 2.2.3

[dependabot]

Bumps rigour from 2.1.2 to 2.2.3.

Release notes

Sourced from rigour's releases.

Rigour 2.2.3

This release substantially improves language-code resolution in rigour.langs and hardens the name-matching internals against pathological, very long inputs.

Highlights

Language resolution (rigour.langs)

• Resolve BCP 47-style tags via their primary subtag, so codes carrying a script or region variant (zh-Hans, pt-BR, sr-el, be-tarask) now resolve instead of returning None. The full tag keeps precedence, so synonyms like chi_sim and aze_cyrl are unaffected, and collective or non-language subtags (roa-tara, mul-x-foo) still return None.
• Fixed several language-code conflations and invalid-code leaks:
  • Old Norse (non) is no longer aliased to Norwegian (nor).
  • Albanian now uses its canonical code sqi (previously conflated with Lower Silesian sli, which had injected the invalid code alb).
  • The Burmese synonym group no longer conflates distinct Burmish languages (Intha, Tavoyan, Taungyo, Rakhine, Marma) with Burmese.
  • list_to_alpha3 output is now filtered to canonical ISO 639-3 codes; ISO 639-2/B and Tesseract-style codes (ger, chi, …) are still accepted as inputs but no longer emitted.
  • Added zxx ("no linguistic content") to the non-language set alongside mis/mul/und.
• Unified Nepali on the FtM-whitelisted macrolanguage nep; the individual-language code npi now resolves to it.
• Greatly expanded label coverage for every language followthemoney whitelists:
  • Native endonyms (plus common exonym variants) for 15 previously code-only languages: amh, est, gle, kan, lav, lit, ltz, mlt, mon, pus, slv, tgk, tgl, tuk, uzb.
  • Russian, French, Spanish and Ukrainian labels for all whitelisted languages.
  • Arabic and Chinese labels, plus common English exonym variants seen in sanctions/corporate data (Mandarin, Cambodian, Castilian, Flemish, Byelorussian, Bokmål, Pushto, …).
  • Added "Central Khmer" (UK FCDO usage) → khm.
  • Fixed Pashto: "Pashto"/"Pashtu" now resolve (the SIL ref-name is "Pushto").

Name matching

• Capped the per-character inputs to the O(n·m) dynamic-programming paths (compare_parts, pick, ordering) at a fixed MAX_NAME_LENGTH of 384. Previously these allocated unbounded cost/backpointer matrices over the joined characters of both names — two 600-part names measured at 379 MB RSS and 0.62 s for a single call, growing quadratically. Overflow parts fall out as solo clusters, preserving the "every part appears exactly once" contract.
• MAX_NAME_LENGTH is now exported from the Rust core and re-exported by rigour.env as the single source of truth shared by the Python distance wrappers and the Rust DP paths.

Internal

• Span length is now computed on demand rather than eagerly, so building a span that is never measured no longer pays for the character count.
• Removed the private rigour._core.string_number export, which had no consumers outside the test suite (the parser remains used Rust-internally).

Upgrade notes

• list_to_alpha3 no longer emits non-canonical codes such as ger or chi. They remain valid inputs but will not appear in output; consumers expecting ISO 639-2/B output should map accordingly.
• The RR_MAX_NAME_LENGTH environment variable is now a no-op — MAX_NAME_LENGTH is fixed at 384.

Full changelog: v2.2.2...v2.2.3

Rigour 2.2.2

This release adds utilities for comparing imprecise dates and makes IMO number validation safer and more precise. It supersedes 2.2.1, whose release build failed and was not published.

Highlights

• Added rigour.dates for working with prefix dates such as 2026, 2026-06, and exact timestamps.
  • Expand dates into UTC intervals with prefix_interval().
  • Compare dates using ended_before() and starts_after().
  • Parse offset-aware exact timestamps with parse_utc().
• Hardened IMO extraction and validation:
  • Rejects all-zero and very short numeric placeholders.

... (truncated)

Commits

• 8f4044d Bump version: 2.2.2 → 2.2.3
• 0c88cd7 Merge pull request #257 from opensanctions/worktree-span-len-dynamic
• 3ae6f38 _core: unexpose string_number
• 89c01c3 names: compute Span length on demand
• 3b02e41 Merge pull request #256 from opensanctions/fix/name-length-cap-230
• 6e3dae4 Cap name-length inputs to the O(n·m) name-matching DP paths (#230)
• f14969e Merge pull request #254 from opensanctions/fix-langs-code-conflations
• 235b579 Add Arabic/Chinese labels and common English variants for FtM languages
• b490823 Add Russian, French, Spanish and Ukrainian labels for all FtM languages
• 826b4da Resolve "Central Khmer" to khm
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
rigour	[>= 1.2.dev0, < 1.3]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​rigour@​2.1.2 ⏵ 2.2.3	+1

View full report

[dependabot]

Superseded by #1228.