build: release 4.11.0

[danielplohmann]

Cuts 4.11.0: __version__ goes from 4.10.0 to 4.11.0. ## [Unreleased] becomes ## [v4.11.0] - 2026-10-15 without its empty subsections (Deprecated, Removed, Security). A fresh ## [Unreleased] skeleton goes above it, and the compare links at the foot are updated.

Changelog fixes made while cutting:

• The two loader bullets get their PR numbers (fix(loaders): take the ELF base from PT_LOAD when the sections miss the header #394, fix(loaders): read a mapped ELF buffer's dynamic symbols through its … #395), and the fix(intel): keep an early-return body in its function when it is analyzed first #389 Compatibility bullet gets its (intel) prefix.
• feat(utility): read Go and Rust strings at their real length #382's cost sentence now says 13 of mirai_x64's 162 strings are shortened in Rust mode, 16 before fix(utility): keep tail-merged C strings in Go and Rust mode #402.
• fix(utility): keep tail-merged C strings in Go and Rust mode #402's bullet names its tree (1cec0bc) and the same 16 -> 13 figure, both reproduced in review.

What 4.11.0 carries

Milestone v4.11.0, 11 closed before this PR:

• Added: Go and Rust strings are read at their real length, with a new mode="rust" and data_addr on each string (feat(utility): read Go and Rust strings at their real length #382). Tail-merged C strings stay whole in those modes (fix(utility): keep tail-merged C strings in Go and Rust mode #402).
• Changed: large images keep their per-instruction state compact (peak RSS -26 to -35%), and the cyclic GC is suspended during analysis (perf(core): keep large images' per-instruction state compact #396).
• Fixed:
  • Mapped ELFs: the base comes from PT_LOAD when the sections miss the header (fix(loaders): take the ELF base from PT_LOAD when the sections miss the header #394), and dynamic symbols are kept in buffer mode (fix(loaders): read a mapped ELF buffer's dynamic symbols through its … #395).
  • x86: an early-return body analyzed before its entry stays in its function (x86: body after an early ret split off when it is analyzed before its function #388, fix(intel): keep an early-return body in its function when it is analyzed first #389).
  • Go mode: no OverflowError on an out-of-range string length (feat(utility): read Go and Rust strings at their real length #382).
  • IDAPython: an import by ordinal with no name no longer fails the export (IDAPython backend raises TypeError on an import by ordinal without a name #398, fix(ida): name an import by ordinal when IDAPython passes no name #400). This lets mcrit-plugin#41 drop its _cbEnumImports override.
• Compatibility:
  • x86 boundaries move where an early-return body was analyzed first.
  • String output changes on every binary extracted in Go or Rust mode.
• Also merged, with no changelog entry: ci: move the dangerous-triggers ignore onto the trigger line #399 (zizmor ignore), ci: allow the arm title scope #401 (arm title scope), and Dependabot build(deps): bump the actions group with 2 updates #391-build(deps-dev): bump ruff from 0.16.9 to 0.16.10 in the dev-dependencies group #393.

Not in this release: #364 (ARM32/Thumb backend, draft) and #397, which is stacked on it.

Checked before opening

• fix(utility): keep tail-merged C strings in Go and Rust mode #402 reviewed on Python 3.11.16: ruff check and format clean, full suite 2397 passed, 2 skipped.
• testPackageMetadata.py and testReleaseGuard.py pass on this branch. release_guard.py --tag v4.11.0 passes and extracts the 64-line notes section.
• A local python -m build produced a 379 KB sdist with no tests/ and a 414 KB wheel with py.typed. twine check --strict passed, and the metadata reads Version: 4.11.0.
• master CI on 5129aa3 (fix(utility): keep tail-merged C strings in Go and Rust mode #402's merge) was still running when this PR was opened. Tag only after it and this PR's merge commit are green.

After merge

publish-release.yml changed since v4.10.0: #391 bumped upload-artifact to v7.0.2 and download-artifact to v8.0.2. RELEASING.md asks for a rehearsal on the first release after any workflow change. Once CI is green on the merge commit, tag it and push the tag. Then run Publish release manually on v4.11.0 against TestPyPI before approving the pypi environment:

git tag -a v4.11.0 -m "SMDA 4.11.0"
git push origin v4.11.0

🤖 Generated with Claude Code

[github-actions]

📊 SMDA Performance Evaluation Benchmark Results

Generated on: 2026-10-15 19:19:00

Summary

Metric	Result
Correctness	✅ PASS — 0 / 155 common file(s) differ
Determinism	✅ PASS — base 3 run(s), PR 3 run(s)
Verdict	inconclusive — within run-to-run noise (±1.8%)
Median paired speedup	-0.20% (95% CI [-0.99%, +0.30%])
Timing noise band	±1.8%

Per-side Timing Context (best of 3/3 runs per file)

Side	Files	Functions	Median best time/file (s)	Sum of best times (s)	Throughput estimate (func/s)
base	155	173540	0.6190	223.85	~775
pr	155	173540	0.6047	223.91	~775

These context rows sum each file's best observed time across repeated runs; they are normalized comparison estimates, not single-run CI wall-clock times.

Paired per-file timing (positive speedup = PR faster):

Statistic	Value
Files compared	155
Median paired speedup	-0.20% (95% CI [-0.99%, +0.30%])
Mean speedup	-0.90% (95% CI [-1.92%, +0.03%])
Std dev / IQR	6.24% / 4.40%
Wilcoxon signed-rank p	0.7512 (n=155)

ℹ️ base and PR are timed in the same job on the same runner, with their passes interleaved base/PR/PR/base/base/PR so that drift over the job cancels rather than landing on whichever side ran last. The noise band above is therefore run-to-run variation on one machine, which is what it is able to measure; a difference inside it is reported as inconclusive. Correctness and determinism are not timing-based and are unaffected either way.

Determinism (self-check across repeated runs)

Side	Runs	Files	Deterministic	Median timing CV
base	3	155	✅	1.8%
pr	3	155	✅	1.7%

Pairwise run matrix (individual run medians, diagnostic)

Diagnostic only: each row compares one raw PR run against one raw base run. The headline verdict above uses paired per-file best-of-runs timings.

Comparison Run	PR Files	Base Files	Common	Function Set Matches	Med PR (s)	Med Base (s)	Med Diff (s)	Speedup %
pr_0 vs base_0	155	155	155	155/155	0.6300s	0.6676s	-0.0376s	+5.63%
pr_0 vs base_1	155	155	155	155/155	0.6300s	0.6468s	-0.0168s	+2.59%
pr_0 vs base_2	155	155	155	155/155	0.6300s	0.6594s	-0.0294s	+4.46%
pr_1 vs base_0	155	155	155	155/155	0.6410s	0.6676s	-0.0266s	+3.98%
pr_1 vs base_1	155	155	155	155/155	0.6410s	0.6468s	-0.0058s	+0.89%
pr_1 vs base_2	155	155	155	155/155	0.6410s	0.6594s	-0.0184s	+2.79%
pr_2 vs base_0	155	155	155	155/155	0.6395s	0.6676s	-0.0281s	+4.21%
pr_2 vs base_1	155	155	155	155/155	0.6395s	0.6468s	-0.0073s	+1.13%
pr_2 vs base_2	155	155	155	155/155	0.6395s	0.6594s	-0.0199s	+3.02%