Prep extra for release: cleanup, security fixes, dep bumps

.containerignore

@@ -1,5 +1,6 @@
 .git
 build
+build-*
 benchmarks/data
 benchmarks/results
 __pycache__

.github/workflows/cmake.yml

@@ -35,12 +35,12 @@ jobs:
       if: runner.os == 'Linux'
       run: |
         sudo apt-get update
-        sudo apt-get install -y libomp-dev cmake
+        sudo apt-get install -y cmake
 
     - name: Install dependencies (macOS)
       if: runner.os == 'macOS'
       run: |
-        brew install --formula libomp cmake
+        brew install --formula cmake
 
     - name: Configure CMake
       run: cmake -B ${{github.workspace}}/build -DCMAKE_BUILD_TYPE=${{ matrix.build_type }}
@@ -83,7 +83,7 @@ jobs:
     - name: Install dependencies
       run: |
         sudo apt-get update
-        sudo apt-get install -y libomp-dev cmake
+        sudo apt-get install -y cmake
 
     - name: Configure CMake with ASAN
       run: cmake -B ${{github.workspace}}/build -DCMAKE_BUILD_TYPE=ASAN

.github/workflows/python.yml

@@ -68,12 +68,12 @@ jobs:
       if: runner.os == 'Linux'
       run: |
         sudo apt-get update
-        sudo apt-get install -y libomp-dev cmake
+        sudo apt-get install -y cmake
 
     - name: Install system dependencies (macOS)
       if: runner.os == 'macOS'
       run: |
-        brew install libomp cmake
+        brew install cmake
 
     - name: Install Python dependencies
       run: |
@@ -116,12 +116,12 @@ jobs:
       if: runner.os == 'Linux'
       run: |
         sudo apt-get update
-        sudo apt-get install -y libomp-dev cmake
+        sudo apt-get install -y cmake
 
     - name: Install system dependencies (macOS)
       if: runner.os == 'macOS'
       run: |
-        brew install libomp cmake
+        brew install cmake
 
     - name: Install build dependencies
       run: |

.github/workflows/wheels.yml

@@ -59,10 +59,12 @@ jobs:
         CIBW_BUILD: cp39-* cp310-* cp311-* cp312-* cp313-*
         CIBW_SKIP: "*-win32 *-manylinux_i686 *-musllinux*"
         CIBW_ARCHS: ${{ matrix.cibw_archs }}
-        # Set minimum macOS version to match OpenMP requirements
+        # Disable OpenMP on macOS to avoid libomp.dylib conflicts
+        # Use built-in threadpool for parallelization instead
+        CIBW_CONFIG_SETTINGS_MACOS: >
+          cmake.args=-DUSE_OPENMP=OFF;-DUSE_THREADPOOL=ON
         CIBW_ENVIRONMENT_MACOS: >
           CMAKE_BUILD_PARALLEL_LEVEL=2
-          OMP_NUM_THREADS=1
           MACOSX_DEPLOYMENT_TARGET=14.0
           CMAKE_OSX_DEPLOYMENT_TARGET=14.0
 
@@ -75,15 +77,14 @@ jobs:
 
         # macOS specific settings  
         CIBW_BEFORE_ALL_MACOS: |
-          brew install --formula cmake libomp || echo "Dependencies may already be installed"
+          brew install --formula cmake || echo "cmake already installed"
         CIBW_REPAIR_WHEEL_COMMAND_MACOS: >
           delocate-wheel --require-archs {delocate_archs} -w {dest_dir} -v {wheel}
 
         # Environment variables for builds
         CIBW_ENVIRONMENT: >
           CMAKE_BUILD_PARALLEL_LEVEL=2
-          OMP_NUM_THREADS=1
-
+
         # Skip testing during wheel build to avoid cross-compilation issues
         CIBW_TEST_SKIP: "*"
 

.gitignore

@@ -419,3 +419,7 @@ callgrind.out.*
 *.large.fasta
 test_data/large/
 
+# Benchmark data (downloaded datasets + simulation results)
+benchmarks/data/
+benchmarks/results/
+

CMakeLists.txt

@@ -13,7 +13,7 @@ include(GenerateExportHeader)
 
 set(KALIGN_LIBRARY_VERSION_MAJOR 3)
 set(KALIGN_LIBRARY_VERSION_MINOR 5)
-set(KALIGN_LIBRARY_VERSION_PATCH 1)
+set(KALIGN_LIBRARY_VERSION_PATCH 2)
 set(KALIGN_LIBRARY_VERSION_STRING ${KALIGN_LIBRARY_VERSION_MAJOR}.${KALIGN_LIBRARY_VERSION_MINOR}.${KALIGN_LIBRARY_VERSION_PATCH})
 
 
@@ -61,14 +61,18 @@ include(GNUInstallDirs)
 include(CTest)
 include(CheckCSourceRuns)
 
-option(USE_OPENMP    "Use OpenMP for parallelization" ON)
+option(USE_OPENMP      "Use OpenMP for parallelization" OFF)
+option(USE_THREADPOOL  "Use built-in threadpool instead of OpenMP" ON)
 option(ENABLE_SSE    "Enable compile-time SSE4.1 support." ON)
 option(ENABLE_AVX    "Enable compile-time AVX support."    ON)
 option(ENABLE_AVX2   "Enable compile-time AVX2 support."   ON)
 
 # Performance tuning parameters
-set(KALIGN_ALN_SERIAL_THRESHOLD "250" CACHE STRING "Alignment positions threshold below which to use serial instead of parallel processing")
-set(KALIGN_KMEANS_UPGMA_THRESHOLD "50" CACHE STRING "Number of sequences threshold below which to use UPGMA instead of parallel k-means")
+# Threadpool parallelization thresholds (all settings in one place)
+set(KALIGN_ALN_SERIAL_THRESHOLD "500" CACHE STRING "Hirschberg DP width below which to run serial")
+set(KALIGN_KMEANS_UPGMA_THRESHOLD "50" CACHE STRING "Sequence count below which to use UPGMA instead of parallel k-means")
+set(KALIGN_DIST_MIN_SEQS "50" CACHE STRING "Minimum sequences to parallelize distance/anchor computations")
+set(KALIGN_PFOR_MIN_CHUNK "10" CACHE STRING "Minimum iterations per chunk in tp_parallel_for")
 
 # option(ENABLE_FMA    "Enable compile-time FMA support."    ON)
 # option(ENABLE_AVX512 "Enable compile-time AVX512 support." ON)
@@ -96,6 +100,20 @@ if(USE_OPENMP)
   endif(OPENMP_FOUND OR OpenMP_FOUND)
 endif(USE_OPENMP)
 
+# Built-in threadpool (alternative to OpenMP)
+if(USE_THREADPOOL)
+  if(USE_OPENMP AND (OPENMP_FOUND OR OpenMP_FOUND))
+    message(WARNING "Both USE_OPENMP and USE_THREADPOOL are ON. Threadpool takes precedence.")
+  endif()
+  find_package(Threads QUIET)
+  if(Threads_FOUND)
+    add_definitions(-DUSE_THREADPOOL)
+    message(STATUS "Built-in threadpool is enabled.")
+  else()
+    set(USE_THREADPOOL OFF)
+    message(STATUS "pthreads not found — falling back to serial execution.")
+  endif()
+endif()
 
 if (ENABLE_SSE)
   #
@@ -199,6 +217,8 @@ endif(HAVE_AVX2)
 # Add performance tuning parameters as compile definitions
 add_definitions(-DKALIGN_ALN_SERIAL_THRESHOLD=${KALIGN_ALN_SERIAL_THRESHOLD})
 add_definitions(-DKALIGN_KMEANS_UPGMA_THRESHOLD=${KALIGN_KMEANS_UPGMA_THRESHOLD})
+add_definitions(-DKALIGN_DIST_MIN_SEQS=${KALIGN_DIST_MIN_SEQS})
+add_definitions(-DKALIGN_PFOR_MIN_CHUNK=${KALIGN_PFOR_MIN_CHUNK})
 
 add_subdirectory(lib)
 add_subdirectory(src)
@@ -223,8 +243,10 @@ if(BUILD_PYTHON_MODULE)
         # Link against the static kalign library
         target_link_libraries(_core PRIVATE kalign_static)
 
-        # Link OpenMP if found
-        if(OpenMP_CXX_FOUND)
+        # Link OpenMP or threadpool
+        if(USE_THREADPOOL)
+            target_link_libraries(_core PRIVATE Threads::Threads)
+        elseif(OpenMP_CXX_FOUND)
             target_link_libraries(_core PRIVATE OpenMP::OpenMP_CXX)
         endif()
 

ChangeLog

@@ -1,4 +1,57 @@
-2026-02-27  Timo Lassmann  <timolassmann@icloud.com>
+2026-05-16  Timo Lassmann  <timolassmann@icloud.com>
+
+	* version 3.5.2 - Four-mode preset system, threadpool, hardening
+	Algorithm and presets
+	- Four mode presets stable for protein and nucleotide:
+	  fast, default, recall, accurate. Per-mode configurations
+	  derived by NSGA-III multi-objective optimisation on
+	  BAliBASE v4 (protein) and BRAliBASE (RNA).
+	- Unified nucleotide preset (DNA and RNA share one path).
+	- Ensemble alignment with POAR consensus and per-column /
+	  per-residue confidence scores.
+	- New --add mode: append sequences to an existing alignment.
+	- Sparse consistency-bonus matrix for large MSAs (avoids
+	  quadratic memory in column count).
+	- Removed deprecated 'precise' mode alias (Python only;
+	  never shipped as a wheel).
+
+	Parallelism
+	- Chase-Lev work-stealing thread pool is now the default
+	  parallelism backend; OpenMP is optional (USE_OPENMP=ON).
+	- macOS wheels no longer link libomp.dylib, resolving the
+	  conda-forge / numpy OpenMP runtime conflict.
+
+	Security / robustness
+	- POAR file parsing now rejects malformed inputs that would
+	  cause integer overflow in pair-count or per-pair entry
+	  count (lib/src/poar.c). Limited threat model (requires
+	  explicit --load-poar) but tightened anyway.
+	- finalise_alignment is now atomic w.r.t. msa->sequences:
+	  validates all per-sequence linear lengths before swapping
+	  any pointer, so a failure leaves the MSA unchanged.
+	- kalign_msa_compare wraps finalise_alignment in RUN(); a
+	  failure surfaces cleanly instead of producing a half-
+	  finalised MSA.
+	- DSSIM stress test now uses KALIGN_MATRIX_AUTO so it
+	  exercises both protein and DNA biotypes correctly.
+	- Bumped locked dependencies (cryptography, flask, werkzeug,
+	  pillow, pygments, pytest, urllib3, requests, mako, black)
+	  past their CVE fix versions.
+
+	Build / tooling
+	- build.zig updated for zig 0.16 (four cross-compile targets).
+	- tests/check-local.sh: one-command pre-push gate that runs
+	  zig build + native ctest + Linux ASAN container + pytest.
+	- Containerfile.memcheck (Ubuntu + ASAN + Valgrind) for local
+	  Linux memory-bug reproduction.
+	- Removed paper-side benchmark machinery, optimizer scripts,
+	  and design-rationale PRDs from the public tree (preserved
+	  in the manuscript repository for reproducibility).
+	- Cleaned up ~550 lines of dead code (coretralign,
+	  bitShiftRight256ymm, unused split() in bisectingKmeans).
+	- Build is now warning-free on clang and GCC.
+	- Dropped the broken benchmark CI workflow (BAliBASE download
+	  endpoint has been gone for months).
 
 	* version 3.5.1 - Bugfix release
 	- Fix memory leak in build_tree_from_pairwise (realign/ensemble)