chore: mark package version as in-development (0.1.0.dev0) - #116
Merged
Conversation
…eleased CHANGELOG pyproject.toml declared a bare "0.1.0" that read as a shipped release, but the CHANGELOG keeps 0.1.0 under [Unreleased] (with a dated note that the tag was never cut) and no v0.1.0 git tag exists. Change the version to the PEP 440 developmental release "0.1.0.dev0" so the single source of version truth reflects the true, not-yet-released state and agrees with the changelog and the (absent) tag. No release is finalized: the CHANGELOG stays Unreleased and the release workflow still bumps this to the final 0.1.0 when the signed v0.1.0 tag ships. (cherry picked from commit 1746c9532708eadb749beba83b9f2f72b1828149) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CQxMdBhpKxXg57SBgC8nUQ
CI runs uv with --locked, so the lockfile's recorded project version must move with pyproject. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CQxMdBhpKxXg57SBgC8nUQ
The 0.1.0.dev0 CI run surfaced a real vulnerability, not a version-string issue: pip-audit, OSV-Scanner, and Trivy all flagged cryptography==49.0.0 (pinned via the `<50` cap) for CVE-2026-69247 / PYSEC-2026-3552 (HIGH, CVSS 8.2, fixed in 50.0.0). Widen the cap to `<51` and re-lock. The identity vault, backup, and replication modules only touch the long-stable Fernet and Scrypt APIs; full local verification after the bump: lint, format, mypy, and the full test suite (1020 passed) all green, plus pip-audit and osv-scanner locally report no known vulnerabilities. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RwvFhZbxJZZn4bpejFu3Vj
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
pyproject.toml declared a bare
0.1.0that read as a shipped release, but the CHANGELOG keeps 0.1.0 under[Unreleased]and nov0.1.0git tag exists. This sets the version to the PEP 440 developmental release0.1.0.dev0so the single source of version truth matches the changelog and the (absent) tag. The release workflow still bumps this to the final0.1.0when the signedv0.1.0tag ships.One-file change (cherry-picked from local commit
1746c95, rebased cleanly ontoorigin/main).Verification (offline gates, all green):
lint,type,test(1020 passed),i18n,accessibility,claims,hygiene,secret-scan(gitleaks: no leaks),workflow-lint(zizmor: no findings). Skipped locally as network-dependent:audit(pip-audit) andosv— CI is the gate of record for those.🤖 Generated with Claude Code
https://claude.ai/code/session_01CQxMdBhpKxXg57SBgC8nUQ