v0.1.0

Python 3.15 dependency findings now come from PyPI as it is today, not from a dated snapshot.

v0 flagged dependencies with a 3.15 cap or no cp315 wheel from a scan of PyPI's 3,000 most downloaded projects taken on 2026-10-11. Projects keep shipping 3.15 wheels and lifting caps: five days later, 14 of those rows were out of date (for example pymongo, hiredis and zope-interface now ship cp315 wheels, and modal and dspy now allow 3.15), so v0 reported them as risks when they were not.

• plan now re-reads PyPI for each dependency your repository declares that the snapshot flags, and drops the finding if it no longer holds. Only those public package names are sent to PyPI, never your other dependencies. Set FUTURECI_PYPI=off to skip the lookups.
• If PyPI cannot be read, the finding stays and says it comes from the 2026-10-11 snapshot.
• The re-read applies pip's rules for CPython 3.15 on Ubuntu 24.04 x86_64: a wheel counts only if one of its tags installs there, it is not yanked and its own requires-python admits 3.15.0 under PEP 440. When the latest release excludes 3.15, the finding names the release an unpinned pip install takes instead (PEP 440 order, final releases first, never a yanked file). A requires-python the check cannot decide, such as an invalid specifier, never drops a finding; the line says so.
• Nine snapshot rows were wrong from the start: wheels tagged py2.py3 or py3X with no ABI tag install on 3.15 (py-spy, libclang, clang-format, tbb, semgrep and others). They are corrected. Four rows had been counted as installable but only offer musllinux, PyPy or Python 2 wheels to 3.15 (lupa, lazy-object-proxy, langdetect, pure-sasl); they are now flagged.

To upgrade, pin the new commit SHA in both uses: and tool-ref.