v1.2.1

v1.2.1 (2026-03-09)

This release is published under the MIT License.

Bug Fixes

• repo: Update branch references to main (8de8ec6)

---

Detailed Changes: v1.2.0...v1.2.1

Verification

Release commit: 1c6ba4d24b003326cd85b523eb5acff82024b793

Artifact	SHA256	SPDX SBOM	Provenance	SBOM attestation
fastapi_paseto-1.2.1-py3-none-any.whl	5dfc6402a69144301e089b256d3cb1d8e2a95bda4dede4dd81b1ad15fa36c2f9	fastapi_paseto-1.2.1-py3-none-any.whl.spdx.json	build provenance	SBOM attestation
fastapi_paseto-1.2.1.tar.gz	d1659158d02bcafdf84a368038be2beedbfcf8962bf1d50287a2a7dfeb98c8bc	fastapi_paseto-1.2.1.tar.gz.spdx.json	build provenance	SBOM attestation

Release assets also include SHA256SUMS, fastapi_paseto-1.2.1-py3-none-any.whl.spdx.json, and fastapi_paseto-1.2.1.tar.gz.spdx.json.

gh release verify "v1.2.1" --repo "Raze-Systems/fastapi-paseto"
gh release verify-asset "v1.2.1" "./fastapi_paseto-1.2.1-py3-none-any.whl" --repo "Raze-Systems/fastapi-paseto"
gh release verify-asset "v1.2.1" "./fastapi_paseto-1.2.1.tar.gz" --repo "Raze-Systems/fastapi-paseto"
gh attestation verify "./fastapi_paseto-1.2.1-py3-none-any.whl" --repo "Raze-Systems/fastapi-paseto" --signer-workflow .github/workflows/release.yml
gh attestation verify "./fastapi_paseto-1.2.1-py3-none-any.whl" --repo "Raze-Systems/fastapi-paseto" --signer-workflow .github/workflows/release.yml --predicate-type https://spdx.dev/Document/v2.3

Install from Git with an immutable ref, not main. Example:

pip install "fastapi-paseto @ git+https://github.com/Raze-Systems/fastapi-paseto.git@v1.2.1"

pip and uv record VCS origin metadata in direct_url.json, but mutable branch installs cannot be strongly verified after the fact. Prefer a signed tag or commit hash and verify the matching release artifacts.