v1.3.0

v1.3.0 (2026-03-10)

This release is published under the MIT License.

Documentation

• docs: Align documentation with current implementation (d5a0705)

Features

• auth: Align paseto support with footer and assertion features (3d3cf84)

---

Detailed Changes: v1.2.2...v1.3.0

Verification

Release commit: b95ffa971cbc6f13a6c3eef51341e81fb197d2c0

Artifact	SHA256	SPDX SBOM	Provenance	SBOM attestation
fastapi_paseto-1.3.0-py3-none-any.whl	6f988b2b7e2d9be38775b81740b1835f50de337f7c9d415884e649881d096732	fastapi_paseto-1.3.0-py3-none-any.whl.spdx.json	build provenance	SBOM attestation
fastapi_paseto-1.3.0.tar.gz	17397cdf51155dd18a018563603f4f51a0db03227595a5847ca01238c50aba94	fastapi_paseto-1.3.0.tar.gz.spdx.json	build provenance	SBOM attestation

Release assets also include SHA256SUMS, fastapi_paseto-1.3.0-py3-none-any.whl.spdx.json, and fastapi_paseto-1.3.0.tar.gz.spdx.json.

gh release verify "v1.3.0" --repo "Raze-Systems/fastapi-paseto"
gh release verify-asset "v1.3.0" "./fastapi_paseto-1.3.0-py3-none-any.whl" --repo "Raze-Systems/fastapi-paseto"
gh release verify-asset "v1.3.0" "./fastapi_paseto-1.3.0.tar.gz" --repo "Raze-Systems/fastapi-paseto"
gh attestation verify "./fastapi_paseto-1.3.0-py3-none-any.whl" --repo "Raze-Systems/fastapi-paseto" --signer-workflow .github/workflows/release.yml
gh attestation verify "./fastapi_paseto-1.3.0-py3-none-any.whl" --repo "Raze-Systems/fastapi-paseto" --signer-workflow .github/workflows/release.yml --predicate-type https://spdx.dev/Document/v2.3

Install from Git with an immutable ref, not main. Example:

pip install "fastapi-paseto @ git+https://github.com/Raze-Systems/fastapi-paseto.git@v1.3.0"

pip and uv record VCS origin metadata in direct_url.json, but mutable branch installs cannot be strongly verified after the fact. Prefer a signed tag or commit hash and verify the matching release artifacts.