v0.3.2

Fixes

• Expired sessions are detected correctly. For an expired session the portal answers with HTTP 200 and a JSON {"redirect": ".../user/login"} instead of an HTTP redirect. pyedookit used to report that as ParseError; it now raises SessionExpired, so callers refresh and retry.

Security

• Session validates the school subdomain when it's created, including in Session.from_json(). A tampered stored session can no longer send cookies to another host.
• Every hop of the login and refresh flow must be https on plus4u.net or edookit.net.
• repr(Session) no longer includes cookies or the CSRF token.
• Minimum versions raised to aiohttp>=3.14.3 and lxml>=6.1.0, which include their security fixes. yarl is now a declared dependency.

Changes

• Pages are parsed in a worker thread, so a large timetable doesn't block the event loop.
• EdookitClient without an http session now uses the same cookieless session as login().
• Removed the unused Student model.
• Ships py.typed. CI tests Python 3.12 and 3.14.