v2026.10.17

• Nothing to act on. The code under src/ is v2026.10.8's, and
  griffe finds no break in the public API against that release. The tests,
  the tooling, the workflows and the contributor documents moved;
  CHANGELOG.md lists them.

v2026.10.8

• A mnemonic or passphrase holding a lone surrogate is no longer kept whole
  on the error
  (GHSA-qjpp-8mp6-7744).
  bip39.seed_from_mnemonic, and electrum's seed_from_mnemonic,
  version_from_mnemonic and entropy_from_mnemonic, kept the whole
  mnemonic or passphrase in a UnicodeEncodeError when it held a lone
  surrogate: 2026.10.2 in the refusal's __context__, 2026.9.29 as the error
  raised, which dispatch.seed_type_from_mnemonic and
  dispatch.all_seed_types_from_mnemonic raised too. Upgrade, and treat a
  mnemonic or passphrase that such an error may have recorded, in a log or an
  error report, as exposed.
• The attestation bundle is attached as v<version>.intoto.jsonl from
  v2026.10.2 on, where earlier releases attach
  v<version>.attestation.jsonl. A script that downloads it by name, or
  passes it to gh attestation verify --bundle, uses the new name.

v2026.10.2

• BIP39 refuses 512-bit entropy and 48-word mnemonics. Pass at most
  256 bits. Entropy over the largest size is refused rather than
  truncated, in every scheme.
• SLIP-0039 refuses master secrets over 64 bytes and shares over 59
  words. The specification sets no maximum, and 64 bytes is the largest
  BIP32 seed.
• Verifying a release's attestation names a new signer and the tag.
  gh attestation verify takes
  --signer-workflow btclib-org/.github/.github/workflows/reusable-build.yml@refs/heads/main
  and --source-ref refs/tags/v<version>; SECURITY.md has the command.
  Earlier releases keep reusable-attest.yml.
• WordLists.language_files holds each file name as a str. A
  pathlib.Path given to the constructor is stored as its str, where it
  was kept as given.

v2026.9.29

The first release of btclib-mnemonics: there is no earlier version of
it to upgrade from.

Coming from btclib_wallet.mnemonic, import the modules from
btclib_mnemonics instead: bip39, dispatch, electrum, entropy,
mnemonic and slip39 keep their names. What does not carry over, one
name at a time:

• btclib_wallet.mnemonic's own names -- WORDLISTS, BinStr,
  Entropy, Mnemonic, indexes_from_mnemonic,
  mnemonic_from_indexes, normalize_mnemonic and the three public
  entropy functions it re-exported, bin_str_entropy_from_random,
  bin_str_entropy_from_rolls and collect_rolls -- are not
  re-exported by btclib_mnemonics, whose root publishes its modules
  only: import each from the module that defines it, mnemonic or
  entropy. The other seven entropy functions it re-exported are
  private, each named below.
• bip39.mxprv_from_mnemonic is not here: derive the master key
  from bip39.seed_from_mnemonic's seed.
• electrum.mxprv_from_mnemonic is not here: derive the master key
  from electrum.seed_from_mnemonic's seed, a function new in this
  package, as the version electrum.version_from_mnemonic answers asks.
• electrum.old_master_pub_key_from_mnemonic is not here: take the
  public key of electrum.old_master_prv_key_from_mnemonic's private key,
  uncompressed and without its 04 prefix, the 128 hexadecimal digits an
  Electrum wallet file holds.
• slip39.mxprv_from_mnemonics is not here: derive the master key
  from slip39.master_secret_from_mnemonics's master secret.
• entropy.bin_str_entropy_from_bytes is private: pass the bytes to
  the scheme's mnemonic_from_entropy, which reads them.
• entropy.bin_str_entropy_from_entropy is private, for the same
  reason.
• entropy.bin_str_entropy_from_int is private, for the same reason.
• entropy.bin_str_entropy_from_str is private: pass the binary
  string itself.
• entropy.bin_str_entropy_from_wordlist_indexes is private: use
  mnemonic.mnemonic_from_indexes and the scheme's
  entropy_from_mnemonic.
• entropy.bytes_entropy_from_str is private: int(entropy, 2).to_bytes(len(entropy) // 8, "big") is the conversion.
• entropy.wordlist_indexes_from_bin_str_entropy is private: use the
  scheme's mnemonic_from_entropy and mnemonic.indexes_from_mnemonic.
• The exceptions are BTClibMnemonicsException,
  BTClibMnemonicsTypeError and BTClibMnemonicsValueError, not
  btclib's; each of the last two is also a TypeError or a ValueError.