v1.0.4 - 2026-07-22

[1.0.4] - 2026-07-22

Changed

• SHA-pinned every GitHub Action reference across all three workflow files (validate.yml,
  lint.yml, release.yml), including home-assistant/actions/hassfest@master and
  hacs/action@main, which were floating branch refs that Dependabot's github-actions
  ecosystem could never version-bump at all. Both actions' release tags are years stale
  (hassfest: 1.0.0 from 2020; hacs/action: 22.5.0 from 2022), so both are pinned to their
  current default-branch HEAD commit instead, with an inline comment documenting the pin date
  and reason. Also bumped astral-sh/ruff-action (v3 → v4.1.0) and astral-sh/setup-uv
  (already SHA-pinned, but to a stale v8.3.2 → v9.0.0) to their current major releases, and
  SHA-pinned actions/checkout and softprops/action-gh-release to their current tags.
  Resolves #72.
• Removed the requires-python = "...,<3.15" and josepy<3.0.0 upper-bound constraints from
  pyproject.toml. Verified empirically that removing the Python ceiling doesn't reintroduce
  the resolution forking this project has fought before — no package in the dependency tree
  publishes anything Python-3.15-specific yet, so uv lock still resolves to a single,
  unforked graph. The josepy ceiling was already redundant: hass-nabucasa (pulled in by
  homeassistant) declares its own josepy<3,>=2 constraint, so removing our copy avoids
  needing to remember to raise it later.
• Moved the devcontainer's .venv off the bind-mounted workspace folder (which is bridged from
  the Windows host via 9p, a filesystem protocol poorly suited to many-small-file workloads)
  onto the container's own native filesystem (/home/dev/.venv), matching the pattern in
  home-assistant/core's own Dockerfile.dev. A uv sync that previously took over 22 minutes
  now completes in seconds.

---

[1.0.3] - 2026-07-22

Added

• Diagnostics now include a capped sample of actual offer data alongside the existing
  offer_counts_by_platform: sample_offers (flat, first 10 across all platforms) and
  sample_offers_by_platform (first 3 per platform, guarding against the flat list starving out
  a platform whose feed happens to iterate after others with more offers). Every GameOffer
  field is public promotional metadata from the feed — reviewed field-by-field, nothing
  personally identifiable, so no redaction was needed (documented inline in diagnostics.py).
  Added a json.dumps(result) regression test to catch a non-serialisable value before it could
  reach a user's downloaded diagnostics file. Resolves #71.