v0.12.3

Maintenance patch. No runtime or user-facing change; the core install stays dependency-free.

Security

• Updated two transitive development dependencies carrying open advisories, clearing all six Dependabot alerts (4 high, 2 moderate):

  • sqlparse 0.5.5 → 0.6.0 — GHSA-prg7-hcfm-mfcr (ReDoS via dollar-quoted SQL literals), GHSA-pwgv-4x5q-6m9f, GHSA-f2ff-p2ww-7p4p, GHSA-3496-9g83-7v6x
  • pymdown-extensions 10.21.3 → 11.0.1 — GHSA-gm37-52c6-37mw, GHSA-9xwg-3r6f-jcx2

  No previous release was affected. erdify declares no runtime dependencies, and both packages are reached only through the development and documentation groups (sqlparse via django, pymdown-extensions via mkdocs-material). This hardens the development and CI toolchain only.

Changed

• Dependabot now holds freshly published versions back for 7 days (cooldown.default-days: 7 on every updates entry) before proposing a version update, giving the ecosystem and security researchers time to catch a compromised or broken release. Security updates are unaffected — cooldown applies to version updates only.
• Bumped CI actions to their latest majors: astral-sh/setup-uv 9.0.0 → 10.0.1, actions/configure-pages 5.0.0 → 6.0.0, actions/upload-pages-artifact 4.0.0 → 5.0.0, and actions/deploy-pages 4.0.5 → 5.0.0. Repository infrastructure only.

Full Changelog: v0.12.2...v0.12.3