v3.1.0

Fix release. Service registration no longer depends on a package servicekit does not declare, HTTP clients stop trusting the compromised eMudhra intermediate CAs, and the ruff security rules are now enforced on the codebase. No API changes.

Fixed

• api/registration.py and the readiness probe in api/service_builder.py imported httpx, but servicekit declares httpx2. Plain httpx was only installed through the fastapi[standard] extra, so a service installed without that extra failed with an ImportError when registering with an orchestrator. Both now use the declared httpx2. (#51)
• certifi in the lockfile is upgraded to 2026.10.19, which drops the eight eMudhra intermediate CA certificates whose private keys are recoverable (CLIM-1546). certifi stays a transitive dependency, so the constraint is unchanged; reinstall or uv lock --upgrade-package certifi in your service to pick it up. The example Dockerfiles now build with uv:0.13-python3.13-trixie-slim. (#50)
• The readiness probe now only skips a candidate port on httpx.TransportError (refused or timed-out connections) instead of any exception, so unexpected errors surface instead of being retried silently until the timeout. (#51)
• A failed WAL checkpoint in SqliteDatabase.dispose() is now logged as a database.wal_checkpoint_failed warning instead of being swallowed. Dispose still completes. (#51)

Changed

• The ruff S (flake8-bandit) rules are enabled for the whole repository (CLIM-1536). This affects contributors only, not the installed package.

Upgrading

• No code changes needed. If your service pins certifi through its own lockfile, upgrade it as described above.

What's Changed

• chore: bump version to 3.1.0.dev0 by @mortenoh in #49
• fix: upgrade certifi and uv image (CLIM-1546) by @mortenoh in #50
• chore: enable ruff security rules and use declared httpx2 (CLIM-1536) by @mortenoh in #51
• chore: release 3.1.0 by @mortenoh in #52

Full Changelog: v3.0.1...v3.1.0