v0.1.5

Security

• make vuln and the Security workflow now actually scan. uvx osv-scanner never resolved
  (osv-scanner is a Go binary, not on PyPI) and || true hid the failure, so no CI run had ever
  scanned uv.lock. make vuln now runs osv-scanner scan source --recursive . and fails on
  findings; fjacquet/ci v1.6.0 installs a pinned, checksum-verified binary in CI.
• Full uv lock --upgrade refresh (litellm 1.106.3 among others); no open advisory.

v0.1.4

Security

• pillow 12.3.0 → 13.0.0 for 41 advisories (5 critical, e.g. GHSA-w889-685w-c8fh and
  GHSA-v9pv-5gc8-w2m6: heap overflows and DoS in the TIFF, JPEG, FPX, PDF and GIF decoders).
• filelock → 4.2.4 for GHSA-v4x8-3wr5-3wq8 (High), GHSA-9vhv-jxww-xfm5 and GHSA-567q-5qvw-pf92,
  through a uv override-dependencies entry filelock>=4.2.1,<5: litellm caps filelock<4.
  Dependents use only FileLock, SoftFileLock, BaseFileLock and Timeout. Drop the override
  once litellm allows filelock 4.2.1.
• pypdf (11 advisories), aiohttp (8), virtualenv (12), certifi → 2026.10.23 for GHSA-6q48-6c7w-9gw2, opentelemetry-api → 1.45.1 for GHSA-xcq7-p3pf-p88h.
• nltk → 3.10.4 closes GHSA-8mgp-746c-j5xp (affected ≤ 3.10.3).

Changed

• Full uv lock --upgrade refresh, replacing the 2026-10-02 lock.
• The Security workflow now also runs on a weekly schedule and can be triggered manually.
• document-to-anki --version reads __version__ instead of a hard-coded string.

v0.1.2 — Dependency security bump

What's Changed

• feat(docs): publish docs to GitHub Pages (MkDocs Material) by @fjacquet in #9
• ci: standardize on fjacquet/ci@v1 by @fjacquet in #10
• chore: fleet health refresh by @fjacquet in #11
• docs(readme): add standard status badges by @fjacquet in #12
• Add generated brand icon by @fjacquet in #13
• chore(deps): full uv.lock upgrade — clear Dependabot alerts by @fjacquet in #14

Full Changelog: v0.1.1...v0.1.2

v0.1.1

Patch release: dependency hygiene.

Changes

• Pruned ~10 unused runtime dependencies (altair, blinker, cachetools, gitdb, ollama, streamlit, tornado, uritemplate, lint, and the conflicting docx twin of python-docx). numpy/openai dropped as direct deps — still resolved transitively, so pandas and OpenAI-model support are unchanged (#7).
• Consolidated the dev toolchain into a single source; removed the deprecated [tool.uv].dev-dependencies block (and its uv deprecation warning).

No behavior or API changes. Smaller install footprint and supply-chain surface.

Full suite green (463 tests, with and without .env); CI green on Python 3.12.

Artifacts

• document_to_anki_cli-0.1.1-py3-none-any.whl
• document_to_anki_cli-0.1.1.tar.gz

Full changelog: v0.1.0...v0.1.1

🤖 Generated with Claude Code

v0.1.0

Initial release of document-to-anki-cli — convert documents (PDF, DOCX, PPTX, TXT, MD, folders, ZIP) into Anki flashcards via LLM, with CLI and FastAPI web interfaces.

Highlights

• AI flashcard generation (Q/A + cloze) via litellm (Gemini default, OpenAI supported)
• Configurable output language (CARDLANG: en/fr/it/de), independent of source language
• Shared core behind both a CLI and a FastAPI web frontend

Notable in this release

• Web layer: shared components resolved behind web/dependencies.py reading app.state (single source of truth), fixing a session-manager dual-source-of-truth bug (#5).
• Test suite: decoupled from local .env so CI is deterministic (#6). Full suite green on CI (463 tests, ~12s, Python 3.12).

Artifacts

• document_to_anki_cli-0.1.0-py3-none-any.whl
• document_to_anki_cli-0.1.0.tar.gz

🤖 Generated with Claude Code