v7.2.0

Note

7.2.0 is available on 🐍 PyPI and 🐙 GitHub.

• Breaking: the release-prep command is renamed prepare-release, matching the job, template, and PR branch it drives; its module moves to repomatic.prepare_release and its class becomes PrepareRelease.
• Breaking: the version-check command is renamed check-version.
• Breaking: the vulnerability audit domain moves from repomatic.uv into the new repomatic.vulnerable_deps module, which also absorbs repomatic.github.advisories.
• Breaking: repomatic.sponsor moves under repomatic.github.
• Breaking: the PR-body helpers (generate_pr_metadata_block, generate_refresh_tip, build_pr_body) now take their CI context as arguments; current_repo_url is removed.
• Breaking: build_expected_body moves from repomatic.github.release_sync to repomatic.changelog.
• Breaking: the five check_pat_* probe functions are replaced by the PAT_PERMISSION_PROBES table and probe_pat_permission.
• Breaking: the workflow generation API (generate_thin_caller, generate_workflow_header, generate_workflows) drops its legacy source_paths argument; pass a PathsSpec instead.
• Add cancel-runs: cancels a branch's in-progress and queued workflow runs, replacing the bash block in cancel-runs.yaml; run listings now paginate past the first page.
• Add [tool.repomatic] binaries.sync: set to false to stop the release pipeline from committing the binaries catalog and scan records to the default branch.
• Add sync-dep-sources, a fifth sync-deps updater: once the release named by a git-tracked dependency's .dev floor ships on PyPI, it drops the [tool.uv.sources] override, tightens the floor, and freezes the adopted release through the cooldown. Disable with [tool.repomatic] dep-sources.sync.
• Extract the setup guide, .gitignore generation, and Sphinx docs orchestration from the CLI module into new repomatic.setup_guide, repomatic.gitignore, and repomatic.docs modules.
• Dialect, ArchiveFormat, and WorkflowFormat now carry their dispatch as enum methods (serialize, extract, write_workflow).
• Consolidate the repomatic.deps_graph API around Subgraph and SubgraphKind types; the unused parse_bom_ref helper is removed.
• Rename cross-module internals to public names: COMPONENTS_BY_NAME, is_source_repo, format_released, format_upload_date, date_to_utc_cutoff.
• The sponsor-labeller job in labels.yaml is renamed sponsor-label, matching the CLI command it runs.
• Remove the dead get_default_repo and list_open_issues helpers and the unused REQUIRED_PAT_PERMISSIONS constant.
• update-deps-graph now keeps only directly-declared dependencies inside the --group and --extra boxes, renders transitive dependencies as plain ovals, and counts an extra's transitives as depth 2 under --level.
• The unsubscribe workflow's GraphQL phase now re-validates each item's staleness client-side and reports the items it holds back.
• The unsubscribe.yaml workflow now streams per-thread progress to the job log.
• Generated PR and issue bodies now use ## section headings, with Release notes nested as a ### subsection; release bodies embedded in dropdowns get their headings demoted below the per-version heading.
• Generated PR bodies drop the boilerplate Description section, and the Workflow metadata block becomes a compact list led by a Documentation link to the job's section of the workflows reference.
• The Cooldown bypasses PR section is now a single table: 🧹 cleared:, 📌 frozen:, and 🚧 unreleased: rows with a Held until expiry column.
• Diff tables label added and removed packages with 🆕 new: and 🗑️ removed: prefixes ahead of the version.
• sync-action-pins and sync-workflow-pins PR bodies now report an action or package pinned at several versions as a single row spanning from the oldest pin.
• The update-docs job now re-formats pyproject.toml files with pyproject-fmt after running the project's update script.
• GitHub Releases API reads now resolve their token like every other GitHub access (REPOMATIC_PAT first), instead of hitting the anonymous rate limit.
• PyPI, npm, and GitHub API lookups now retry once on a truncated response instead of crashing with IncompleteRead.
• The release freeze and unfreeze steps now cover .yml workflow files alongside .yaml.
• The gitignore.io template download now times out after 10 seconds instead of hanging on a stalled connection.
• Version bumps no longer overwrite the cff-version: schema field in citation.cff when it coincides with the package version.
• sync-action-pins no longer rewrites uses: pins inside files repomatic init deploys verbatim, like the publish-pypi composite action.
• The run typos guidance now recommends extend-ignore-re guards for encoded hashes and intentional-typo examples.
• Document the scan job contract and the release-lane direct-commit exception.
• Add test suites for the notification-unsubscribe engine and the repomatic.npm, repomatic.gitignore, and repomatic.docs modules; the setup-guide tests now run offline.

Full changelog: v7.1.0...v7.2.0