v7.4.0

Note

7.4.0 is available on 🐍 PyPI and 🐙 GitHub.

• Breaking: Regroup the internal module layout: the tool catalog to tool_registry.py, dep-report rendering to dep_report.py, labels to labels.py, bundled data to bundle.py, matrix axes to matrix_axes.py (formerly test_matrix.py), PR helpers to github/issue.py. Import paths change; the CLI surface does not.
• Breaking: Rename update-deps-graph to update-dep-graph across the CLI command, autofix job, PR branch, and body template, aligning with the dependency-graph config key. Close any open update-deps-graph pull request; the next run reopens it on the new branch.
• Breaking: repomatic init component selectors are now case-sensitive, validated by the same code path as the exclude and include configuration entries.
• Lower the compiled-binary OS floors: Linux glibc 2.28, built and self-tested in manylinux_2_28 containers (RHEL 8, Debian 10, Ubuntu 20.04 and later), and macOS 11.0 (Apple silicon) / 10.15 (Intel) via uv's embedded python-build-standalone interpreter.
• Enforce each binary's OS floor at build time: verify-binary parses ELF, Mach-O and PE headers natively and no longer needs exiftool.
• Keep tkinter and its Tcl/Tk stack out of compiled binaries via the new [tool.repomatic] nuitka.nofollow-imports setting (default ["tkinter"], set to [] to bundle it).
• Emit man pages for repomatic's own CLI on docs builds and attach a repomatic-manpages.tar.gz asset to each release.
• Add update-docs --check to report out-of-date self-updating content and exit non-zero without writing, for CI drift detection. The docs update script must accept its own --check flag to participate.
• Add a check_sha_pinning_required lint check and setup-guide step for GitHub's sha_pinning_required Actions setting, the platform-enforced backstop for action SHA pinning.
• Unify the lint-repo checks on one tri-state result protocol: skipped checks now print ℹ instead of a misleading ✓.
• Key the CI tool-binary caches on tool_registry.py instead of the whole runner module, so engine-only changes stop invalidating cached tools.
• Report sync-deps and update-checksums progress as a ✓/✘ trail with a running tally and a timed summary.
• Warn about unknown [tool.repomatic] keys once per project and process, instead of on every configuration re-load.
• Loosen the uv required-version pin to a lower bound (>=0.12), dropping the per-minor upper cap so uv can update across minors without a manual bump.
• Move the docs link checker from ubuntu-slim to ubuntu-24.04-arm: the crawl outgrew the slim runner's 15-minute job cap.
• Extend the bundled lychee configuration with generic excludes: GitHub issue-comment fragments, release binary downloads, and DOI-to-Zenodo redirects.
• Declare least-privilege permissions on the canonical release.yaml, clearing the workflow check_workflow_permissions lint.
• Extend the check_workflow_permissions lint to flag a reusable-workflow call inheriting an empty top-level permissions: {} without its own grants: the misconfiguration that aborts a run at startup.
• Block install-time scripts and apply the minimum-release-age cooldown on every npm install of awesome-lint, hardening both the runtime and CI-provisioning paths against supply-chain attacks.
• Surface uv audit's stderr when it exits without emitting JSON, replacing the bare produced no output error.
• Keep metadata from crashing when git refuses the repository (dubious ownership, unresolvable range): it now logs git's stderr and continues.
• Accept sur (macOS Big Sur, Homebrew's big_sur bottle tag) as a valid word in the bundled typos configuration, so fix-typos stops correcting it to sure.
• Document the minimum OS requirement of each binary target, and the distributions it opens execution to, in a new Minimum OS requirements section that downstream binaries pages link to.
• Document how to verify a downloaded binary's build-provenance attestation with gh attestation verify on the installation page.
• Order the installation docs' Python-compatibility table newest-first, so the latest release and Python version read from the upper-left.
• Rename the binaries page chart markers to binaries-chart/binaries-chart-end, aligning on click-extra's <!-- name --> / <!-- name-end --> marker grammar; pages carrying older markers are migrated on their next refresh.
• Fix the click-extra {matrix} directive link on the installation page, and realign page octicons with the sphinx-docs agent's extended icon registry.
• Emit an absolute og:image URL for social previews: ogp_site_url now backs ogp_image in the docs configuration.
• Pin the install guide's versioned CLI examples (pkg@X.Y.Z, pkg==X.Y.Z) to the release in the prepare-release freeze step.
• Direct the babysit-ci skill to announce its early exit and name the still-unverified release.yaml binary run, instead of stopping on a silent idle.
• Harden the repomatic-ship skill: forbid detached Monitor polling, read the whole unreleased changelog section at invocation, and align every convention description its docs pass corrects.
• Extend the sphinx-docs agent and sphinx-docs-sync skill: the {click:run} --version trap, thin-schema combined CLI page, Cloudflare-blocked intersphinx probes, mdformat seed-block collapse, plus release-asset, self-healing-marker, and linkcheck audit guards.
• Note in the repomatic-ship skill that changelog released sections are immutable, and that a workflow cache-key line-length fix cannot lift hashFiles() into a workflow-level env:.

Full changelog: v7.3.1...v7.4.0