v0.4.23

0.4.23 — 2026-06-30

Upgrade notes for admins

• Rebuild images after pulling: docker compose up -d --build. The backend image
  now installs Python dependencies with uv from the committed uv.lock
  instead of pip; a normal rebuild picks this up. No migrations, no new runtime
  env vars.
• Contributors: local setup is now uv sync --all-extras (install
  uv first) rather than pip install -e ".[…]",
  and checks run via uv run …. See .github/CONTRIBUTING.md.

Changed

• Adopted uv as the project's package manager so the backend has the same
  lockfile guarantee the frontend already has with npm: pyproject.toml +
  uv.lock + a lockfile-enforced install. The Docker build and every CI job now
  install via uv sync --locked (the npm ci analogue — the build fails if
  uv.lock has drifted from pyproject.toml), and the lint job runs an explicit
  uv lock --check drift gate.
• Pre-commit now runs the backend Python hooks (ruff, mypy, pyrefly, pytest)
  through uv run --no-sync against the locked .venv, replacing the
  separately-pinned ruff-pre-commit repo and the bare .venv/bin / pyrefly
  entries. Pre-commit and CI therefore use the exact same lockfile-resolved tool
  versions (no ruff version drift between local commits and CI).
• Moved dev dependencies from [project.optional-dependencies] to PEP 735
  [dependency-groups]: installed by default with uv sync, excluded from the
  production image via uv sync --no-dev (mirrors npm devDependencies).
• Rewrote the backend Dockerfile to copy uv from the official pinned image and
  do a cached two-phase sync (deps without the project, then the project), with
  the synced /app/.venv on PATH.
• CI now provisions Python via astral-sh/setup-uv (pinned uv 0.9.28) on Python
  3.12 — matching the runtime image — and runs the tools through uv run.
• Updated contributor/setup docs (.github/CONTRIBUTING.md, project CLAUDE.md)
  from pip to uv, and fixed a stale web/ → backend/ path in the checks list.

Fixed

• Regenerated uv.lock, which was incomplete (missing freezegun,
  model-bakery, pytest-django, pytest-mock) because nothing had ever
  installed from it. It is now the enforced source of truth.