v0.3.0 — conformance completion and attribution correction

See CHANGELOG.md for the full entry.

Breaking

• A comma is required between adjacent version specifiers. foo (>=1.0<2.0) and foo>=1.0<2.0 no longer parse. Previously they did, and re-rendered with a comma the input never contained, turning urllib3 (>=1.26<2.0) into urllib3>=1.26,<2.0 and fabricating a constraint boundary from malformed input. 756 of 2,804,135 distinct requirement strings in a production PyPI snapshot were affected. Arbitrary equality (===) is unchanged.
• An empty specifier set admits every version, where it previously matched none. PEP 508 makes a version specifier optional and an omitted one accepts any version. Only a deliberately constructed or zero-valued Specifiers can reach this; no input string produces one.
• An all-digit local version segment normalizes as an integer, so 1.0+007 renders as 1.0+7. Ordering is unaffected. What changes is the rendered string, and therefore === matching.

Notes

NOTICE now credits the Python pkginfo package and pypa/twine, whose material distribution/ ports and which were uncredited through v0.2.0; records that pypa/packaging is dual-licensed Apache-2.0 or two-clause BSD; and deletes a stale claim that no source from the cited projects was incorporated. Redistributors of v0.2.0 or earlier should take the NOTICE from this release. No code changed.

A note on v0.2.0

The three breaking changes above were documented under 0.2.0 until 2026-08-07, on the mistaken belief that its tag had not yet been cut. It had, on 2026-08-03. v0.2.0 does not contain them. The changelog is now accurate for both releases.