0.103.0

This release adds optional declarative source: configuration for version discovery, downloads, and sdist creation.
See #1414.

This release adds optional source: configuration for version discovery, downloads, and sdist creation (#1414).

• Settings: Existing settings continue to work. Mixing source: with conflicting legacy resolver/download or variant prebuilt settings raises a validation error.
• Breaking Python API: sources.download_source() now returns DownloadedSource. Direct callers must use .path and can inspect .kind. Legacy plugin hooks can still return Path.
• API and CLI additions: Source preparation supports artifact kinds and Git checkouts. default_build_sdist() gains exclude_vcs, and step commands can report or accept source kind and path.
• Build orders: Regenerate retained build-order files when adopting or changing source configuration. build-sequence and download-sequence check the recorded source_provider; build-parallel does not yet.

What's Changed

• feat(packagesettings): activate source field and add source_resolver PBI property by @LalatenduMohanty in #1305
• feat(packagesettings): error when source and legacy settings are both set by @LalatenduMohanty in #1307
• Manual syning with main branch by @LalatenduMohanty in #1319
• Updating new-resolver-config branch by @LalatenduMohanty in #1323
• feat(resolver): dispatch configured source resolvers by @LalatenduMohanty in #1325
• fix(resolver): delegate hook source providers by @LalatenduMohanty in #1326
• Feat/1293 download dispatch by @LalatenduMohanty in #1338
• chore(sync): merge main into new-resolver-config by @LalatenduMohanty in #1367
• Feat/1331 typed download result by @LalatenduMohanty in #1344
• fix(packagesettings): reject cross-level (package level and variant level) settings conflicts for source by @smoparth in #1369
• fix(sources): honor resolver sdist build strategy by @jlarkin09 in #1385
• fix(sources): prepare Git checkouts by download kind by @smoparth in #1389
• fix(resolver): honor configured prebuilt wheel resolvers by @smoparth in #1393
• fix(wheels): reuse the exact wheel the local mirror serves by @LalatenduMohanty in #1398
• chore(sync): merge main into new-resolver-config by @LalatenduMohanty in #1399
• fix(resolver): let hook profiles set their own index URL by @LalatenduMohanty in #1405
• refactor(resolver): pass version and URL to source downloads by @LalatenduMohanty in #1406
• feat(resolver): let hook profiles work with only a download hook by @LalatenduMohanty in #1409
• fix(download-sequence): replay configured source downloads by @smoparth in #1410
• test(e2e): build packages with configured sources end to end by @LalatenduMohanty in #1412
• docs: target 0.103.0 in version notes by @LalatenduMohanty in #1415
• fix(find-updates): honor configured source resolvers by @jlarkin09 in #1408
• feat(list-overrides): surface source config in details output by @rd4398 in #1413
• test: fail on unexpected network access by @booxter in #1362
• build(deps): bump actions/setup-python from 7.0.0 to 7.1.0 by @dependabot[bot] in #1428
• fix(sources): exclude .git from configured tarball sdists by @LalatenduMohanty in #1417
• build(deps): bump pypa/gh-action-pypi-publish from 1.14.2 to 1.14.3 by @dependabot[bot] in #1427
• build(deps): bump the codeql group with 4 updates by @dependabot[bot] in #1426
• Sync/new resolver config from main 20261102 t131702 z by @LalatenduMohanty in #1429
• fix(build-sequence): validate recorded source providers by @smoparth in #1433
• fix(sources): reuse matching Git checkouts by @LalatenduMohanty in #1437
• fix(sources): save sdists with a standard filename by @LalatenduMohanty in #1438
• feat(package): honor configured source resolvers by @jenlevy in #1407
• fix(sources): canonicalize Git checkout paths by @smoparth in #1441
• fix: address follow-ups from the #1414 reviews by @LalatenduMohanty in #1449
• docs(resolver): improve architecture guide readability by @LalatenduMohanty in #1450
• fix(pkgmetadata): accept LicenseRef anywhere in SPDX expressions by @mprpic in #1452
• chore(sync): merge main into new-resolver-config by @LalatenduMohanty in #1454
• feat(resolver): add the declarative source: configuration by @LalatenduMohanty in #1414
• fix(sbom): use wheel version instead of resolved version in SBOM by @rd4398 in #1453
• fix(sbom): make package SPDX ids unique per document by @mprpic in #1455

Full Changelog: 0.102.0...0.103.0