Release v0.2.1 - #5
Merged
Merged
Conversation
v0.2.0 was tagged and published at 07:48Z on 2026-07-26; the audit fixes merged at 17:10Z the same day. The published PyPI package and GHCR image therefore ship without them, including the one high-severity finding: a non-loopback bind had no authentication at all. v0.2.1 exists to get those fixes to anyone who installed v0.2.0. No code changes beyond the version bump. CHANGELOG documents what e596a04 actually changed, which that commit did not record. create_app reads __version__ instead of repeating the literal, so a release bumps four files rather than five.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
v0.2.0was tagged and published at 07:48Z on 2026-07-26. The audit-fix PR #4 merged at 17:10Z the same day. The tag points atb98fe7b, so the published PyPI package and GHCR image do not contain those fixes — including the one high-severity finding: binding a non-loopback host (--host 0.0.0.0, the Docker demo) had no authentication at all.v0.2.1 exists to get those fixes to anyone who installed v0.2.0.
What's in it
No new code. Version bump plus the CHANGELOG entry that e596a04 never wrote:
pyproject.toml,uv.lock,src/dreamloop/__init__.py,tests/test_packaging_release.py→0.2.1create_appnow reads__version__instead of repeating the literal, so a release bumps four files rather than fiveCHANGELOG.mddocuments the audit fixes under## v0.2.1, grouped Security / Data safety / FixesTest plan
uv run --extra dev pytest -q— 212 passeduv lock --checkcleanv0.2.1Release, which fires the PyPI and Docker workflowspip install dreamloop==0.2.1andghcr.io/saime428/dreamloop:0.2.1