Skip to content

v0.2.0

Choose a tag to compare

View all tags
@smoxy smoxy released this 03 Jun 18:43
v0.2.0
89dfd2c

telegram-menu-builder 0.2.0

This release fixes a critical correctness bug in async usage, hardens the
dependency posture, and adds a full documentation site, CI, and project tooling.

🐛 Fixed

  • Critical: callback data is no longer lost when a menu is built inside a running
    event loop. add_item() previously discarded the handler and parameters in async
    contexts (the normal Telegram-bot case), producing buttons with empty callback_data.
    Encoding is now deferred to build_async() so every item is encoded correctly.
  • MenuBuilder.build() now works when called inside a running event loop (it runs the
    async build on a short-lived worker thread) instead of raising RuntimeError. In async
    code, prefer await build_async().
  • add_submenu() no longer stores the non-serializable submenu builder in callback params;
    only a JSON-safe _submenu_id is stored, with the builder kept in an internal registry
    accessible via the new get_submenu().
  • __version__ is now single-sourced from package metadata (was hard-coded and drifted).
  • Hardened the deterministic dedup hash with hashlib.md5(..., usedforsecurity=False).

✨ Added

  • Exported the exception hierarchy (MenuBuilderError, EncodingError, DecodingError,
    StorageError, ValidationError) from the package root, plus MenuBuilder.get_submenu().
  • MkDocs Material documentation site (API reference, guides, security and
    dependency/CVE audit, Python-compatibility analysis).
  • Tests for the router, storage backends, type validators, and package metadata
    (coverage ~62% → ~90%).
  • CI workflow (ruff, black, mypy, pyright, pytest, pip-audit) on every push/PR, plus a
    docs-deploy workflow; SECURITY.md, Dependabot, and issue/PR templates.

🔧 Changed

  • Raised the pydantic floor to >=2.4 to exclude CVE-2024-3772 (ReDoS in pydantic
    email validation, fixed in 2.4.0). The library does not use email validation, so it was
    never exploitable here — this is defense-in-depth.
  • StorageStrategy now subclasses enum.StrEnum; refactored navigation buttons and
    MenuRouter.route() (no behavior change).

Full changelog: https://github.com/smoxy/telegram-menu-builder/blob/v0.2.0/CHANGELOG.md

Assets 2
Loading