Housekeeping. The tool itself is unchanged from 4.0.1 — upgrade only if the
PyPI page bothered you.
- The build badge is off the PyPI page. Its image is served live from the default
branch, so every version's page read out whatever master happened to be doing
that day: a red master put "build failing" on the page of a release that was
green when it was made. It stays on the README, where it tells a contributor
something true. - The test matrix no longer runs twice for every release. A tag push is a
push
event and the concurrency group is keyed on the ref, so the same commit was
tested once when it landed on master and again when it was tagged. - Some tests of
release.py's own printed output are gone. They asserted the
shape of strings a developer script prints, at the cost of a CI cycle whenever
anybody touched it.
If you are still on 4.0.0, upgrade. It has the command-injection bug fixed in
4.0.1 and has been removed from PyPI — see the
4.0.1 notes.