v1.0.0

Bug fixes

• Accept trailing slashes and the www.github.com host in verified release-note author links (#29) by @gaborbernat.
• Accept valid YAML comments and quoting in Knope changeset front matter during news validation (#29) by @gaborbernat.
• Apply one author credit to adjacent pull request references separated by whitespace or semicolons (#29) by @gaborbernat.
• Do not count reviewer mentions as pull request author credits (#29) by @gaborbernat.
• Escape URL punctuation when converting reStructuredText links to GitHub release Markdown (#29) by @gaborbernat.
• Finalize a CalVer prerelease in the current month before incrementing its patch number (#29) by @gaborbernat.
• Find the introducing commit for renamed fragments and fragments whose filenames contain non-ASCII characters (#29) by @gaborbernat.
• Identify fragment commits by full path so nested files with the same name cannot change pull request attribution (#29) by @gaborbernat.
• Ignore numeric fragments of unrelated bare URLs when checking release-note pull request credits (#29) by @gaborbernat.
• Ignore pull request references inside code when linking changelog fragments (#29) by @gaborbernat.
• Keep a numbered issue in a changelog entry when its digits only appear as the start of a longer pull request number (#29) by @gaborbernat.
• Keep direct dependencies in a flow-style list when a trailing comment contains the managed-pin marker (#29) by @gaborbernat.
• Keep fenced package headings inside their changelog section and reject unsupported pending fragment files in documentation previews (#29) by @gaborbernat.
• Keep generated hook dependency pins with a folded or literal dependency item when another YAML key follows it (#29) by @gaborbernat.
• Keep literal tildes in reStructuredText changelog entries when rendering GitHub Markdown (#29) by @gaborbernat.
• Leave fenced code examples unchanged when repairing Markdown release anchors (#29) by @gaborbernat.
• Match explicit GitHub author credits without case sensitivity and treat GitHub mannequin authors as unavailable accounts (#29) by @gaborbernat.
• Pin ranged and unpinned Python hook dependencies before they run in release preparation. Preserve the caller's version range across updates and reject YAML aliases that share an edited dependency list (#29) by @gaborbernat.
• Preserve comments on direct dependencies when updating a flow-style hook mapping (#29) by @gaborbernat.
• Preserve wrapped reStructuredText release notes and verify credits on short, repository-prefixed, and issue-form pull request links. Ignore pull request syntax inside code spans and blocks when checking credits (#29) by @gaborbernat.
• Reject misleading pull request labels and GitHub author links after resolving Markdown references and nested markup (#29) by @gaborbernat.
• Reject raw HTML hyperlinks in release entries so an @handle credit cannot point to another person (#29) by @gaborbernat.
• Reject release-note lines that embed markup inside a category anchor (#29) by @gaborbernat.
• Reject unsupported or empty changelog fragments in the pull request news check (#29) by @gaborbernat.
• Render package release anchors when the package name contains underscores (#29) by @gaborbernat.
• Require the merged pull request author in the fragment's author list; a later reviewer mention does not count as a credit (#29) by @gaborbernat.
• Rerun eligible hook cooldown checks daily so an unchanged bot update can become mergeable after seven days (#29) by @gaborbernat.
• Resolve Python hook dependencies for the manifest's language_version when the caller does not override it (#29) by @gaborbernat.
• Resolve hook dependencies from PyPI even when the caller sets uv or pip index and resolver environment variables (#29) by @gaborbernat.
• Stop package release notes at the next version anchor, even when the following heading is missing (#29) by @gaborbernat.

Breaking changes

• release-creator hooks now uses a seven-day package cutoff and each hook's configured Python version without --exclude-newer or --python-version options (#29) by @gaborbernat.

Security

• Ignore inherited SSL_CERT_DIR and SSL_CLIENT_CERT when resolving hook pins from PyPI (#29) by @gaborbernat.
• Reject YAML merge keys in hook definitions so shared dependencies cannot bypass exact pin updates (#29) by @gaborbernat.
• Reject duplicate pre-commit YAML keys so effective hook dependencies cannot bypass cooldown and pin updates (#29) by @gaborbernat.
• Reject repository-level YAML merge keys before refreshing hook pins, so a merged source cannot hide the hook package (#29) by @gaborbernat.

PyPI release

Full Changelog