Split the version-substituted template reset out of fediverse-post into
a dedicated reset-release-notes recipe so it can run without posting.
fediverse-post now delegates the reset. Refs #40

@@ -15,6 +15,8 @@
 
 `zaojun` is a command-line (CLI) tool to check versions of your dependencies as defined in `pyproject.toml` against the latest versions published on [PyPI](https://pypi.org). Full documentation is available at [zaojun.marvin8.zone](https://zaojun.marvin8.zone/latest/).
 
+**New**: Constraint-range advisory scanning — zaojun checks the oldest version your constraint allows, not just the newest release. When that floor has known security advisories, the dependency line gains a 🚨 inline indicator and an `Advisories in declared range` block lists them with a suggested floor that clears every fixable advisory. One extra cached HTTP request per constrained package; `vuln-ignore` rules apply.

@@ -8,3 +10,4 @@
 
 ---
 
+zaojun's vulnerability feed only looked at the newest release on PyPI, so a constraint like `~=2.3` could look fully up to date while still admitting six known-vulnerable versions. zaojun now fetches the advisory list for each constraint's lower bound as well. Anything your range still allows shows up as a 🚨 warning inline plus an "Advisories in declared range" section, with a suggested floor that clears every fixable advisory — the exact gap that hid the httpx2 advisories from library-mode runs. Range warnings respect `vuln-ignore`, always set exit code 1, and are never silenced by `--library` or `--compat-ok`.

@@ -160,0 +165,4 @@
+package-level PyPI endpoint only lists advisories against the newest release, so a
+constraint like `~=2.3` can look fully up to date while still admitting known-vulnerable
+releases. zaojun therefore also fetches the version-level PyPI JSON response for each
+spec's lower bound (`>=`, `==`, `~=`) and reports advisories that affect it:

@@ -160,0 +179,4 @@
+```
+
+The 🚨 inline indicator is always shown (even in `--short` mode); the block follows the
+same suppression rules as `Vulnerabilities`. Advisories already reported against the

@@ -516,6 +547,8 @@ human-readable text. The JSON format is stable and suitable for scripting and CI
 
 `groups` is only present when `--groups` is used. `--short` has no effect in JSON mode.
 `vulnerabilities` is only present on records that have open (non-ignored) advisories.
+`range_vulnerabilities` and `suggested_floor` are only present on records whose

@@ -207,0 +217,4 @@
+            index_url=index_url,
+        )
+        latest_ids = {vuln.id for vuln in result.vulns} | {alias for vuln in result.vulns for alias in vuln.aliases}
+        result.range_vulns = [vuln for vuln in range_vulns if vuln.id not in latest_ids]

@@ -124,0 +176,4 @@
+        response = await client.get(f"{index_url.rstrip('/')}/{package_name}/{lower_bound}/json")
+        response.raise_for_status()
+        payload = response.json()
+    except (httpx2.HTTPStatusError, httpx2.RequestError, json.JSONDecodeError):

@@ -17,0 +32,4 @@
+    """
+    minima: list[Version] = []
+    for advisory in advisories:
+        parsed = [parse_version(v) for v in advisory.fixed_in]

@@ -88,0 +127,4 @@
+    """
+    if not result.range_vulns:
+        return
+    result.range_vulns = _filter_vulns(

@@ -15,6 +15,8 @@
 
 `zaojun` is a command-line (CLI) tool to check versions of your dependencies as defined in `pyproject.toml` against the latest versions published on [PyPI](https://pypi.org). Full documentation is available at [zaojun.marvin8.zone](https://zaojun.marvin8.zone/latest/).
 
+**New in v1.8.0**: Constraint-range advisory scanning — zaojun checks the oldest version your constraint allows, not just the newest release. When that floor has known security advisories, the dependency line gains a 🚨 inline indicator and an `Advisories in declared range` block lists them with a suggested floor that clears every fixable advisory. One extra cached HTTP request per constrained package; `vuln-ignore` rules apply. Range advisories set exit code 1 and are never silenced by `--library` or `--compat-ok`.

@@ -160,0 +168,4 @@
+lower bound and reports advisories that affect it. Only constraints that define a
+concrete allowed floor are scanned — `>=X.Y`, exact `==X.Y.Z`, and `~=X.Y` — because the
+bound version must itself be allowed by the constraint to be a meaningful floor.
+Constraints without one (e.g. `>2.3`, `==2.3.*`, `<2.0`) are not scanned.

@@ -160,0 +189,4 @@
+suggested floor is the highest per-advisory minimum `fixed_in` version; advisories
+without any listed fix cannot be cleared by a floor raise.
+
+A failed range fetch degrades to no advisories for that package and prints a warning to

@@ -4,10 +4,16 @@ visibility: public
 
 zaojun 1.7.5

@@ -160,0 +166,4 @@
+constraint like `~=2.3` can look fully up to date while still admitting known-vulnerable
+releases. zaojun therefore also fetches the version-level PyPI JSON response for the
+lower bound and reports advisories that affect it. Only constraints that resolve to a
+single concrete allowed version are scanned — `>=X.Y`, exact `==X.Y.Z`, and `~=X.Y`.

@@ -4,10 +4,16 @@ visibility: public
 
 zaojun 1.7.5
 
+- Constraint-range advisory scanning: zaojun now also checks the oldest version each constraint allows — 🚨 warns when your declared range still admits known-vulnerable releases, and suggests a floor that clears them

@@ -160,0 +193,4 @@
+A failed range fetch produces no advisories for that package and prints a warning to
+stderr — the degradation is never silent.
+
+Known limitation (documented): advisories introduced *after* the floor (affecting only

@@ -124,0 +174,4 @@
+            return _rebuild_advisories(cached.get("vulns") or [])
+
+    try:
+        response = await client.get(f"{index_url.rstrip('/')}/{package_name}/{lower_bound}/json")

@@ -124,0 +179,4 @@
+        payload = response.json()
+    except (httpx2.HTTPStatusError, httpx2.RequestError, json.JSONDecodeError) as exc:
+        print(
+            f"zaojun: range-advisory fetch for {package_name} {lower_bound} failed ({exc!r}) — scan degraded",

@@ -8,3 +10,4 @@
 
 ---
 
+zaojun's vulnerability feed only looked at the newest release on PyPI, so a constraint like `~=2.3` could look fully up to date while still admitting versions with six known advisories. zaojun now fetches the advisory list for each constraint's lower bound as well. Anything your range still allows shows up as a 🚨 warning inline plus an "Advisories in declared range" section, with a suggested floor that clears every fixable advisory — the exact gap that hid the httpx2 advisories from library-mode runs. Range warnings respect `vuln-ignore`, always set exit code 1, and are never silenced by `--library` or `--compat-ok`.