46 releases 48 tags

RSS feed

• 1.8.0 a82a919076

  Compare

  1.8.0 Stable

  marvin8 released this 2026-09-14 08:00:16 +00:00 | 0 commits to main since this release

  Signed by marvin8

  SSH key fingerprint: SHA256:cyGOzvyFNw+A8J/LVjRif8v3KZLo8seQDVZbk/IhNhI

  [1.8.0] - 2026-09-14

  • Constraint-range advisory scan refined: the lower-bound probe now snaps to the lowest allowed release, and advisories are deduplicated by ID and alias across probes

  Commits

  • correct minor things in justfile and Release-Notes.md and bump versions in .pre-commit-config.yaml 1a63d2e
  • 🔀 Merge branch 'feat/issue-42-probe-newest-allowed' 09dd542
  • 🐛 percent-encode package names and versions in PyPI URLs 8caf741
  • 📝 address wave-8 docs findings (version wording, dev-deps section) ab011a6
  • 📝 address wave-7 docs findings: version attribution and scan semantics 9ab3679
  • 📝 note that dev-dependency floor raises are fine in library mode dad7150
  • 📝 align README version and tighten range-scan docs 1f3ff4c
  • 🎨 extract probe selection helper to satisfy complexipy 81b4f05
  • 📝 document lowest-allowed probe and alias-aware dedupe ff1d4a0
  • 🐛 alias-aware advisory union and floor-version snap-to-release a4cde6b
  • ✅ use version-accurate fixtures in range-probe tests a94b037
  • 📝 restore wildcard-bound rationale and scope mid-range caveat e5d2356
  • ✅ assert checker threads releases_map into the range probe 1d13f9b
  • 📝 caveat the oldest-version claim and document min-age independence 31824ed
  • ✅ pin coincident-probe behaviour with request counts c1fcff6
  • ✨ probe the newest allowed version for range advisories 17a07c0
  • 🔀 Merge branch 'feat/issue-37-39-stage2-and-vuln-range' 3a30a26
  • 📝 scope the release-notes range-scan claim to the floor 3cbac0e
  • 🚨 redact exception detail from range-fetch warning f6f684f
  • 📝 restate range-scan criterion as inclusive lower bound 3438968
  • 📝 fix range-scan exclusion rationale and degradation wording e4f7553
  • 🐛 recompute range floor after suppression and warn on degraded scans 0148cdf
  • ✨ flag advisories within the declared constraint range 1dfc71e
  • ⬆️ bump deps 34e433c
  • ♻️ extract Release-Notes reset into its own just recipe 473bfbb

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• 1.7.5 21fed1ce06

  Compare

  1.7.5 Stable

  marvin8 released this 2026-08-29 21:47:00 +00:00 | 27 commits to main since this release

  Signed by marvin8

  SSH key fingerprint: SHA256:cyGOzvyFNw+A8J/LVjRif8v3KZLo8seQDVZbk/IhNhI

  [1.7.5] - 2026-08-30

  Commits

  • ⬆️ bump deps e3b0bea

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• 1.7.4 1d765f6412

  Compare

  1.7.4 Stable

  marvin8 released this 2026-08-18 07:56:56 +00:00 | 30 commits to main since this release

  Signed by marvin8

  SSH key fingerprint: SHA256:cyGOzvyFNw+A8J/LVjRif8v3KZLo8seQDVZbk/IhNhI

  [1.7.4] - 2026-08-18

  Commits

  • 🔀 Merge branch 'feat/issue-37-complete-stage2-migration' 40cae2c
  • 🔧 make zaojun in noxfile be a little more forgivin ff2248e
  • 🔧 fix copyright to reference zaojun and start at 2024 ec231c2
  • 🔥 remove stale ROADMAP.md and ROADMAP-detail.md 952d57b
  • 🔧 update remaining Codeberg references to forge.marvin8.zone d6df5d3
  • 🔧 bump dependencies and align pre-commit revs 68fa642

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• 1.7.3 76aa436c28

  Compare

  1.7.3 Stable

  marvin8 released this 2026-08-07 03:11:54 +00:00 | 38 commits to main since this release

  Signed by marvin8

  SSH key fingerprint: SHA256:cyGOzvyFNw+A8J/LVjRif8v3KZLo8seQDVZbk/IhNhI

  [1.7.3] - 2026-08-07

  • Moved the project repository from Codeberg to our own Forgejo instance at forge.marvin8.zone, seeking a home that welcomes AI-assisted development.

  Commits

  • 🔀 Merge branch 'feat/issue-35-migrate-to-forge' 6396c20
  • 🔧 normalize constraint-dependencies comment style ea3edfa
  • 📝 update release notes 1376a8a
  • 📝 add forge migration note to Release-Notes.md ec291d6
  • 🔒 fix h2 and pymdown-extensions vulnerabilities b75d476
  • ⬆️ bump dependencies e74590a
  • 🚚 migrate remotes and source refs to forge.marvin8.zone ca1044c

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• 1.7.2 b860791fc9

  Compare

  1.7.2 Stable

  marvin8 released this 2026-07-19 06:35:02 +00:00 | 47 commits to main since this release

  Signed by marvin8

  SSH key fingerprint: SHA256:cyGOzvyFNw+A8J/LVjRif8v3KZLo8seQDVZbk/IhNhI

  [1.7.2] - 2026-07-19

  • Pinned a minimum version of click in uv constraint-dependencies to close a HIGH-severity transitive vulnerability (PYSEC-2026-2132).

  Commits

  • 🔧 bump uv_build floor to 0.11 a1c208c
  • 🔧 use pytest-httpx2 in beta pytest session 337f32c
  • 🔧 raise ruff target-version to py311; apply UP017 and import-sort fixes d4d5580
  • 🔧 config hygiene: ruff-check hook id, gitleaks default config, editorconfig newline fix 4ad2308
  • 🔧 add Release-Notes.md.template and fediverse justfile recipes 2170fd3
  • 📝 consolidate agent instructions into AGENTS.md with CLAUDE.md symlink 4b10356
  • 📝 replace Woodpecker CI badge with Forgejo Actions, drop CodeLimit badge, point docs links at zaojun.marvin8.zone 023e85c
  • 👷 move CI to zhuiri runner, setup-uv action, checksum-verified gitleaks 20a261c
  • 🔧 pin click floor; bump deps and align pre-commit revs 53307bb

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• 1.7.1 f7f08d0e73

  Compare

  1.7.1 Stable

  marvin8 released this 2026-07-07 03:23:15 +00:00 | 58 commits to main since this release

  Signed by marvin8

  SSH key fingerprint: SHA256:cyGOzvyFNw+A8J/LVjRif8v3KZLo8seQDVZbk/IhNhI

  [1.7.1] - 2026-07-07

  • CI migrated from Woodpecker to Forgejo Actions; WuMing AI review broadened to six agents.
  • Documentation is now at zaojun.marvin8.zone — old Codeberg Pages links redirect automatically.
  • Release changelogs are now sourced from Release-Notes.md bullets; git-cliff removed.
  • Woodpecker CI pipelines removed.

  Commits

  • Merge branch 'feat/issue-31-forgejo-actions-migration' 7788c1e
  • 👷 consolidate ai-review and checks into ci.yml 6c3ac39
  • 📝 clean up Release-Notes.md — remove stale 1.7.0 prose fc178e7
  • 🔧 remove validating release notes 21eeef9
  • 👷 guard deploy-docs against non-semver workflow_dispatch 3abe565
  • 👷 remove Woodpecker CI pipelines 3f4b788
  • 🔧 remove git-cliff; generate changelog from Release-Notes.md 80d9b60
  • 📝 add grebedoc docs hosting and client-side redirect 58d1f09
  • 👷 migrate CI from Woodpecker to Forgejo Actions 979f7c5
  • 🔧 bump deps; fix ty errors and complexipy violation 8f767b6

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• 1.7.0 79c143b9ef

  Compare

  1.7.0 Stable

  marvin8 released this 2026-06-24 09:08:34 +00:00 | 70 commits to main since this release

  Signed by marvin8

  SSH key fingerprint: SHA256:cyGOzvyFNw+A8J/LVjRif8v3KZLo8seQDVZbk/IhNhI

  [1.7.0] - 2026-06-24

  Documentation

  • 📝 reset and update Release-Notes for aged-version-fallback commits
  • 📝 update Release-Notes for pre-release filtering
  • 📝 document aged-version fallback and pre-release filtering
  • 📝 update Release-Notes for init module split

  Features

  • ✨ add _spec_lower_bound helper
  • ✨ surface aged update candidate when latest is quarantined
  • ✨ show aged update candidate in text and json output
  • ✨ filter pre-release versions unless spec pins to a pre-release

  Refactoring

  • ♻️ replace get_latest_pypi_version 4-tuple with PyPIPackageData
  • ♻️ Moved publishing of release notes from CI to a just recipe
  • ♻️ extract models.py
  • ♻️ extract pypi.py
  • ♻️ extract version.py
  • ♻️ extract vulns.py
  • ♻️ extract render.py
  • ♻️ extract checker.py, thin init to CLI only
  • ♻️ convert relative imports to absolute

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• 1.6.1 f4cf0a9823

  Compare

  1.6.1 Stable

  marvin8 released this 2026-06-21 04:35:04 +00:00 | 95 commits to main since this release

  Signed by marvin8

  SSH key fingerprint: SHA256:cyGOzvyFNw+A8J/LVjRif8v3KZLo8seQDVZbk/IhNhI

  [1.6.1] - 2026-06-21

  Migrated from httpx to the actively maintained fork httpx2

  Bug Fixes

  • 🐛 address GHSA-4xgf-cpjx-pc3j and bump deps

  Documentation

  • 📝 update release notes for httpx2 migration
  • 📝 update release notes: remove stale license blurb, add WuMing review note

  Testing

  • ✅ migrate tests from pytest-httpx to pytest-httpx2

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• 1.6.0 9e702a01d2

  Compare

  1.6.0 Stable

  marvin8 released this 2026-06-07 06:25:42 +00:00 | 105 commits to main since this release

  Signed by marvin8

  SSH key fingerprint: SHA256:cyGOzvyFNw+A8J/LVjRif8v3KZLo8seQDVZbk/IhNhI

  [1.6.0] - 2026-06-07

  Bug Fixes

  • 🐛 parse SPDX OR/AND/WITH expressions in license compatibility check
  • 🐛 fix installing zaojun from local dir, instead of from pypi.org
  • 🐛 infer allowed dep set from compound project SPDX expressions

  Documentation

  • 📝 add license-checking docs page and update existing docs
  • 📝 rewrite release notes with thematic narrative for license checking
  • 📝 removed version number from first status
  • 📝 document compound SPDX expressions for project and dep licenses
  • 📝 link to SPDX license list in license-checking docs

  Features

  • ✨ add licenses module with SPDX extraction and tier inference
  • ✨ add license config keys to config.py
  • ✨ extract license from PyPI response and propagate to DependencyResult
  • ✨ wire license compliance checking into dependency processing and CLI
  • ✨ print detected project license and allowed set when using defaults

  Testing

  • ✅ add failing tests for license extraction and tier inference
  • ✅ add failing tests for new license config keys
  • ✅ add failing tests for license field in PyPI fetch and cache
  • ✅ add failing tests for license violation detection and output

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• 1.5.3 dd150e3222

  Compare

  1.5.3 Stable

  marvin8 released this 2026-05-23 01:59:47 +00:00 | 128 commits to main since this release

  Signed by marvin8

  SSH key fingerprint: SHA256:cyGOzvyFNw+A8J/LVjRif8v3KZLo8seQDVZbk/IhNhI

  [1.5.3] - 2026-05-23

  Documentation

  • 🔧 address pysentry vulnerabilities: idna, pymdown-extensions, markdown

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads