From 4957e7c233bef0e8bb8dd0e8075c348117483752 Mon Sep 17 00:00:00 2001 From: blackax Date: Fri, 16 Oct 2026 11:31:11 -0700 Subject: [PATCH 1/2] fix(deps): lock pip-api 0.0.35 so pip-audit runs on Python 3.15 --- CHANGELOG.md | 4 ++++ uv.lock | 8 ++++---- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 42955ed..009e413 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 **Python 3.15 is supported and tested.** CI and the release gate now run the test suite on 3.15 alongside 3.11-3.14, and the wheel carries the 3.15 classifier. No code change was needed. The pinned `uv` moves from 0.12.10 to 0.13.1 in every workflow and the Dockerfile, because 0.12.10 only knows CPython 3.15.0rc2 — a 3.15 leg on it would have tested a release candidate while reporting 3.15. 0.13.1 rather than 0.13.0 because 0.13.0 regressed on extracting source distributions that contain hard links, and the 3.15 leg builds PyYAML from its sdist (6.0.3 ships no cp315 wheel). The container image stays on Python 3.14. +### Fixed + +**`uv run pip-audit` works on Python 3.15.** `pip-api` is locked at 0.0.35 instead of 0.0.34, whose vendored pyparsing imports `sre_constants`, a module 3.15 removed, so the audit gate crashed before scanning in a 3.15 dev environment. Since uv 0.13 made 3.15 its default download, a fresh `uv sync` can create exactly that environment. CI was not affected because its audit job runs on 3.13. The change is dev-only: `pip-api` comes in through `pip-audit`, and neither the wheel nor the image ships it. + ## [0.9.0] - 2026-09-30 > **Why 0.9.0 and not 0.8.2:** the `groups` fix under Fixed makes two configurations that started on 0.8.1 refuse to start, a string `groups` and an inline-table one, which is the test 0.8.0 recorded for taking the minor. The fix for both is a list: `groups = ["web"]`. diff --git a/uv.lock b/uv.lock index 78ba90e..a3aecec 100644 --- a/uv.lock +++ b/uv.lock @@ -1,5 +1,5 @@ version = 1 -revision = 3 +revision = 5 requires-python = ">=3.11" resolution-markers = [ "python_full_version >= '3.15'", @@ -1353,14 +1353,14 @@ wheels = [ [[package]] name = "pip-api" -version = "0.0.34" +version = "0.0.35" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "pip" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/b9/f1/ee85f8c7e82bccf90a3c7aad22863cc6e20057860a1361083cd2adacb92e/pip_api-0.0.34.tar.gz", hash = "sha256:9b75e958f14c5a2614bae415f2adf7eeb54d50a2cfbe7e24fd4826471bac3625", size = 123017, upload-time = "2024-07-09T20:32:30.641Z" } +sdist = { url = "https://files.pythonhosted.org/packages/fc/08/47dfc28aa16ef0dbc38dd7c6e4fe24d124c3ed3a722a4a3e5021584a588c/pip_api-0.0.35.tar.gz", hash = "sha256:14dea05d7b3b68f4c7582213e3ae8932bbba8e1f754bf06b95263d5fa6ab4363", size = 123884, upload-time = "2026-09-08T19:35:12.876Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/91/f7/ebf5003e1065fd00b4cbef53bf0a65c3d3e1b599b676d5383ccb7a8b88ba/pip_api-0.0.34-py3-none-any.whl", hash = "sha256:8b2d7d7c37f2447373aa2cf8b1f60a2f2b27a84e1e9e0294a3f6ef10eb3ba6bb", size = 120369, upload-time = "2024-07-09T20:32:29.099Z" }, + { url = "https://files.pythonhosted.org/packages/1d/2e/d424c5b5877be862dd9a2c8b7e9ddb13382bb25e132e6dd50cc09c0a7dde/pip_api-0.0.35-py3-none-any.whl", hash = "sha256:66990d0da25378555cbb538db79384bab92d4617c6350dfd7a2126ba2a3a9894", size = 123943, upload-time = "2026-09-08T19:35:11.537Z" }, ] [[package]] From b578656cb2078e03535a664b2d6284b4e9a5203c Mon Sep 17 00:00:00 2001 From: blackax Date: Fri, 16 Oct 2026 11:32:53 -0700 Subject: [PATCH 2/2] fix(deps): keep uv.lock at revision 3 (regenerate with pinned-era uv) --- uv.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/uv.lock b/uv.lock index a3aecec..5efd0e3 100644 --- a/uv.lock +++ b/uv.lock @@ -1,5 +1,5 @@ version = 1 -revision = 5 +revision = 3 requires-python = ">=3.11" resolution-markers = [ "python_full_version >= '3.15'",