Commits on Aug 6, 2026

1. Harden PyPI install verification against stale cache (#102) …

   * fix(ci): refresh PyPI install verification
   
   * fix(ci): extend PyPI verify budget to 30 minutes and log index staleness
   
   Match the socket-python-cli release workflow hardening (PR #290 there):
   the 2026-08-05 propagation delay exceeded 10 minutes from the release
   runner's vantage point, so extend the retry budget to 30 minutes, and
   log when the JSON API already has the version but the Simple index does
   not, making CDN propagation delay distinguishable from a failed publish
   in the logs.
   
   Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
   Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
   
   * Trim release-specific details from verify step comment
   
   Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
   Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
   
   ---------
   
   Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
   Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

   

   lelia and claude authored Aug 6, 2026
   Configuration menu

   • View commit details
   • Copy full SHA for 04d2c0b
   • Browse repository at this point

   Copy the full SHA

   04d2c0b View commit details

   Browse the repository at this point in the history

2. Bound runtime dependency ranges and pin build backend (#103) …

   * Bound runtime dependency ranges and pin build backend
   
   Add version bounds to the runtime dependencies: requests was fully
   unbounded and typing-extensions had no upper bound, so a fresh install
   could resolve either to any just-published release. As a library,
   socketdev declares bounded ranges rather than exact pins - exact pins
   in package metadata would conflict with consumers that pin their own
   dependencies, including socket-python-cli, which pins its entire
   runtime closure (socketsecurity 2.5.10+) and relies on this package's
   ranges staying compatible.
   
   Floors match the versions already resolved and tested in uv.lock;
   ceilings exclude the next major. Also pins the hatchling build backend
   used for sdist builds. Dependabot (uv ecosystem, 7-day cooldown)
   already keeps the lockfile fresh within these bounds.
   
   Companion to the socket-python-cli dependency pinning work (CE-359).
   
   Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
   Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
   
   * Add CHANGELOG.md
   
   Seed a changelog in the socket-python-cli format, starting at 3.4.3,
   with a pointer to GitHub releases for earlier history.
   
   Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
   Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
   
   * Backfill changelog from GitHub release notes
   
   Import all 53 published releases (v1.0.15 through v3.4.2) from the
   auto-generated GitHub release notes: one dated entry per version,
   pre-releases labeled, body headings demoted one level so version
   headings stay the top-level structure.
   
   Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
   Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
   
   * Bump version to 3.5.0
   
   The new requests floor is a newly binding constraint for consumers on
   older versions, so this warrants a minor bump rather than a patch.
   
   Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
   Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
   
   * Fix static project version and use a Python 3.9-compatible hatchling
   
   The [project] version in pyproject.toml is static ([tool.hatch.version]
   is only consulted when version is declared dynamic), so bumping
   version.py alone left the packaging metadata and uv.lock at 3.4.2.
   Set the static version to 3.5.0 to match.
   
   Pin hatchling to 1.27.0 instead of 1.31.0: 1.28+ requires Python 3.10,
   while this package's requires-python still includes 3.9, so the newer
   pin would break sdist builds on 3.9.
   
   Addresses PR#103 review findings.
   
   Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
   Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
   
   * Declare the version dynamic so version.py is the single source of truth
   
   Per review on PR#103: with dynamic = ["version"], hatchling reads
   socketdev/version.py (the file version-check.yml already validates),
   so packaging metadata can never drift from the checked version again.
   
   Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
   Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
   
   ---------
   
   Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
   Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

   

   lelia and claude authored Aug 6, 2026
   Configuration menu

   • View commit details
   • Copy full SHA for 6b855d3
   • Browse repository at this point

   Copy the full SHA

   6b855d3 View commit details

   Browse the repository at this point in the history