Security
- #213 Fix ReDoS vulnerability in auth header parsing — replace regex-based
Authorizationheader parser with simple string splitting to prevent polynomial backtracking on crafted input
Added
- #212 Add type annotations to all source modules and ship PEP 561
py.typedmarker for downstream type checking - #212 Add Python 3.14 support
- #214 Automate PyPI publishing with GitHub Actions trusted publishing (OIDC, no API tokens needed)
Changed
- #206 Modernize project infrastructure:
- Replace black, flake8, and isort with ruff for linting and formatting
- Switch from
maketojustas the task runner - Migrate from
setup.py/MANIFEST.intopyproject.tomlwith Hatch build backend - Update CI test matrix: drop Django 5.0 (EOL), add Django 5.2 (LTS)
- Expand Dependabot to cover GitHub Actions and pip dependencies
- Modernize tests to use
pathlib; remove legacyruntests.pywrapper - Add test runner and ty type checker to pre-commit hooks
- #206 Fix storage check to handle
pathlib.Pathobjects forMEDIA_ROOTandWATCHMAN_STORAGE_PATH - #214 Read version dynamically from
watchman/__init__.pyvia Hatchling (eliminate duplication inpyproject.toml)