What's Changed
- Fix link formatting by @Xeforo in #1624
- CI: harden and modernise the GitHub Actions workflows (zizmor audit, Node 24, lint/build/docs jobs) by @Olegt0rr in #1908
- Add Claude Code GitHub Workflow by @JrooTJunior in #1940
- Fix exponential validation of nested RichText (#1925) by @JrooTJunior in #1934
- Add dependency resolution options to project dependency installation by @Olegt0rr in #1773
- Bump dependencies and GitHub Actions (batched Dependabot updates) by @JrooTJunior in #1945
- Bump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the github-actions group across 1 directory by @dependabot[bot] in #1946
- docs: add missing # to via-flags by @M1h4n1k in #1938
- fix: return False for non-ASCII hash in check_webapp_signature by @nvikou in #1904
- Detect async callable objects as awaitable handlers by @Sanjays2402 in #1858
- Fix UserContextMiddleware not resolving user for stopped_message_generation by @kurupdevs in #1923
- ci(claude): allow read-only git commands and fetch full history by @JrooTJunior in #1947
- Bump astral-sh/setup-uv from 10.2.0 to 10.3.0 in the github-actions group by @dependabot[bot] in #1952
- Add OSS Scanner build, threat model and security policy by @JrooTJunior in #1967
- Bump pymongo from 4.18.2 to 4.18.3 by @dependabot[bot] in #1969
- Bump certifi from 2026.4.22 to 2026.10.18 by @dependabot[bot] in #1968
- ci: gate Claude workflow to members, skip bot PRs in review, label uv security PRs by @JrooTJunior in #1970
- Bump the github-actions group across 1 directory with 2 updates by @dependabot[bot] in #1971
- Fix translation context for I18n subclasses by @troyan-dy in #1961
- fix(filters): reject invalid base64 deep-link payloads in CommandStart by @Enesuygurs in #1963
- Bump aiohttp, virtualenv and setuptools in uv.lock for security fixes by @JrooTJunior in #1973
- Potential fix for code scanning alert no. 1: Incomplete URL substring sanitization by @JrooTJunior in #1972
- Document polling shutdown on Windows by @troyan-dy in #1960
- Bump virtualenv from 21.14.9 to 21.14.13 in uv.lock by @JrooTJunior in #1975
- fix(utils): use hmac.compare_digest for Login Widget signature check by @iSlavok in #1939
- Fix InlineKeyboardBuilder.as_markup dropping options and type as_mark… by @sinnercode228 in #1954
- Avoid an unawaited update coroutine when limited polling is cancelled by @CLCK0622 in #1958
- Support Python 3.11–3.15: drop 3.10, add 3.15 by @JrooTJunior in #1976
- ci(changelog): read the skip news label from the API, not the event payload by @JrooTJunior in #1977
- Add tasks_shutdown_timeout to wait for running update handlers on polling shutdown by @sinnercode228 in #1956
- Escape link URLs and attribute values in text decorations by @JrooTJunior in #1979
- Added full support for the Bot API 10.4 by @JrooTJunior in #2004
- Bump dnspython from 2.9.0 to 2.9.2 by @dependabot[bot] in #2009
- Bump soupsieve from 2.9.2 to 4.0 by @dependabot[bot] in #2008
- Accept commands addressed to a bot's secondary username by @uburuntu in #1984
- Bump the github-actions group across 1 directory with 2 updates by @dependabot[bot] in #2010
- Keep explicit None in CallbackData optional fields with a default by @bardrop in #2007
- perf: keep UNSET stripping out of the inbound validation path by @Jahongir-Qurbonov in #1978
New Contributors
- @nvikou made their first contribution in #1904
- @Sanjays2402 made their first contribution in #1858
- @kurupdevs made their first contribution in #1923
- @troyan-dy made their first contribution in #1961
- @Enesuygurs made their first contribution in #1963
- @sinnercode228 made their first contribution in #1954
- @CLCK0622 made their first contribution in #1958
- @bardrop made their first contribution in #2007
- @Jahongir-Qurbonov made their first contribution in #1978
Full Changelog: v3.31.0...v3.32.0