ghostpkg 0.24.2__tar.gz → 0.24.3__tar.gz

{ghostpkg-0.24.2 → ghostpkg-0.24.3}/.pre-commit-hooks.yaml

@@ -2,7 +2,7 @@
 #
 #   repos:
 #     - repo: https://github.com/M1rwana12/ghostpkg
-#       rev: v0.24.0
+#       rev: v0.24.3
 #       hooks:
 #         - id: ghostpkg
 #

{ghostpkg-0.24.2 → ghostpkg-0.24.3}/CHANGELOG.md

@@ -6,6 +6,21 @@ this project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.24.3] - 2026-09-04
+
+### Fixed
+- **The documented snippets pinned `@v0.24.0`, two releases behind.** Each
+  release script replaced the *previous* version string, so a snippet already
+  left on an older one was never touched again. The GitHub Marketplace listing
+  renders that snippet, so it told people to pin a version predating the fixes
+  it advertises.
+
+  Replacement is now by pattern rather than by exact previous string, and a
+  test fails if any documented pin disagrees with `__version__` -- with a
+  second test guarding against the patterns silently matching nothing.
+
+711 tests.
+
 ## [0.24.2] - 2026-09-04
 
 ### Changed
@@ -1015,7 +1030,8 @@ First release.
 - No corpus of hallucinated package names is shipped, following the decision of
   the USENIX'25 authors not to publish theirs.
 
-[Unreleased]: https://github.com/M1rwana12/ghostpkg/compare/v0.24.2...HEAD
+[Unreleased]: https://github.com/M1rwana12/ghostpkg/compare/v0.24.3...HEAD
+[0.24.3]: https://github.com/M1rwana12/ghostpkg/releases/tag/v0.24.3
 [0.24.2]: https://github.com/M1rwana12/ghostpkg/releases/tag/v0.24.2
 [0.24.1]: https://github.com/M1rwana12/ghostpkg/releases/tag/v0.24.1
 [0.24.0]: https://github.com/M1rwana12/ghostpkg/releases/tag/v0.24.0

{ghostpkg-0.24.2 → ghostpkg-0.24.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ghostpkg
-Version: 0.24.2
+Version: 0.24.3
 Summary: Catch package names that do not exist before you install them
 Project-URL: Homepage, https://github.com/m1rwana12/ghostpkg
 Project-URL: Issues, https://github.com/m1rwana12/ghostpkg/issues
@@ -445,7 +445,7 @@ length, and only applies to packages young enough to plausibly be a squat.
 ### In CI
 
 ```yaml
-- uses: M1rwana12/ghostpkg@v0.24.0
+- uses: M1rwana12/ghostpkg@v0.24.3
 ```
 
 That is the whole step. It searches the checkout, skips `node_modules` and
@@ -476,7 +476,7 @@ Or without the action, if you prefer:
 ```yaml
 repos:
   - repo: https://github.com/M1rwana12/ghostpkg
-    rev: v0.24.0
+    rev: v0.24.3
     hooks:
       - id: ghostpkg
 ```

{ghostpkg-0.24.2 → ghostpkg-0.24.3}/README.en.md

@@ -397,7 +397,7 @@ length, and only applies to packages young enough to plausibly be a squat.
 ### In CI
 
 ```yaml
-- uses: M1rwana12/ghostpkg@v0.24.0
+- uses: M1rwana12/ghostpkg@v0.24.3
 ```
 
 That is the whole step. It searches the checkout, skips `node_modules` and
@@ -428,7 +428,7 @@ Or without the action, if you prefer:
 ```yaml
 repos:
   - repo: https://github.com/M1rwana12/ghostpkg
-    rev: v0.24.0
+    rev: v0.24.3
     hooks:
       - id: ghostpkg
 ```

{ghostpkg-0.24.2 → ghostpkg-0.24.3}/README.md

@@ -194,7 +194,7 @@ ghostpkg scan ../інший-проєкт
 ### У CI
 
 ```yaml
-- uses: M1rwana12/ghostpkg@v0.24.0
+- uses: M1rwana12/ghostpkg@v0.24.3
 ```
 
 Це весь крок. Він шукає маніфести в чекауті, обходить `node_modules` і подібні
@@ -218,7 +218,7 @@ ghostpkg scan ../інший-проєкт
 ```yaml
 repos:
   - repo: https://github.com/M1rwana12/ghostpkg
-    rev: v0.24.0
+    rev: v0.24.3
     hooks:
       - id: ghostpkg
 ```

{ghostpkg-0.24.2 → ghostpkg-0.24.3}/ghostpkg/__init__.py

@@ -1,6 +1,6 @@
 """ghostpkg -- catch package names that do not exist before you install them."""
 
-__version__ = "0.24.2"
+__version__ = "0.24.3"
 
 from .assess import Finding, Verdict, assess
 from .registries import PackageFacts, RegistryError, fetch

{ghostpkg-0.24.2 → ghostpkg-0.24.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ghostpkg"
-version = "0.24.2"
+version = "0.24.3"
 description = "Catch package names that do not exist before you install them"
 readme = "README.en.md"  # English page for PyPI; the repo main page is Ukrainian
 requires-python = ">=3.9"

{ghostpkg-0.24.2 → ghostpkg-0.24.3}/tests/test_action.py

@@ -189,3 +189,30 @@ class TestTheHookIsWellFormed:
     )
     def test_unrelated_files_are_not_matched(self, path):
         assert not re.search(hook()["files"], path)
+
+
+class TestTheDocumentedVersionIsTheRealOne:
+    """Every release script replaced the *previous* version string, so a
+    snippet left on an older one was never touched again. `README.md` sat on
+    `@v0.24.0` through two releases, and the GitHub Marketplace renders that
+    snippet -- so the listing told people to pin a version that predates the
+    fixes it advertises."""
+
+    @pytest.mark.parametrize(
+        "path", ["README.md", "README.en.md", ".pre-commit-hooks.yaml"]
+    )
+    def test_every_pinned_version_matches_the_package(self, path):
+        from ghostpkg import __version__
+
+        text = read(ROOT / path)
+        pinned = set(re.findall(r"M1rwana12/ghostpkg@v([0-9.]+)", text))
+        pinned |= set(re.findall(r"rev: v([0-9.]+)", text))
+        assert pinned <= {__version__}, f"{path} pins {pinned}, package is {__version__}"
+
+    def test_at_least_one_snippet_is_pinned(self):
+        """A guard on the guard: if the patterns stop matching, the test above
+        passes for the wrong reason."""
+        from ghostpkg import __version__
+
+        text = read(ROOT / "README.en.md") + read(ROOT / "README.md")
+        assert f"M1rwana12/ghostpkg@v{__version__}" in text