github-security-report 0.4.0__tar.gz → 0.4.1__tar.gz

{github_security_report-0.4.0 → github_security_report-0.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: github-security-report
-Version: 0.4.0
+Version: 0.4.1
 Summary: Security and quality reporting across GitHub organisations
 Project-URL: Homepage, https://github.com/lfreleng-actions/github-security-report-action
 Project-URL: Repository, https://github.com/lfreleng-actions/github-security-report-action
@@ -36,8 +36,8 @@ Requires-Dist: pytest-asyncio==1.4.0; extra == 'dev'
 Requires-Dist: pytest-cov==7.1.0; extra == 'dev'
 Requires-Dist: pytest==9.1.1; extra == 'dev'
 Requires-Dist: respx==0.23.1; extra == 'dev'
-Requires-Dist: ruff==0.15.18; extra == 'dev'
-Requires-Dist: syrupy==5.3.2; extra == 'dev'
+Requires-Dist: ruff==0.15.19; extra == 'dev'
+Requires-Dist: syrupy==5.3.3; extra == 'dev'
 Requires-Dist: types-jsonschema==4.26.0.20260518; extra == 'dev'
 Requires-Dist: types-pyyaml==6.0.12.20250915; extra == 'dev'
 Description-Content-Type: text/markdown

{github_security_report-0.4.0 → github_security_report-0.4.1}/pyproject.toml

@@ -63,9 +63,9 @@ dev = [
   "pytest-asyncio==1.4.0",
   "pytest-cov==7.1.0",
   "respx==0.23.1",
-  "syrupy==5.3.2",
+  "syrupy==5.3.3",
   "mypy==2.1.0",
-  "ruff==0.15.18",
+  "ruff==0.15.19",
   "types-jsonschema==4.26.0.20260518",
   "types-PyYAML==6.0.12.20250915",
 ]
@@ -95,26 +95,21 @@ dev = [
   "pytest-asyncio==1.4.0",
   "pytest-cov==7.1.0",
   "respx==0.23.1",
-  "syrupy==5.3.2",
+  "syrupy==5.3.3",
   "mypy==2.1.0",
-  "ruff==0.15.18",
+  "ruff==0.15.19",
   "types-jsonschema==4.26.0.20260518",
   "types-PyYAML==6.0.12.20250915",
 ]
 
-[tool.uv]
-# Supply-chain cooldown: refuse to resolve anything published in the last
-# 7 days, giving the community time to catch a compromised release.
-exclude-newer = "7 days"
-
 [tool.uv.pip]
 # Verify any per-package hashes that are present (e.g. when resolving the
 # locked dependencies). 'require-hashes' is deliberately NOT enabled: it would
 # demand a hash for every requirement including this project itself, which has
 # no hash when installed from source (uv pip install .[test,dev]), breaking the
 # editable/source installs the CI test and SBOM jobs rely on. Reproducibility
-# and supply-chain resistance come from the exact '==' pins, the 7-day
-# exclude-newer cooldown, and the hash-verified uv.lock consumed by uv sync.
+# and supply-chain resistance come from the exact '==' pins and the
+# hash-verified uv.lock consumed by uv sync.
 verify-hashes = true
 
 [tool.pytest.ini_options]

{github_security_report-0.4.0 → github_security_report-0.4.1}/src/github_security_report/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.4.0'
-__version_tuple__ = version_tuple = (0, 4, 0)
+__version__ = version = '0.4.1'
+__version_tuple__ = version_tuple = (0, 4, 1)
 
 __commit_id__ = commit_id = None