lib-cli-exit-tools 2.2.4__tar.gz → 2.3.1__tar.gz

{lib_cli_exit_tools-2.2.4 → lib_cli_exit_tools-2.3.1}/.codacy/cli.sh

@@ -1,6 +1,5 @@
 #!/usr/bin/env bash
 
-
 set -e +o pipefail
 
 # Set up paths first
@@ -11,15 +10,15 @@ os_name=$(uname)
 arch=$(uname -m)
 
 case "$arch" in
-"x86_64")
-  arch="amd64"
-  ;;
-"x86")
-  arch="386"
-  ;;
-"aarch64"|"arm64")
-  arch="arm64"
-  ;;
+    "x86_64")
+        arch="amd64"
+        ;;
+    "x86")
+        arch="386"
+        ;;
+    "aarch64" | "arm64")
+        arch="arm64"
+        ;;
 esac
 
 if [ -z "$CODACY_CLI_V2_TMP_FOLDER" ]; then
@@ -34,10 +33,10 @@ fi
 
 version_file="$CODACY_CLI_V2_TMP_FOLDER/version.yaml"
 
-
 get_version_from_yaml() {
     if [ -f "$version_file" ]; then
-        local version=$(grep -o 'version: *"[^"]*"' "$version_file" | cut -d'"' -f2)
+        local version
+        version=$(grep -o 'version: *"[^"]*"' "$version_file" | cut -d'"' -f2)
         if [ -n "$version" ]; then
             echo "$version"
             return 0
@@ -49,20 +48,24 @@ get_version_from_yaml() {
 get_latest_version() {
     local response
     if [ -n "$GH_TOKEN" ]; then
-        response=$(curl -Lq --header "Authorization: Bearer $GH_TOKEN" "https://api.github.com/repos/codacy/codacy-cli-v2/releases/latest" 2>/dev/null)
+        response=$(curl -Lq \
+            --header "Authorization: Bearer $GH_TOKEN" \
+            "https://api.github.com/repos/codacy/codacy-cli-v2/releases/latest" 2>/dev/null)
     else
-        response=$(curl -Lq "https://api.github.com/repos/codacy/codacy-cli-v2/releases/latest" 2>/dev/null)
+        response=$(curl -Lq \
+            "https://api.github.com/repos/codacy/codacy-cli-v2/releases/latest" 2>/dev/null)
     fi
 
     handle_rate_limit "$response"
-    local version=$(echo "$response" | grep -m 1 tag_name | cut -d'"' -f4)
+    local version
+    version=$(echo "$response" | grep -m 1 tag_name | cut -d'"' -f4)
     echo "$version"
 }
 
 handle_rate_limit() {
     local response="$1"
     if echo "$response" | grep -q "API rate limit exceeded"; then
-          fatal "Error: GitHub API rate limit exceeded. Please try again later"
+        fatal "Error: GitHub API rate limit exceeded. Please try again later"
     fi
 }
 
@@ -70,9 +73,9 @@ download_file() {
     local url="$1"
 
     echo "Downloading from URL: ${url}"
-    if command -v curl > /dev/null 2>&1; then
+    if command -v curl >/dev/null 2>&1; then
         curl -# -LS "$url" -O
-    elif command -v wget > /dev/null 2>&1; then
+    elif command -v wget >/dev/null 2>&1; then
         wget "$url"
     else
         fatal "Error: Could not find curl or wget, please install one."
@@ -83,7 +86,7 @@ download() {
     local url="$1"
     local output_folder="$2"
 
-    ( cd "$output_folder" && download_file "$url" )
+    (cd "$output_folder" && download_file "$url")
 }
 
 download_cli() {
@@ -95,7 +98,7 @@ download_cli() {
     local version="$3"
 
     if [ ! -f "$bin_path" ]; then
-        echo "📥 Downloading CLI version $version..."
+        echo "Downloading CLI version $version..."
 
         remote_file="codacy-cli-v2_${version}_${suffix}_${arch}.tar.gz"
         url="https://github.com/codacy/codacy-cli-v2/releases/download/${version}/${remote_file}"
@@ -107,16 +110,16 @@ download_cli() {
 
 # Warn if CODACY_CLI_V2_VERSION is set and update is requested
 if [ -n "$CODACY_CLI_V2_VERSION" ] && [ "$1" = "update" ]; then
-    echo "⚠️  Warning: Performing update with forced version $CODACY_CLI_V2_VERSION"
+    echo "Warning: Performing update with forced version $CODACY_CLI_V2_VERSION"
     echo "    Unset CODACY_CLI_V2_VERSION to use the latest version"
 fi
 
 # Ensure version.yaml exists and is up to date
 if [ ! -f "$version_file" ] || [ "$1" = "update" ]; then
-    echo "ℹ️  Fetching latest version..."
+    echo "Fetching latest version..."
     version=$(get_latest_version)
     mkdir -p "$CODACY_CLI_V2_TMP_FOLDER"
-    echo "version: \"$version\"" > "$version_file"
+    echo "version: \"$version\"" >"$version_file"
 fi
 
 # Set the version to use
@@ -126,7 +129,6 @@ else
     version=$(get_version_from_yaml)
 fi
 
-
 # Set up version-specific paths
 bin_folder="${CODACY_CLI_V2_TMP_FOLDER}/${version}"
 
@@ -146,4 +148,4 @@ if [ "$#" -eq 1 ] && [ "$1" = "download" ]; then
     echo "Codacy cli v2 download succeeded"
 else
     eval "$run_command $*"
-fi
+fi

lib_cli_exit_tools-2.3.1/.data_arch_violations.json

@@ -0,0 +1,38 @@
+{
+  "pass": 1,
+  "total_violations": 0,
+  "files": {
+    "src/lib_cli_exit_tools/core/configuration.py": {
+      "violations": [],
+      "status": "clean"
+    },
+    "src/lib_cli_exit_tools/core/exit_codes.py": {
+      "violations": [],
+      "status": "clean"
+    },
+    "src/lib_cli_exit_tools/application/runner.py": {
+      "violations": [],
+      "status": "clean"
+    },
+    "src/lib_cli_exit_tools/__init__.py": {
+      "violations": [],
+      "status": "clean"
+    },
+    "src/lib_cli_exit_tools/__init__conf__.py": {
+      "violations": [],
+      "status": "clean"
+    },
+    "src/lib_cli_exit_tools/cli.py": {
+      "violations": [],
+      "status": "clean"
+    },
+    "src/lib_cli_exit_tools/lib_cli_exit_tools.py": {
+      "violations": [],
+      "status": "clean"
+    },
+    "src/lib_cli_exit_tools/adapters/signals.py": {
+      "violations": [],
+      "status": "clean"
+    }
+  }
+}

lib_cli_exit_tools-2.3.1/.github/actions/extract-metadata/action.yml

@@ -0,0 +1,92 @@
+name: Extract project metadata
+description: >-
+  Parse pyproject.toml and expose project metadata as step outputs.
+  Requires Python to be available in the runner environment.
+  Auto-installs rtoml if not already present.
+
+outputs:
+  PACKAGE_MODULE:
+    description: Python-importable module name (underscored)
+    value: ${{ steps.meta.outputs.PACKAGE_MODULE }}
+  PROJECT_NAME:
+    description: Project name from pyproject.toml
+    value: ${{ steps.meta.outputs.PROJECT_NAME }}
+  CLI_BIN:
+    description: CLI entry-point binary name
+    value: ${{ steps.meta.outputs.CLI_BIN }}
+  SRC_PATH:
+    description: Source directory path (e.g. "src")
+    value: ${{ steps.meta.outputs.SRC_PATH }}
+  COV_FAIL_UNDER:
+    description: Minimum coverage percentage from tool.coverage.report.fail_under
+    value: ${{ steps.meta.outputs.COV_FAIL_UNDER }}
+  COV_REPORT_FILE:
+    description: Coverage report filename (e.g. "coverage.xml")
+    value: ${{ steps.meta.outputs.COV_REPORT_FILE }}
+  PYTEST_VERBOSITY:
+    description: Pytest verbosity flag (e.g. "-vv")
+    value: ${{ steps.meta.outputs.PYTEST_VERBOSITY }}
+  BANDIT_SKIP_FLAG:
+    description: Bandit skip flag string (e.g. "-s B101,B601") or empty
+    value: ${{ steps.meta.outputs.BANDIT_SKIP_FLAG }}
+
+runs:
+  using: composite
+  steps:
+    - name: Extract project metadata from pyproject.toml
+      id: meta
+      shell: python
+      run: |
+        import os, subprocess, sys
+        try:
+            import rtoml
+        except ModuleNotFoundError:
+            subprocess.check_call([sys.executable, "-m", "pip", "install", "rtoml", "-q"])
+            import rtoml
+
+        from pathlib import Path
+        data = rtoml.load(Path('pyproject.toml'))
+
+        # --- [project] section ---
+        project = data['project']['name']
+        module = project.replace('-', '_')
+        dash = project.replace('_', '-')
+        scripts = list(data['project'].get('scripts', {}).keys())
+        cli_bin = scripts[0] if scripts else dash
+
+        # --- [tool.scripts.test] section ---
+        scripts_test = data.get('tool', {}).get('scripts', {}).get('test', {})
+        src_path = scripts_test.get('src-path', 'src')
+        pytest_verbosity = scripts_test.get('pytest-verbosity', '-vv')
+        cov_report_file = scripts_test.get('coverage-report-file', 'coverage.xml')
+
+        # --- [tool.coverage.report] section ---
+        cov_fail_under = (
+            data.get('tool', {}).get('coverage', {}).get('report', {}).get('fail_under', 90)
+        )
+
+        # --- [tool.bandit] section ---
+        bandit_skips = data.get('tool', {}).get('bandit', {}).get('skips', [])
+        bandit_skip_flag = f"-s {','.join(bandit_skips)}" if bandit_skips else ""
+
+        # Write to GITHUB_OUTPUT for composite action outputs
+        with open(os.environ['GITHUB_OUTPUT'], 'a', encoding='utf-8') as out:
+            out.write(f"PROJECT_NAME={project}\n")
+            out.write(f"PACKAGE_MODULE={module}\n")
+            out.write(f"CLI_BIN={cli_bin}\n")
+            out.write(f"SRC_PATH={src_path}\n")
+            out.write(f"PYTEST_VERBOSITY={pytest_verbosity}\n")
+            out.write(f"COV_REPORT_FILE={cov_report_file}\n")
+            out.write(f"COV_FAIL_UNDER={cov_fail_under}\n")
+            out.write(f"BANDIT_SKIP_FLAG={bandit_skip_flag}\n")
+
+        # Also write to GITHUB_ENV so subsequent steps can use ${{ env.VAR }}
+        with open(os.environ['GITHUB_ENV'], 'a', encoding='utf-8') as env:
+            env.write(f"PROJECT_NAME={project}\n")
+            env.write(f"PACKAGE_MODULE={module}\n")
+            env.write(f"CLI_BIN={cli_bin}\n")
+            env.write(f"SRC_PATH={src_path}\n")
+            env.write(f"PYTEST_VERBOSITY={pytest_verbosity}\n")
+            env.write(f"COV_REPORT_FILE={cov_report_file}\n")
+            env.write(f"COV_FAIL_UNDER={cov_fail_under}\n")
+            env.write(f"BANDIT_SKIP_FLAG={bandit_skip_flag}\n")

{lib_cli_exit_tools-2.2.4 → lib_cli_exit_tools-2.3.1}/.github/workflows/default_cicd_public.yml

@@ -10,19 +10,61 @@ on:
     - cron: '17 3 * * *'
 
 jobs:
+  setup:
+    name: Extract Python versions and OS matrix from pyproject.toml
+    runs-on: ubuntu-latest
+    outputs:
+      python-versions: ${{ steps.metadata.outputs.python-versions }}
+      python-latest: ${{ steps.metadata.outputs.python-latest }}
+      os-matrix: ${{ steps.metadata.outputs.os-matrix }}
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.x"
+      - name: Parse pyproject.toml for Python versions and OS matrix
+        id: metadata
+        shell: python
+        run: |
+          import json, os, tomllib
+
+          with open("pyproject.toml", "rb") as f:
+              data = tomllib.load(f)
+
+          # Python versions from classifiers
+          classifiers = data.get("project", {}).get("classifiers", [])
+          prefix = "Programming Language :: Python :: "
+          versions = [
+              c[len(prefix):]
+              for c in classifiers
+              if c.startswith(prefix) and "." in c[len(prefix):]
+          ]
+          if not versions:
+              raise SystemExit("No Python X.Y versions found in classifiers")
+
+          # OS matrix from [tool.ci]
+          ci_config = data.get("tool", {}).get("ci", {})
+          os_list = ci_config.get("os", ["ubuntu-latest"])
+
+          with open(os.environ["GITHUB_OUTPUT"], "a") as fh:
+              fh.write(f"python-versions={json.dumps(versions)}\n")
+              fh.write(f"python-latest={versions[-1]}\n")
+              fh.write(f"os-matrix={json.dumps(os_list)}\n")
+
   test:
     name: Tests (Python ${{ matrix.python }}, ${{ matrix.os }})
+    needs: setup
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-        # Test against all supported Python versions (3.10+)
-        python: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+        os: ${{ fromJSON(needs.setup.outputs.os-matrix) }}
+        python: ${{ fromJSON(needs.setup.outputs.python-versions) }}
     env:
       PYO3_USE_ABI3_FORWARD_COMPATIBILITY: "1"
       PYTHONIOENCODING: "utf-8"
       UV_LINK_MODE: "copy"
+      UV_BREAK_SYSTEM_PACKAGES: "1"
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
@@ -34,51 +76,98 @@ jobs:
           enable-cache: true
           prune-cache: false
 
-      - name: Install tomli (Python < 3.11)
-        shell: bash
-        run: python -c "import tomllib" 2>/dev/null || uv pip install tomli --system
+      - name: Install bash 4+ on macOS
+        if: runner.os == 'macOS'
+        run: |
+          brew install bash
+          echo "$(brew --prefix)/bin" >> "$GITHUB_PATH"
 
       - name: Extract project metadata
+        id: metadata
+        uses: ./.github/actions/extract-metadata
+
+      - name: Install CI system dependencies (Ubuntu)
+        if: runner.os == 'Linux'
         shell: python
         run: |
-          import os
+          import subprocess
           try:
               import tomllib
           except ModuleNotFoundError:
-              import tomli as tomllib
-
-          with open('pyproject.toml', 'rb') as f:
+              import pip._vendor.tomli as tomllib
+          with open("pyproject.toml", "rb") as f:
               data = tomllib.load(f)
-          project = data['project']['name']
-          module = project.replace('-', '_')
-          dash = project.replace('_', '-')
-          scripts = list(data['project'].get('scripts', {}).keys())
-          cli_bin = scripts[0] if scripts else dash
-
-          with open(os.environ['GITHUB_ENV'], 'a', encoding='utf-8') as env:
-              env.write(f"PROJECT_NAME={project}\n")
-              env.write(f"PACKAGE_MODULE={module}\n")
-              env.write(f"CLI_BIN={cli_bin}\n")
-
-      - name: Install journald prerequisites
-        if: runner.os == 'Linux'
-        shell: bash
+          deps = data.get("tool", {}).get("ci", {}).get("system-dependencies-ubuntu", [])
+          if deps:
+              print(f"Installing system packages: {' '.join(deps)}")
+              subprocess.check_call(["sudo", "apt-get", "update"])
+              subprocess.check_call(["sudo", "apt-get", "install", "-y", *deps])
+          else:
+              print("No CI system dependencies configured for Ubuntu.")
+
+      - name: Install CI system dependencies (macOS)
+        if: runner.os == 'macOS'
+        shell: python
         run: |
-          sudo apt-get update
-          sudo apt-get install -y python3-systemd
+          import subprocess
+          try:
+              import tomllib
+          except ModuleNotFoundError:
+              import pip._vendor.tomli as tomllib
+          with open("pyproject.toml", "rb") as f:
+              data = tomllib.load(f)
+          deps = data.get("tool", {}).get("ci", {}).get("system-dependencies-macos", [])
+          if deps:
+              print(f"Installing system packages: {' '.join(deps)}")
+              subprocess.check_call(["brew", "install", *deps])
+          else:
+              print("No CI system dependencies configured for macOS.")
 
       - name: Install dev deps
         shell: bash
         run: |
           uv pip install -e .[dev] --system
 
-      - name: Install Windows Event Log prerequisites
+      - name: Install CI system dependencies (Windows/choco)
         if: runner.os == 'Windows'
-        shell: bash
+        shell: python
         run: |
-          uv pip install pywin32 --system
-
+          import subprocess
+          try:
+              import tomllib
+          except ModuleNotFoundError:
+              import pip._vendor.tomli as tomllib
+          with open("pyproject.toml", "rb") as f:
+              data = tomllib.load(f)
+          deps = data.get("tool", {}).get("ci", {}).get("system-dependencies-windows-choco", [])
+          if deps:
+              print(f"Installing choco packages: {' '.join(deps)}")
+              subprocess.check_call(["choco", "install", "-y", *deps])
+          else:
+              print("No CI choco dependencies configured for Windows.")
+
+      - name: Install CI pip dependencies (Windows)
+        if: runner.os == 'Windows'
+        shell: python
+        run: |
+          import subprocess
+          try:
+              import tomllib
+          except ModuleNotFoundError:
+              import pip._vendor.tomli as tomllib
+          with open("pyproject.toml", "rb") as f:
+              data = tomllib.load(f)
+          deps = data.get("tool", {}).get("ci", {}).get("system-dependencies-windows-pip", [])
+          if deps:
+              print(f"Installing pip packages: {' '.join(deps)}")
+              subprocess.check_call(["uv", "pip", "install", *deps, "--system"])
+          else:
+              print("No CI pip dependencies configured for Windows.")
+
+      # Self-hosted runners persist ruff cache via RUFF_CACHE_DIR volume mount,
+      # so actions/cache is only needed on GitHub-hosted runners.
       - name: Restore ruff cache
+        if: runner.environment == 'github-hosted'
         id: ruff-cache
         uses: actions/cache/restore@v5
         with:
@@ -93,8 +182,8 @@ jobs:
         continue-on-error: true
         shell: bash
         run: |
-          ruff check src tests notebooks
-          ruff format --check src tests notebooks
+          ruff check .
+          ruff format --check .
 
       - name: Run pyright (type check)
         id: pyright
@@ -108,7 +197,27 @@ jobs:
         shell: bash
         env:
           TEST_VERBOSE: "1"
-        run: pytest --cov=src --cov-report=term-missing --cov-report=xml
+          # Write coverage SQLite database to local disk — network mounts
+          # and stale journal files cause "database is locked" errors.
+          COVERAGE_FILE: "${{ runner.temp }}/.coverage"
+        run: >-
+          pytest -m "not local_only"
+          --cov=${{ env.SRC_PATH }}/${{ env.PACKAGE_MODULE }}
+          --cov-report=term-missing
+          --cov-report=xml:${{ env.COV_REPORT_FILE }}
+          --cov-fail-under=${{ env.COV_FAIL_UNDER }}
+          ${{ env.PYTEST_VERBOSITY }}
+
+      - name: Upload coverage to Codecov
+        if: >-
+          always()
+          && steps.pytest.outcome == 'success'
+          && matrix.os == 'ubuntu-latest'
+          && matrix.python == needs.setup.outputs.python-latest
+        uses: codecov/codecov-action@v6
+        with:
+          files: ${{ env.COV_REPORT_FILE }}
+          fail_ci_if_error: false
 
       - name: Run import-linter (architecture)
         id: importlinter
@@ -120,7 +229,7 @@ jobs:
         id: bandit
         continue-on-error: true
         shell: bash
-        run: bandit -q -r src/${{ env.PACKAGE_MODULE }}
+        run: bandit -q -c pyproject.toml -r ${{ env.SRC_PATH }}/${{ env.PACKAGE_MODULE }} ${{ env.BANDIT_SKIP_FLAG }}
 
       - name: Run pip-audit (vulnerability scan)
         id: pipaudit
@@ -128,12 +237,9 @@ jobs:
         shell: python
         run: |
           import subprocess, sys
-          try:
-              import tomllib
-          except ModuleNotFoundError:
-              import tomli as tomllib
-          with open("pyproject.toml", "rb") as f:
-              data = tomllib.load(f)
+          import rtoml
+          from pathlib import Path
+          data = rtoml.load(Path("pyproject.toml"))
           vulns = data.get("tool", {}).get("pip-audit", {}).get("ignore-vulns", [])
           cmd = ["pip-audit", "--skip-editable"]
           for v in vulns:
@@ -164,8 +270,7 @@ jobs:
             exit 1
           fi
           if [[ "${{ steps.pipaudit.outcome }}" != "success" ]]; then
-            echo "::error::pip-audit vulnerability scan failed"
-            exit 1
+            echo "::warning::pip-audit vulnerability scan failed"
           fi
           echo "All checks passed!"
 
@@ -187,7 +292,7 @@ jobs:
         run: uv cache prune --ci
 
       - name: Save ruff cache
-        if: always() && steps.ruff-cache.outputs.cache-hit != 'true'
+        if: always() && runner.environment == 'github-hosted' && steps.ruff-cache.outputs.cache-hit != 'true'
         uses: actions/cache/save@v5
         with:
           path: .ruff_cache
@@ -208,31 +313,9 @@ jobs:
           enable-cache: true
           prune-cache: false
 
-      - name: Install tomli (Python < 3.11)
-        shell: bash
-        run: python -c "import tomllib" 2>/dev/null || uv pip install tomli --system
-
       - name: Extract project metadata
-        shell: python
-        run: |
-          import os
-          try:
-              import tomllib
-          except ModuleNotFoundError:
-              import tomli as tomllib
-
-          with open('pyproject.toml', 'rb') as f:
-              data = tomllib.load(f)
-          project = data['project']['name']
-          module = project.replace('-', '_')
-          dash = project.replace('_', '-')
-          scripts = list(data['project'].get('scripts', {}).keys())
-          cli_bin = scripts[0] if scripts else dash
-
-          with open(os.environ['GITHUB_ENV'], 'a', encoding='utf-8') as env:
-              env.write(f"PROJECT_NAME={project}\n")
-              env.write(f"PACKAGE_MODULE={module}\n")
-              env.write(f"CLI_BIN={cli_bin}\n")
+        id: metadata
+        uses: ./.github/actions/extract-metadata
 
       - name: Build wheel
         run: uv build

{lib_cli_exit_tools-2.2.4 → lib_cli_exit_tools-2.3.1}/.github/workflows/default_release_public.yml

@@ -31,7 +31,7 @@ jobs:
         run: uv build
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: dist
           path: dist/*
@@ -56,7 +56,7 @@ jobs:
           fi
 
       - name: Download artifacts
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v8
         with:
           name: dist
           path: dist/

{lib_cli_exit_tools-2.2.4 → lib_cli_exit_tools-2.3.1}/.gitignore

@@ -179,3 +179,6 @@ poetry.lock
 pdm.lock
 uv.lock
 /.github_bak/
+prompts.md
+CLAUDE.md
+.claude/

{lib_cli_exit_tools-2.2.4 → lib_cli_exit_tools-2.3.1}/CHANGELOG.md

@@ -2,12 +2,40 @@
 
 All notable changes to this project are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [2.3.1] - 2026-04-24
+
+### Fixed
+- Replaced `Iterator[...]` with `Generator[...]` in return annotations of `@contextmanager`-decorated functions (`config_overrides`, `cli_session`, `_apply_overrides_without_restore`, `_temporary_rich_click_configuration`) to satisfy pyright 1.1.409's new deprecation check that was breaking CI.
+
+### Security
+- Refreshed pip-audit `ignore-vulns`: dropped entries whose packages are now at fixed versions; added dev/env-only exclusions for authlib (GHSA-jj8c-mmj3-mmgv), cryptography (CVE-2026-39892), lxml (CVE-2026-41066), Pillow (CVE-2026-40192), python-multipart (CVE-2026-40347), and uv (GHSA-pjjw-68hj-v9mw). None of these packages are runtime dependencies of `lib_cli_exit_tools`.
+
+### Changed
+- Bumped dev dependency minimums in `pyproject.toml` and refreshed the BMK Makefile wrapper to 2.9.1 (persistent `uv tool install`).
+
+## [2.3.0] - 2026-02-13
+
+### Added
+- `ExitCodeStyle` enum (`str, Enum`) replacing `Literal["errno", "sysexits"]` string literals, re-exported through the public API facade.
+- New `cli/` package structure splitting the monolithic `cli.py` into `group.py`, `commands.py`, and `styling.py` with backward-compatible re-exports.
+
+### Changed
+- Replaced `Mapping[str, object]` with typed `SessionOverrides` in `cli_session` and internal helpers for stricter type safety.
+- Removed `_CONFIG_TRACEBACK` / `_CONFIG_TRACEBACK_FORCE_COLOR` string constants in favour of direct `SessionOverrides` key access.
+- Migrated `scripts/` to external submodule; build automation now uses `uvx bmk`.
+- Updated GitHub Actions CI/CD workflows and removed legacy backup workflow files.
+
+### Security
+- Added CVE-2026-1703, CVE-2026-25990, and CVE-2026-26007 to pip-audit ignore list (transitive dev dependencies, not runtime).
 
 ## [2.2.4] - 2026-01-26
 
 ### Changed
 - Updated dependencies.
 - Excluded `scripts/` from pyright, pytest, and CI/CD test collection.
+- Ctrl-C in scripts now exits with code 130 (POSIX SIGINT convention) instead of Click's default exit code 1.
 
 ## [2.2.3] - 2025-12-17