lib-shopware6-api-base 6.0.2__tar.gz → 6.0.3__tar.gz

{lib_shopware6_api_base-6.0.2 → lib_shopware6_api_base-6.0.3}/.github/workflows/cicd_docker.yml

@@ -24,7 +24,7 @@ jobs:
       PYTHONIOENCODING: "utf-8"
       UV_LINK_MODE: "copy"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python }}
@@ -62,7 +62,7 @@ jobs:
 
       - name: Restore ruff cache
         id: ruff-cache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
         with:
           path: .ruff_cache
           key: ruff-${{ runner.os }}-py${{ matrix.python }}-${{ github.sha }}
@@ -190,7 +190,7 @@ jobs:
 
       - name: Save ruff cache
         if: always() && steps.ruff-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@v5
+        uses: actions/cache/save@v6
         with:
           path: .ruff_cache
           key: ruff-${{ runner.os }}-py${{ matrix.python }}-${{ github.sha }}
@@ -199,7 +199,7 @@ jobs:
     name: pipx/uv verification (ubuntu)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: "3.14"
@@ -242,7 +242,7 @@ jobs:
     name: Execute notebooks (ubuntu, Python 3.14)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: "3.14"
@@ -304,7 +304,7 @@ jobs:
       PYTHONIOENCODING: "utf-8"
       UV_LINK_MODE: "copy"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python }}

{lib_shopware6_api_base-6.0.2 → lib_shopware6_api_base-6.0.3}/.github/workflows/codeql-analysis.yml

@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4

{lib_shopware6_api_base-6.0.2 → lib_shopware6_api_base-6.0.3}/.github/workflows/default_release_public.yml

@@ -16,7 +16,7 @@ jobs:
     env:
       UV_LINK_MODE: "copy"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: '3.14'

{lib_shopware6_api_base-6.0.2 → lib_shopware6_api_base-6.0.3}/.gitignore

@@ -187,3 +187,8 @@ uv.lock
 CLAUDE.md
 prompts.md
 .grimp_cache/
+
+# Local, per-developer settings (Claude Code etc.) - never commit
+*.local.json
+# bitranox curated memory (local; CLAUDE.local.md @imports it)
+CLAUDE.local.md

{lib_shopware6_api_base-6.0.2 → lib_shopware6_api_base-6.0.3}/CHANGELOG.md

@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [6.0.3] 2026-07-14 11:12:29
+
+### Fixed
+- Green pip-audit gate again. The nightly CI run failed on `click` 8.2.1 (CVE-2026-7246 / PYSEC-2026-2132), a command injection in `click.edit()` fixed in click 8.3.3. This was a dev-toolchain exposure only: `click.edit()` is never called here and `click` is a dev/CLI transitive, so installs of this library already resolved a safe `click`. No action is required from users.
+
+### Removed
+- `codecov-cli` from the `dev` extra. It requires `click<8.3.0`, and since nothing else caps `click`, it alone held the dev environment on the vulnerable 8.2.1; `click` now resolves to 8.4.2. The dependency is left commented out in `pyproject.toml` with the reason inline, to be restored once codecov-cli relaxes the pin. Coverage upload is unaffected: CI uses `codecov/codecov-action`, and `bmk codecov` resolves `codecovcli` from PATH.
+
+### Changed
+- Bumped dependency floors: `httpx2>=2.5.0`, `lib_layered_config>=5.6.0`, `hatchling>=1.31.0`, plus dev tooling (`pytest>=9.1.1`, `ruff>=0.15.21`, `pyright>=1.1.411`, `hypothesis>=6.156.6`, `build>=1.5.1`, `textual>=8.2.8`, `import-linter>=2.13`, `virtualenv>=21.6.1`, `pip-audit>=2.10.1`).
+
 ## [6.0.2] 2026-06-14
 
 ### Changed

{lib_shopware6_api_base-6.0.2 → lib_shopware6_api_base-6.0.3}/Makefile

@@ -1,4 +1,4 @@
-# BMK MAKEFILE 2.9.4
+# BMK MAKEFILE 3.1.7
 # do not alter this file - it might be overwritten on new versions of BMK
 # if You want to alter it, remove the first line # BMK MAKEFILE 1.0 - then it is a custom makefile and will not be overwritten
 # bmk Makefile — thin wrapper using `uv tool install` for persistent bmk
@@ -30,10 +30,13 @@ ARGS ?=
 # Ensure bmk + project deps are installed as a persistent uv tool
 # ──────────────────────────────────────────────────────────────
 # --reinstall re-resolves deps on every call (fast when cached).
-# Fallback handles first-time install where --reinstall would fail.
+# Prefer the project's [dev] extra so test-only deps (test-import libraries,
+# fakes, property-test helpers) land in bmk's tool venv and `make test` matches
+# CI; fall back to base deps when the project has no [dev] extra, and to a plain
+# install on first run where --reinstall would fail.
 .PHONY: _ensure_bmk
 _ensure_bmk:
-	@uv tool install --reinstall bmk --with . 2>/dev/null || uv tool install bmk --with .
+	@uv tool install --reinstall bmk --with ".[dev]" 2>/dev/null || uv tool install --reinstall bmk --with . 2>/dev/null || uv tool install bmk --with .
 
 # ──────────────────────────────────────────────────────────────
 # Argument forwarding via MAKECMDGOALS
@@ -44,9 +47,9 @@ _ensure_bmk:
 # All targets that accept trailing arguments
 _BMK_TARGETS := test t test-human th testintegration testi ti testintegration-human tih \
 	codecov coverage cov \
-	build bld clean cln cl run \
+	build bld clean cln cl run ensure \
 	bump-major bump-minor bump-patch bump \
-	commit c push psh p release rel r \
+	commit c push psh p release rel r ship sh \
 	dependencies deps d dependencies-update \
 	config config-deploy config-generate-examples \
 	send-email send-notification custom \
@@ -117,6 +120,10 @@ cln cl: _ensure_bmk
 run: _ensure_bmk  ## Run the project CLI
 	$(BMK) run $(ARGS)
 
+.PHONY: ensure
+ensure: _ensure_bmk  ## Install missing external tools for this OS
+	$(BMK) ensure $(ARGS)
+
 # ──────────────────────────────────────────────────────────────
 # Version Bumping
 # ──────────────────────────────────────────────────────────────
@@ -158,6 +165,12 @@ release: _ensure_bmk  ## Create a versioned release (tag + GitHub release) [alia
 rel r: _ensure_bmk
 	$(BMK) release $(ARGS)
 
+.PHONY: ship sh
+ship: _ensure_bmk  ## Push, wait for CI, release, wait for release CI (CI-gated) [alias: sh]
+	$(BMK) ship $(ARGS)
+sh: _ensure_bmk
+	$(BMK) ship $(ARGS)
+
 # ──────────────────────────────────────────────────────────────
 # Dependencies
 # ──────────────────────────────────────────────────────────────

{lib_shopware6_api_base-6.0.2 → lib_shopware6_api_base-6.0.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lib_shopware6_api_base
-Version: 6.0.2
+Version: 6.0.3
 Summary: python3 base API client for shopware6
 Project-URL: Homepage, https://github.com/bitranox/lib_shopware6_api_base
 Project-URL: Documentation, https://github.com/bitranox/lib_shopware6_api_base/blob/master/README.md
@@ -22,33 +22,32 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Typing :: Typed
 Requires-Python: >=3.10
-Requires-Dist: httpx2>=2.3.0
+Requires-Dist: httpx2>=2.5.0
 Requires-Dist: lib-cli-exit-tools>=2.3.2
-Requires-Dist: lib-layered-config>=5.5.2
+Requires-Dist: lib-layered-config>=5.6.0
 Requires-Dist: lib-log-rich>=6.3.5
 Requires-Dist: orjson
 Requires-Dist: pydantic>=2.13.4
 Requires-Dist: rich-click
 Provides-Extra: dev
 Requires-Dist: bandit>=1.9.4; extra == 'dev'
-Requires-Dist: build>=1.5.0; extra == 'dev'
-Requires-Dist: codecov-cli>=11.2.8; extra == 'dev'
-Requires-Dist: httpx2>=2.3.0; extra == 'dev'
-Requires-Dist: hypothesis>=6.155.2; extra == 'dev'
-Requires-Dist: import-linter>=2.11; extra == 'dev'
+Requires-Dist: build>=1.5.1; extra == 'dev'
+Requires-Dist: httpx2>=2.5.0; extra == 'dev'
+Requires-Dist: hypothesis>=6.156.6; extra == 'dev'
+Requires-Dist: import-linter>=2.13; extra == 'dev'
 Requires-Dist: jaraco-context>=6.1.2; extra == 'dev'
-Requires-Dist: pip-audit>=2.10.0; extra == 'dev'
+Requires-Dist: pip-audit>=2.10.1; extra == 'dev'
 Requires-Dist: pynacl>=1.6.2; extra == 'dev'
-Requires-Dist: pyright[nodejs]>=1.1.410; extra == 'dev'
+Requires-Dist: pyright[nodejs]>=1.1.411; extra == 'dev'
 Requires-Dist: pytest-cov>=7.1.0; extra == 'dev'
-Requires-Dist: pytest>=9.0.3; extra == 'dev'
+Requires-Dist: pytest>=9.1.1; extra == 'dev'
 Requires-Dist: python-multipart>=0.0.32; extra == 'dev'
 Requires-Dist: rtoml>=0.13.0; extra == 'dev'
-Requires-Dist: ruff>=0.15.16; extra == 'dev'
-Requires-Dist: textual>=8.2.7; extra == 'dev'
+Requires-Dist: ruff>=0.15.21; extra == 'dev'
+Requires-Dist: textual>=8.2.8; extra == 'dev'
 Requires-Dist: twine>=6.2.0; extra == 'dev'
 Requires-Dist: urllib3>=2.7.0; extra == 'dev'
-Requires-Dist: virtualenv>=21.4.2; extra == 'dev'
+Requires-Dist: virtualenv>=21.6.1; extra == 'dev'
 Requires-Dist: wheel>=0.47.0; extra == 'dev'
 Description-Content-Type: text/markdown
 

{lib_shopware6_api_base-6.0.2 → lib_shopware6_api_base-6.0.3}/pyproject.toml

@@ -1,17 +1,17 @@
 [project]
 name = "lib_shopware6_api_base"
-version = "6.0.2"
+version = "6.0.3"
 description = "python3 base API client for shopware6"
 readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
     "pydantic>=2.13.4",
-    "lib_layered_config>=5.5.2",
+    "lib_layered_config>=5.6.0",
     "lib_log_rich>=6.3.5",
     "lib_cli_exit_tools>=2.3.2",
     "rich-click",
     "orjson",
-    "httpx2>=2.3.0",
+    "httpx2>=2.5.0",
 ]
 license = {text = "MIT"}
 authors = [{ name = "bitranox", email = "bitranox@gmail.com" }]
@@ -37,27 +37,33 @@ Changelog = "https://github.com/bitranox/lib_shopware6_api_base/blob/master/CHAN
 
 [project.optional-dependencies]
 dev = [
-  "pytest>=9.0.3",
+  "pytest>=9.1.1",
   "pytest-cov>=7.1.0",
-  "hypothesis>=6.155.2",
-  "ruff>=0.15.16",
-  "pyright[nodejs]>=1.1.410",
+  "hypothesis>=6.156.6",
+  "ruff>=0.15.21",
+  "pyright[nodejs]>=1.1.411",
   "bandit>=1.9.4",
-  "build>=1.5.0",
+  "build>=1.5.1",
   "twine>=6.2.0",
-  "codecov-cli>=11.2.8",
-  "pip-audit>=2.10.0",
-  "textual>=8.2.7",
-  "import-linter>=2.11",
+  # codecov-cli is disabled, not dropped: it requires click<8.3.0, which drags click back to
+  # 8.2.1 - the version with CVE-2026-7246 (command injection in click.edit(), fixed in 8.3.3).
+  # Nothing else here caps click, so with this line active the audit gate goes red on every
+  # clean install. Leaving it off costs nothing: CI uploads coverage via codecov/codecov-action,
+  # not this CLI, and "bmk codecov" resolves codecovcli from PATH and only warns when absent.
+  # Re-enable once codecov-cli relaxes its click<8.3.0 pin.
+  # "codecov-cli>=11.3.1",
+  "pip-audit>=2.10.1",
+  "textual>=8.2.8",
+  "import-linter>=2.13",
   "rtoml>=0.13.0",
-  "httpx2>=2.3.0",
+  "httpx2>=2.5.0",
   # Transitive CVE pins
   "jaraco-context>=6.1.2",       # CVE-2025-23949
   "python-multipart>=0.0.32",    # CVE-2025-24486, CVE-2026-40347, CVE-2026-42561
   "wheel>=0.47.0",               # CVE-2025-24049
   "pynacl>=1.6.2",               # CVE-2025-69277
   "urllib3>=2.7.0",              # CVE-2025-66471, CVE-2025-66418
-  "virtualenv>=21.4.2",         # CVE-2025-22702
+  "virtualenv>=21.6.1",         # CVE-2025-22702
 ]
 
 [project.scripts]
@@ -65,7 +71,7 @@ lib_shopware6_api_base = "lib_shopware6_api_base.lib_shopware6_api_base_cli:main
 lib-shopware6-api-base = "lib_shopware6_api_base.lib_shopware6_api_base_cli:main"
 
 [build-system]
-requires = ["hatchling>=1.30.1"]
+requires = ["hatchling>=1.31.0"]
 build-backend = "hatchling.build"
 
 [tool.hatch.build.targets.wheel]

{lib_shopware6_api_base-6.0.2 → lib_shopware6_api_base-6.0.3}/src/lib_shopware6_api_base/__init__conf__.py

@@ -26,7 +26,7 @@ name = "lib_shopware6_api_base"
 #: Human-readable summary shown in CLI help output.
 title = "python3 base API client for shopware6"
 #: Current release version pulled from ``pyproject.toml`` by automation.
-version = "6.0.2"
+version = "6.0.3"
 #: Repository homepage presented to users.
 homepage = "https://github.com/bitranox/lib_shopware6_api_base"
 #: Author attribution surfaced in CLI output.