plain 0.63.0__tar.gz → 0.64.0__tar.gz

{plain-0.63.0 → plain-0.64.0}/.gitignore

@@ -11,8 +11,6 @@ plain*/tests/.plain
 # Ottobot
 .aider*
 
-/llms-full.txt
-
 # Plain temp dirs
 .plain
 

{plain-0.63.0 → plain-0.64.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plain
-Version: 0.63.0
+Version: 0.64.0
 Summary: A web framework for building products with Python.
 Author-email: Dave Gaeddert <dave.gaeddert@dropseed.dev>
 License-File: LICENSE

{plain-0.63.0 → plain-0.64.0}/plain/CHANGELOG.md

@@ -1,5 +1,17 @@
 # plain changelog
 
+## [0.64.0](https://github.com/dropseed/plain/releases/plain@0.64.0) (2025-09-19)
+
+### What's changed
+
+- Added `plain-build` command as a standalone executable ([4b39ca4](https://github.com/dropseed/plain/commit/4b39ca4599))
+- Removed `constant_time_compare` utility function in favor of `hmac.compare_digest` ([55f3f55](https://github.com/dropseed/plain/commit/55f3f5596d))
+- CLI now forces colors in CI environments (GitHub Actions, GitLab CI, etc.) for better output visibility ([56f7d2b](https://github.com/dropseed/plain/commit/56f7d2b312))
+
+### Upgrade instructions
+
+- Replace any usage of `plain.utils.crypto.constant_time_compare` with `hmac.compare_digest` or `secrets.compare_digest`
+
 ## [0.63.0](https://github.com/dropseed/plain/releases/plain@0.63.0) (2025-09-12)
 
 ### What's changed

{plain-0.63.0 → plain-0.64.0}/plain/cli/formatting.py

@@ -1,3 +1,5 @@
+import os
+
 import click
 from click.formatting import iter_rows, measure_table, term_len, wrap_text
 
@@ -59,3 +61,13 @@ class PlainHelpFormatter(click.HelpFormatter):
 
 class PlainContext(click.Context):
     formatter_class = PlainHelpFormatter
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+
+        # Force colors in CI environments
+        if any(
+            os.getenv(var)
+            for var in ["CI", "FORCE_COLOR", "GITHUB_ACTIONS", "GITLAB_CI"]
+        ) and not any(os.getenv(var) for var in ["NO_COLOR", "PYTEST_CURRENT_TEST"]):
+            self.color = True

{plain-0.63.0 → plain-0.64.0}/plain/cli/upgrade.py

@@ -153,7 +153,6 @@ def build_prompt(before_after: dict[str, tuple[str | None, str | None]]) -> str:
             "   - Process ALL packages before testing or validation",
             "   - After all packages are updated, run `uv run plain fix --unsafe-fixes` and `uv run plain pre-commit` to check results",
             "   - DO NOT commit any changes",
-            "   - DO NOT run `plain migrate` with the `--no-backup` option",
             "   - Keep code changes minimal and focused - avoid unnecessary comments",
             "",
             "3. **Available tools:**",

{plain-0.63.0 → plain-0.64.0}/plain/signing.py

@@ -35,12 +35,14 @@ These functions make use of all of them.
 
 import base64
 import datetime
+import hmac
 import json
 import time
 import zlib
 
 from plain.runtime import settings
-from plain.utils.crypto import constant_time_compare, salted_hmac
+from plain.utils.crypto import salted_hmac
+from plain.utils.encoding import force_bytes
 from plain.utils.regex_helper import _lazy_re_compile
 
 _SEP_UNSAFE = _lazy_re_compile(r"^[A-z0-9-_=]*$")
@@ -196,7 +198,9 @@ class Signer:
             raise BadSignature(f'No "{self.sep}" found in value')
         value, sig = signed_value.rsplit(self.sep, 1)
         for key in [self.key, *self.fallback_keys]:
-            if constant_time_compare(sig, self.signature(value, key)):
+            if hmac.compare_digest(
+                force_bytes(sig), force_bytes(self.signature(value, key))
+            ):
                 return value
         raise BadSignature(f'Signature "{sig}" does not match')
 

{plain-0.63.0 → plain-0.64.0}/plain/utils/crypto.py

@@ -62,11 +62,6 @@ def get_random_string(length, allowed_chars=RANDOM_STRING_CHARS):
     return "".join(secrets.choice(allowed_chars) for i in range(length))
 
 
-def constant_time_compare(val1, val2):
-    """Return True if the two strings are equal, False otherwise."""
-    return secrets.compare_digest(force_bytes(val1), force_bytes(val2))
-
-
 def pbkdf2(password, salt, iterations, dklen=0, digest=None):
     """Return the hash of password using pbkdf2."""
     if digest is None:

{plain-0.63.0 → plain-0.64.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "plain"
-version = "0.63.0"
+version = "0.64.0"
 description = "A web framework for building products with Python."
 authors = [{name = "Dave Gaeddert", email = "dave.gaeddert@dropseed.dev"}]
 readme = "README.md"
@@ -18,6 +18,7 @@ plain = "plain.cli.core:cli"
 # Make this directly available without loading Plain,
 # for use in upgrade scripts.
 plain-changelog = "plain.cli.changelog:changelog"
+plain-build = "plain.cli.build:build"
 
 [tool.uv]
 dev-dependencies = [