pymetadata 0.8.0__tar.gz → 0.8.2__tar.gz

{pymetadata-0.8.0 → pymetadata-0.8.2}/.bumpversion.toml

@@ -1,5 +1,5 @@
 [tool.bumpversion]
-current_version = "0.8.0"
+current_version = "0.8.2"
 commit = true
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)"
 serialize = ["{major}.{minor}.{patch}"]

pymetadata-0.8.2/.github/dependabot.yml

@@ -0,0 +1,34 @@
+# Keep the GitHub Actions used in the workflows and the locked python dependencies up to date,
+# monthly, since every update pull request runs the checks.
+# See https://docs.github.com/code-security/dependabot/dependabot-version-updates
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    # a single pull request for all action updates instead of one per action
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "ci"
+
+  # the locked python dependencies (uv.lock), bumped together
+  - package-ecosystem: "uv"
+    directory: "/"
+    # only uv.lock is updated: the default would raise the lower bounds in
+    # pyproject.toml, which are what a user of the library installs against,
+    # so they are only ever changed by hand
+    versioning-strategy: lockfile-only
+    schedule:
+      interval: "monthly"
+    groups:
+      python-dependencies:
+        patterns:
+          - "*"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "build"

{pymetadata-0.8.0 → pymetadata-0.8.2}/.github/workflows/ci-cd.yml

@@ -15,8 +15,9 @@ permissions:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  # superseded branch runs are cancelled, release runs are never cancelled
-  cancel-in-progress: ${{ !startsWith(github.ref, 'refs/tags/') }}
+  # a newer run supersedes the running one of the same branch or pull request;
+  # a release is never superseded, every tag is a group of its own
+  cancel-in-progress: true
 
 jobs:
   test:
@@ -25,26 +26,11 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
+        # continuous integration tests the newest python on every platform, the
+        # older and newer versions are tested locally with `tox run-parallel`,
+        # see docs/development.md
         os: [ubuntu-latest, windows-latest, macos-latest]
-        python-version: ["3.11", "3.12", "3.13", "3.14", "3.15"]
-        # linux covers the full range, windows and macos only the newest version
-        exclude:
-          - os: windows-latest
-            python-version: "3.11"
-          - os: windows-latest
-            python-version: "3.12"
-          - os: windows-latest
-            python-version: "3.13"
-          - os: windows-latest
-            python-version: "3.14"
-          - os: macos-latest
-            python-version: "3.11"
-          - os: macos-latest
-            python-version: "3.12"
-          - os: macos-latest
-            python-version: "3.13"
-          - os: macos-latest
-            python-version: "3.14"
+        python-version: ["3.14"]
 
     steps:
     - uses: actions/checkout@v7
@@ -55,10 +41,16 @@ jobs:
       uses: astral-sh/setup-uv@v10.2.0
       with:
         python-version: ${{ matrix.python-version }}
-        enable-cache: true
+        # a release run restores no cache, which zizmor cannot tell from the
+        # expression; the distributions are built without one, see `release`
+        enable-cache: ${{ !startsWith(github.ref, 'refs/tags/') }}  # zizmor: ignore[cache-poisoning]
+        # the interpreter is cached with the packages instead of downloaded by every run
+        cache-python: ${{ !startsWith(github.ref, 'refs/tags/') }}  # zizmor: ignore[cache-poisoning]
     - name: Test with tox
+      # the runner is billed by wall time: the tests run on every core, the
+      # slowest are listed so they stay visible
       run:
-        uvx --with tox-uv tox -e py${{ matrix.python-version }}
+        uvx --with tox-uv tox -e py${{ matrix.python-version }} -- -n auto --durations=15
 
   tests:
     # the one check the branch protection requires; the names of the matrix
@@ -95,7 +87,8 @@ jobs:
       uses: astral-sh/setup-uv@v10.2.0
       with:
         python-version: "3.14"
-        enable-cache: true
+        # a release is built from a clean state, never from a restored cache
+        enable-cache: false
     - name: Build package
       run: uvx hatch build
     - name: Check the package

{pymetadata-0.8.0 → pymetadata-0.8.2}/.github/workflows/docs.yml

@@ -13,8 +13,9 @@ permissions:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  # never cancel a running deployment, it would leave the site half published
-  cancel-in-progress: false
+  # a newer run supersedes the running one; a cancelled deployment leaves the
+  # published site as it was, the newer run deploys
+  cancel-in-progress: true
 
 jobs:
   docs:
@@ -27,14 +28,19 @@ jobs:
         with:
           persist-credentials: false
       - name: Configure GitHub Pages
+        # only needed for the deployment, see `deploy`
+        if: github.ref == 'refs/heads/develop'
         uses: actions/configure-pages@v6
       - name: Install uv and set the python version
         uses: astral-sh/setup-uv@v10.2.0
         with:
           python-version: "3.14"
           enable-cache: true
-      - name: Install dependencies
-        run: uv sync --extra dev
+          cache-python: true
+      - name: Install the locked dependencies (fails if uv.lock is out of date with pyproject.toml, run `uv lock`)
+        # `--locked` refuses to update the lock: a change of the dependencies
+        # in pyproject.toml has to come with the `uv lock` which records it
+        run: uv sync --locked --extra dev
       - name: Build the documentation
         # the API reference is rendered from the docstrings by mkdocstrings,
         # so the package has to be importable
@@ -43,6 +49,8 @@ jobs:
         # llms.txt, llms-full.txt and the markdown of every page
         run: uv run python scripts/llms_txt.py
       - name: Upload the site
+        # only needed for the deployment, see `deploy`
+        if: github.ref == 'refs/heads/develop'
         uses: actions/upload-pages-artifact@v5
         with:
           path: site

{pymetadata-0.8.0 → pymetadata-0.8.2}/.github/workflows/ruff.yml

@@ -25,13 +25,16 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      # the ruff version is read from the dev dependencies in pyproject.toml
+      # the ruff version is read from the lock (the same file `uv run ruff` uses locally), not from the
+      # `ruff>=` bound in pyproject.toml, which would resolve to the latest release
       - name: Lint
         # astral-sh/ruff-action publishes no floating major tag beyond v3
         uses: astral-sh/ruff-action@v4.1.0
         with:
+          version-file: uv.lock
           args: check --output-format=github
       - name: Format
         uses: astral-sh/ruff-action@v4.1.0
         with:
+          version-file: uv.lock
           args: format --check --diff

{pymetadata-0.8.0 → pymetadata-0.8.2}/.github/workflows/ty.yml

@@ -30,6 +30,7 @@ jobs:
         with:
           python-version: "3.14"
           enable-cache: true
+          cache-python: true
       - name: Type check with tox
         env:
           # render diagnostics as GitHub Actions workflow annotations

{pymetadata-0.8.0 → pymetadata-0.8.2}/.gitignore

@@ -17,8 +17,11 @@ coverage.xml
 # rendered documentation, built by the `documentation` workflow
 site/
 
-# the lock file is not committed, pymetadata is a library and pins nothing
-uv.lock
+# working files of coding agents, their design documents and plans are not committed
+.superpowers/
+docs/superpowers/
+.claude/plans/
+.claude/specs/
 
 # editors, operating system
 .idea/

{pymetadata-0.8.0 → pymetadata-0.8.2}/CITATION.cff

@@ -8,8 +8,8 @@ authors:
     given-names: "Matthias"
     orcid: "https://orcid.org/0000-0003-1725-179X"
     affiliation: "Humboldt-University Berlin, Faculty of Life Science, Institute for Biology, Biology, Berlin; University Lübeck; University Hospital Schleswig-Holstein, Campus Lübeck, First Department of Medicine, Germany"
-version: "0.8.0"
-date-released: "2026-09-23"
+version: "0.8.2"
+date-released: "2026-10-05"
 doi: "10.5281/zenodo.5308801"
 license: MIT
 repository-code: "https://github.com/matthiaskoenig/pymetadata"

{pymetadata-0.8.0 → pymetadata-0.8.2}/CLAUDE.md

@@ -4,12 +4,7 @@ This file provides guidance when working with code in this repository.
 
 ## Project
 
-`pymetadata` is a python library for metadata in the context of COMBINE standards:
-COMBINE archives (OMEX), MIRIAM/RDF annotations, and ontology terms (SBO, KISAO, PBPKO).
-Pure library, no CLI entry points. Requires python >= 3.11, packaged with hatchling
-(version is read from `src/pymetadata/__init__.py`). Runtime dependencies are
-`rich`, `requests` and `pydantic`; `pronto` is the optional `ontology` extra,
-needed only to regenerate the ontology modules.
+`pymetadata` is a python library for metadata in the context of COMBINE standards: COMBINE archives (OMEX), MIRIAM/RDF annotations, and ontology terms (SBO, KISAO, PBPKO). Pure library, no CLI entry points. Requires python >= 3.11, packaged with hatchling (version is read from `src/pymetadata/__init__.py`). Runtime dependencies are `rich`, `requests` and `pydantic`, plus the floors of `urllib3` and `certifi`, which are not imported but reached through `requests` (`certifi>=2026.10.19` excludes the CA store with the compromised emSign intermediates, GHSA-6q48-6c7w-9gw2); `pronto` is the optional `ontology` extra, needed only to regenerate the ontology modules.
 
 ## Commands
 
@@ -17,13 +12,14 @@ needed only to regenerate the ontology modules.
 # environment (uv based); the dev extra includes the ontology extra
 uv sync --extra dev
 uv run pre-commit install
+uv lock                         # after every change of a dependency in pyproject.toml
 
 # tests
 pytest                          # all tests
 pytest tests/test_omex.py       # single file
 pytest tests/test_omex.py::test_entry_from_dict   # single test
 tox r -e py3.15                 # single tox env (py3.11-3.15 available)
-tox run-parallel                # full matrix + ty
+tox run-parallel                # full matrix + ty, run before opening a pull request
 
 # lint / format / types
 ruff check
@@ -32,11 +28,7 @@ tox -e ty                       # ty type check (config in [tool.ty] in pyprojec
 uvx ty check                    # same check, straight from the working tree
 ```
 
-`develop` is the default branch and takes every change through a pull request;
-direct pushes are rejected by the rulesets in `.github/rulesets/` (applied with
-`.github/rulesets/apply.sh`), which require the `tests`, `ruff`, `ty` and `docs`
-checks. `main` only tracks the latest release and is fast-forwarded by the
-`sync-main` job of the release workflow, never by hand.
+`develop` is the default branch and takes every change through a pull request; direct pushes are rejected by the rulesets in `.github/rulesets/` (applied with `.github/rulesets/apply.sh`), which require the `tests`, `ruff`, `ty` and `docs` checks. Continuous integration is kept minimal: `tests` runs only `py3.14`, on linux, macos and windows, with pytest-xdist (`-n auto`), every workflow cancels a superseded run (`cancel-in-progress: true`), uv caches packages and interpreters, dependabot runs monthly. The other python versions run only locally. `main` only tracks the latest release and is fast-forwarded by the `sync-main` job of the release workflow, never by hand.
 
 Release steps are in `docs/development.md` (there is no separate `RELEASE.md`):
 the release is prepared on a branch, `uvx bump-my-version bump [major|minor|patch]`
@@ -121,7 +113,14 @@ registry). When a refresh fails, `read_json_cache_fallback` returns the outdated
 content with a warning instead of failing, so queries answered before keep
 working offline; `tests/test_offline.py` covers this per service. The corresponding tests
 (`test_ols.py`, `test_registry.py`, `test_chebi.py`, `test_unichem.py`, `test_uniprot.py`) require
-network access.
+network access. Processes share the cache (pytest-xdist workers): `write_bytes_cache`
+and `write_json_cache` write a temporary file next to the cache file and `os.replace`
+it, so a reader never sees a partial file, and the write is best effort, a failure is
+a warning and the caller keeps its data. On Windows a file another process has open
+cannot be replaced and a file being replaced cannot be opened, so both are retried
+(`CACHE_IN_USE_ATTEMPTS`); `Registry` uses the downloaded namespaces and does not read
+them back. `test_registry.py` loads the registry from several processes into one empty
+cache, with the download answered from `tests/data/registry/` (#102).
 
 `console.py` (rich console, for scripts and `__main__` blocks) and `log.py`
 provide the shared output/logging. Modules get their logger from the standard
@@ -138,6 +137,16 @@ lazy `%s` formatting rather than f-strings (enforced by ruff `G`).
   `project.requires-python`. Suppress a diagnostic with a rule-specific
   `# ty: ignore[rule-name]`, never a blanket `# type: ignore`. ty also runs as a
   pre-commit hook (`--extra dev`, so the hook syncs the dev environment it checks against).
+- `uv.lock` is committed and pins the local development environment (`uv sync`,
+  `uv run`, so also `uv run ty check`), the `documentation` workflow, which runs
+  `uv sync --locked`, and the ruff version of the `ruff` workflow; the tox
+  environments, i.e. the test matrix and the `ty` check of continuous
+  integration, resolve from `pyproject.toml` and do not use it. After changing a
+  dependency in `pyproject.toml` run `uv lock`, otherwise the `documentation`
+  workflow fails; `uv lock --upgrade` moves the lock to the newest releases.
+  Dependabot bumps the lock monthly with `versioning-strategy: lockfile-only`, so
+  the lower bounds in `pyproject.toml`, which users install against, are only
+  changed by hand.
 - Every module, class and function carries full type annotations and a google-style
   docstring.
 - `examples/` at the top level holds the runnable usage examples, they are not

{pymetadata-0.8.0 → pymetadata-0.8.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pymetadata
-Version: 0.8.0
+Version: 0.8.2
 Summary: pymetadata are python utilities for working with metadata.
 Project-URL: Homepage, https://matthiaskoenig.github.io/pymetadata
 Project-URL: Documentation, https://matthiaskoenig.github.io/pymetadata
@@ -25,7 +25,8 @@ Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Topic :: Scientific/Engineering
 Classifier: Topic :: Scientific/Engineering :: Bio-Informatics
 Requires-Python: >=3.11
-Requires-Dist: pydantic>=2.13.5
+Requires-Dist: certifi>=2026.10.19
+Requires-Dist: pydantic>=2.12
 Requires-Dist: requests>=2.34.2
 Requires-Dist: rich>=15.0.0
 Requires-Dist: urllib3>=2.5.0
@@ -65,18 +66,18 @@ If you have any questions or issues please [open an issue](https://github.com/ma
 
 If you use `pymetadata` please cite the archived software on [Zenodo](https://doi.org/10.5281/zenodo.5308801):
 
-> König, M. (2026). *pymetadata are python utilities for working with metadata* (Version 0.6.6) [Computer software]. Zenodo. https://doi.org/10.5281/zenodo.22914125
+> König, M. (2026). *pymetadata are python utilities for working with metadata* (Version 0.8.0) [Computer software]. Zenodo. https://doi.org/10.5281/zenodo.23159552
 
 ```bibtex
 @software{konig_pymetadata,
   author    = {König, Matthias},
   title     = {pymetadata are python utilities for working with metadata},
   year      = {2026},
-  month     = sep,
-  version   = {0.6.6},
+  month     = oct,
+  version   = {0.8.0},
   publisher = {Zenodo},
-  doi       = {10.5281/zenodo.22914125},
-  url       = {https://doi.org/10.5281/zenodo.22914125},
+  doi       = {10.5281/zenodo.23159552},
+  url       = {https://doi.org/10.5281/zenodo.23159552},
 }
 ```
 

{pymetadata-0.8.0 → pymetadata-0.8.2}/README.md

@@ -19,18 +19,18 @@ If you have any questions or issues please [open an issue](https://github.com/ma
 
 If you use `pymetadata` please cite the archived software on [Zenodo](https://doi.org/10.5281/zenodo.5308801):
 
-> König, M. (2026). *pymetadata are python utilities for working with metadata* (Version 0.6.6) [Computer software]. Zenodo. https://doi.org/10.5281/zenodo.22914125
+> König, M. (2026). *pymetadata are python utilities for working with metadata* (Version 0.8.0) [Computer software]. Zenodo. https://doi.org/10.5281/zenodo.23159552
 
 ```bibtex
 @software{konig_pymetadata,
   author    = {König, Matthias},
   title     = {pymetadata are python utilities for working with metadata},
   year      = {2026},
-  month     = sep,
-  version   = {0.6.6},
+  month     = oct,
+  version   = {0.8.0},
   publisher = {Zenodo},
-  doi       = {10.5281/zenodo.22914125},
-  url       = {https://doi.org/10.5281/zenodo.22914125},
+  doi       = {10.5281/zenodo.23159552},
+  url       = {https://doi.org/10.5281/zenodo.23159552},
 }
 ```
 

{pymetadata-0.8.0 → pymetadata-0.8.2}/docs/development.md

@@ -27,7 +27,7 @@ A pull request can only be merged once the four required checks are green:
 
 | check   | workflow      | content                                                              |
 | ------- | ------------- | -------------------------------------------------------------------- |
-| `tests` | `ci-cd.yml`   | the test matrix, linux, macos and windows with python 3.11 to 3.15    |
+| `tests` | `ci-cd.yml`   | the test matrix, python 3.14 on linux, macos and windows              |
 | `ruff`  | `ruff.yml`    | `ruff check` and `ruff format --check`                                |
 | `ty`    | `ty.yml`      | `tox r -e ty`                                                         |
 | `docs`  | `docs.yml`    | the zensical build including the api reference and the agent files    |
@@ -35,6 +35,8 @@ A pull request can only be merged once the four required checks are green:
 `tests` aggregates the test matrix into a single job, so the name of the
 required check stays the same when the matrix changes.
 
+Continuous integration is kept small: every workflow cancels its running build when a newer commit of the same branch or pull request arrives, uv caches the packages and the interpreters between runs, dependabot proposes its updates once a month, and the matrix tests only python 3.14. The other python versions are tested locally, see [Testing](#testing), before a pull request is opened.
+
 Further rules of a pull request:
 
 - conversations have to be resolved before the merge
@@ -94,6 +96,8 @@ A single sync creates the virtual environment in `.venv`, installs `pymetadata`
 uv sync --extra dev
 ```
 
+The environment is resolved from `uv.lock`, which is committed, so local development, including `uv run ty check`, and the documentation build use the same versions. The tox environments, i.e. the test matrix and the `ty` check of continuous integration, resolve from `pyproject.toml` and do not use the lock; the lower bounds in `pyproject.toml` are what a user of the library installs against. After changing a dependency in `pyproject.toml` run `uv lock`: the `documentation` workflow syncs with `uv sync --locked`, which fails when `pyproject.toml` and the lock disagree. `uv lock --upgrade` moves the lock to the newest releases. Dependabot bumps the locked dependencies as one grouped monthly pull request, with `versioning-strategy: lockfile-only`, so the lower bounds in `pyproject.toml` are never raised by it and only ever changed by hand.
+
 The `dev` extra contains everything used below, i.e., pytest, ruff, ty, tox, pre-commit, zensical and bump-my-version, and it pulls in the optional `ontology` extra, so nothing has to be installed separately. The python version is taken from `.python-version` (currently 3.14); to work against the oldest supported version instead use `uv sync --extra dev --python 3.11`, which replaces the environment.
 
 The tools are then run either with `uv run <command>`, which uses the environment without activating it, or from the activated environment:
@@ -127,7 +131,7 @@ and the complete matrix, including the `ty` environment, in parallel with
 tox run-parallel
 ```
 
-This needs the interpreters to be available, which uv installs with `uv python install 3.11 3.12 3.13 3.14 3.15`. Continuous integration runs the same environments as `uvx --with tox-uv tox -e py3.15`.
+This needs the interpreters to be available, which uv installs with `uv python install 3.11 3.12 3.13 3.14 3.15`. It is the complete test and is run before a pull request is opened: continuous integration runs only `py3.14`, on linux, macos and windows, as `uvx --with tox-uv tox -e py3.14 -- -n auto --durations=15`, i.e., with the tests distributed over the cores of the runner by pytest-xdist and the 15 slowest tests listed. What follows `--` is passed on to pytest, so `tox r -e py3.14 -- -n auto` does the same locally.
 
 To run the tests directly against the development environment use
 
@@ -148,6 +152,8 @@ ruff check     # lint
 ruff format    # format
 ```
 
+The `ruff` workflow installs the ruff version locked in `uv.lock`, so continuous integration and `uv run ruff` agree.
+
 ## Type checking
 
 Type checking is performed with [ty](https://docs.astral.sh/ty/):

{pymetadata-0.8.0 → pymetadata-0.8.2}/docs/index.md

@@ -70,18 +70,18 @@ If you have any questions or issues please [open an issue](https://github.com/ma
 
 If you use `pymetadata` please cite the archived software on [Zenodo](https://doi.org/10.5281/zenodo.5308801):
 
-> König, M. (2026). *pymetadata are python utilities for working with metadata* (Version 0.6.6) [Computer software]. Zenodo. https://doi.org/10.5281/zenodo.22914125
+> König, M. (2026). *pymetadata are python utilities for working with metadata* (Version 0.8.0) [Computer software]. Zenodo. https://doi.org/10.5281/zenodo.23159552
 
 ```bibtex
 @software{konig_pymetadata,
   author    = {König, Matthias},
   title     = {pymetadata are python utilities for working with metadata},
   year      = {2026},
-  month     = sep,
-  version   = {0.6.6},
+  month     = oct,
+  version   = {0.8.0},
   publisher = {Zenodo},
-  doi       = {10.5281/zenodo.22914125},
-  url       = {https://doi.org/10.5281/zenodo.22914125},
+  doi       = {10.5281/zenodo.23159552},
+  url       = {https://doi.org/10.5281/zenodo.23159552},
 }
 ```
 

{pymetadata-0.8.0 → pymetadata-0.8.2}/docs/installation.md

@@ -1,6 +1,6 @@
 # Installation
 
-`pymetadata` requires python >= 3.11 and is available from [pypi](https://pypi.python.org/pypi/pymetadata). It is pure python and tested with python 3.11 to 3.15 on Linux, macOS and Windows. The only compiled dependency is `pydantic-core`, which comes with [pydantic](https://docs.pydantic.dev/) and is installed from a wheel; for python 3.15 these wheels are part of pydantic 2.14, with an older pydantic it is built from source, which requires a Rust toolchain.
+`pymetadata` requires python >= 3.11 and is available from [pypi](https://pypi.python.org/pypi/pymetadata). It is pure python and tested with python 3.11 to 3.15: continuous integration tests python 3.14 on Linux, macOS and Windows, all supported versions are tested locally on Linux before every pull request. The only compiled dependency is `pydantic-core`, which comes with [pydantic](https://docs.pydantic.dev/) and is installed from a wheel; for python 3.15 these wheels are part of pydantic 2.14, with an older pydantic it is built from source, which requires a Rust toolchain.
 
 ## With uv
 
@@ -103,6 +103,12 @@ Using the cache from 1080.0 h ago, it could not be refreshed:
 
 A query which was answered before therefore keeps working offline. Only a query which was never cached fails: `ChebiQuery.query` and `OLSQuery.query_ols` report the problem in their result, `UnichemQuery` and `Registry` raise a `WebserviceError`.
 
+### Several processes
+
+Processes which run at the same time can share the cache, e.g., the workers of [pytest-xdist](https://pytest-xdist.readthedocs.io). A cache file is written to a temporary file in the same directory, which then replaces the cache file atomically, so a process never reads a partially written file. Processes which start on an empty cache each download what they need once, e.g., the registry.
+
+Writing the cache is best effort, the process has the content already: a cache file which cannot be written is a warning, and the query returns its result anyway. On Windows a file which another process has open cannot be replaced, and a file which another process replaces cannot be opened; both are retried for about a second, after which the cache file of the other process is kept.
+
 ### The registry
 
 The identifiers.org registry is cached independently of `CACHE_USE`. It is downloaded to `CACHE_PATH / "identifiers_registry.json"` and refreshed when the local copy is older than the cache duration:

{pymetadata-0.8.0 → pymetadata-0.8.2}/pyproject.toml

@@ -41,7 +41,10 @@ dependencies = [
 	"rich>=15.0.0",
 	"requests>=2.34.2",
 	"urllib3>=2.5.0",
-	"pydantic>=2.13.5",
+	# not imported, reached through requests; the floor excludes the CA store
+	# with the compromised emSign intermediates, GHSA-6q48-6c7w-9gw2
+	"certifi>=2026.10.19",
+	"pydantic>=2.12",
 ]
 
 [project.optional-dependencies]

pymetadata-0.8.2/release-notes/0.8.1.md

@@ -0,0 +1,20 @@
+# Release notes for pymetadata 0.8.1
+![pymetadata](./docs/images/favicon/pymetadata-100x100-300dpi.png)
+
+## Dependencies
+
+- `pydantic>=2.12` instead of `pydantic>=2.13.5` (#105). The lower bound was the newest release when the bounds were pinned, not a requirement: the tests pass with pydantic 2.12.0 on python 3.11 and 3.14. The strict bound made pymetadata uninstallable with pip next to `pydantic-numpy` 9.0.2 (which requires `pydantic~=2.12.5`, and is the only release pip can install on python 3.14), e.g. in `sbmlsim[sciml]` through `petab-sciml`.
+
+## Fixes
+
+- Processes which load the identifiers.org registry into the same empty cache at the same time, e.g., the workers of pytest-xdist, no longer fail on Windows with `PermissionError: [WinError 5] Access is denied` (#102). A cache file which another process has open is retried for about a second, and a cache file which cannot be written is a warning instead of an error, the query returns its result anyway. `Registry` uses the namespaces it downloaded instead of reading them back from the cache.
+- Reading a cache file which another process replaces at the same moment is retried on Windows.
+- Cache files have the permissions of a regular file again (`0o666` minus the umask) instead of being readable only by their owner, so a cache directory can be shared.
+- A corrupt cached registry is downloaded again instead of failing.
+
+## Development
+
+- The lock of the development environment, `uv.lock`, is tracked, and continuous integration installs it (#101).
+- Continuous integration runs with less load (#104).
+
+Your pymetadata team

pymetadata-0.8.2/release-notes/0.8.2.md

@@ -0,0 +1,9 @@
+# Release notes for pymetadata 0.8.2
+![pymetadata](./docs/images/favicon/pymetadata-100x100-300dpi.png)
+
+## Security
+
+- `certifi>=2026.10.19` is a runtime dependency (#106). certifi 2026.10.19 removes the emSign root CA, whose intermediates have compromised keys ([GHSA-6q48-6c7w-9gw2](https://github.com/advisories/GHSA-6q48-6c7w-9gw2)). pymetadata reaches the web services through `requests`, which verifies the certificates with the CA store of certifi, so the floor applies although certifi is not imported.
+- The lock of the development environment, `uv.lock`, has certifi 2026.10.19 and virtualenv 21.14.12, which seeds pip 26.2.2 (vendoring certifi 2026.10.19) into the environments of tox (#106). uv is pinned nowhere: continuous integration installs the latest uv, 0.13.4 or newer, which fixes its bundled CA store ([GHSA-hq85-5cpj-mr62](https://github.com/advisories/GHSA-hq85-5cpj-mr62)); a local uv older than 0.13.4 should be updated.
+
+Your pymetadata team

{pymetadata-0.8.0 → pymetadata-0.8.2}/src/pymetadata/__init__.py

@@ -7,7 +7,7 @@ from pathlib import Path
 logging.getLogger(__name__).addHandler(logging.NullHandler())
 
 __author__ = "Matthias Koenig"
-__version__ = "0.8.0"
+__version__ = "0.8.2"
 
 
 program_name: str = "pymetadata"