pymetadata 0.8.1__tar.gz → 0.8.2__tar.gz

{pymetadata-0.8.1 → pymetadata-0.8.2}/.bumpversion.toml

@@ -1,5 +1,5 @@
 [tool.bumpversion]
-current_version = "0.8.1"
+current_version = "0.8.2"
 commit = true
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)"
 serialize = ["{major}.{minor}.{patch}"]

{pymetadata-0.8.1 → pymetadata-0.8.2}/CITATION.cff

@@ -8,7 +8,7 @@ authors:
     given-names: "Matthias"
     orcid: "https://orcid.org/0000-0003-1725-179X"
     affiliation: "Humboldt-University Berlin, Faculty of Life Science, Institute for Biology, Biology, Berlin; University Lübeck; University Hospital Schleswig-Holstein, Campus Lübeck, First Department of Medicine, Germany"
-version: "0.8.1"
+version: "0.8.2"
 date-released: "2026-10-05"
 doi: "10.5281/zenodo.5308801"
 license: MIT

{pymetadata-0.8.1 → pymetadata-0.8.2}/CLAUDE.md

@@ -4,12 +4,7 @@ This file provides guidance when working with code in this repository.
 
 ## Project
 
-`pymetadata` is a python library for metadata in the context of COMBINE standards:
-COMBINE archives (OMEX), MIRIAM/RDF annotations, and ontology terms (SBO, KISAO, PBPKO).
-Pure library, no CLI entry points. Requires python >= 3.11, packaged with hatchling
-(version is read from `src/pymetadata/__init__.py`). Runtime dependencies are
-`rich`, `requests` and `pydantic`; `pronto` is the optional `ontology` extra,
-needed only to regenerate the ontology modules.
+`pymetadata` is a python library for metadata in the context of COMBINE standards: COMBINE archives (OMEX), MIRIAM/RDF annotations, and ontology terms (SBO, KISAO, PBPKO). Pure library, no CLI entry points. Requires python >= 3.11, packaged with hatchling (version is read from `src/pymetadata/__init__.py`). Runtime dependencies are `rich`, `requests` and `pydantic`, plus the floors of `urllib3` and `certifi`, which are not imported but reached through `requests` (`certifi>=2026.10.19` excludes the CA store with the compromised emSign intermediates, GHSA-6q48-6c7w-9gw2); `pronto` is the optional `ontology` extra, needed only to regenerate the ontology modules.
 
 ## Commands
 

{pymetadata-0.8.1 → pymetadata-0.8.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pymetadata
-Version: 0.8.1
+Version: 0.8.2
 Summary: pymetadata are python utilities for working with metadata.
 Project-URL: Homepage, https://matthiaskoenig.github.io/pymetadata
 Project-URL: Documentation, https://matthiaskoenig.github.io/pymetadata
@@ -25,6 +25,7 @@ Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Topic :: Scientific/Engineering
 Classifier: Topic :: Scientific/Engineering :: Bio-Informatics
 Requires-Python: >=3.11
+Requires-Dist: certifi>=2026.10.19
 Requires-Dist: pydantic>=2.12
 Requires-Dist: requests>=2.34.2
 Requires-Dist: rich>=15.0.0

{pymetadata-0.8.1 → pymetadata-0.8.2}/pyproject.toml

@@ -41,6 +41,9 @@ dependencies = [
 	"rich>=15.0.0",
 	"requests>=2.34.2",
 	"urllib3>=2.5.0",
+	# not imported, reached through requests; the floor excludes the CA store
+	# with the compromised emSign intermediates, GHSA-6q48-6c7w-9gw2
+	"certifi>=2026.10.19",
 	"pydantic>=2.12",
 ]
 

pymetadata-0.8.2/release-notes/0.8.2.md

@@ -0,0 +1,9 @@
+# Release notes for pymetadata 0.8.2
+![pymetadata](./docs/images/favicon/pymetadata-100x100-300dpi.png)
+
+## Security
+
+- `certifi>=2026.10.19` is a runtime dependency (#106). certifi 2026.10.19 removes the emSign root CA, whose intermediates have compromised keys ([GHSA-6q48-6c7w-9gw2](https://github.com/advisories/GHSA-6q48-6c7w-9gw2)). pymetadata reaches the web services through `requests`, which verifies the certificates with the CA store of certifi, so the floor applies although certifi is not imported.
+- The lock of the development environment, `uv.lock`, has certifi 2026.10.19 and virtualenv 21.14.12, which seeds pip 26.2.2 (vendoring certifi 2026.10.19) into the environments of tox (#106). uv is pinned nowhere: continuous integration installs the latest uv, 0.13.4 or newer, which fixes its bundled CA store ([GHSA-hq85-5cpj-mr62](https://github.com/advisories/GHSA-hq85-5cpj-mr62)); a local uv older than 0.13.4 should be updated.
+
+Your pymetadata team

{pymetadata-0.8.1 → pymetadata-0.8.2}/src/pymetadata/__init__.py

@@ -7,7 +7,7 @@ from pathlib import Path
 logging.getLogger(__name__).addHandler(logging.NullHandler())
 
 __author__ = "Matthias Koenig"
-__version__ = "0.8.1"
+__version__ = "0.8.2"
 
 
 program_name: str = "pymetadata"

{pymetadata-0.8.1 → pymetadata-0.8.2}/uv.lock

@@ -69,11 +69,11 @@ wheels = [
 
 [[package]]
 name = "certifi"
-version = "2026.7.22"
+version = "2026.10.19"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/a3/c2/24167ea9858356b47a87a50d39908bfdb72ceeefe0041586e704e5376b3a/certifi-2026.7.22.tar.gz", hash = "sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55", size = 138112, upload-time = "2026-07-22T03:35:12.644Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/0b/a7/71ac2cff56fec219ed242bb11b8efb69fcc4bec75db06fb7bfe35de520e6/certifi-2026.7.22-py3-none-any.whl", hash = "sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775", size = 136983, upload-time = "2026-07-22T03:35:11.276Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" },
 ]
 
 [[package]]
@@ -1098,6 +1098,7 @@ wheels = [
 name = "pymetadata"
 source = { editable = "." }
 dependencies = [
+    { name = "certifi" },
     { name = "pydantic" },
     { name = "requests" },
     { name = "rich" },
@@ -1124,6 +1125,7 @@ ontology = [
 [package.metadata]
 requires-dist = [
     { name = "bump-my-version", marker = "extra == 'dev'", specifier = ">=1.5.1" },
+    { name = "certifi", specifier = ">=2026.10.19" },
     { name = "mkdocstrings-python", marker = "extra == 'dev'", specifier = ">=2.0.8" },
     { name = "pre-commit", marker = "extra == 'dev'", specifier = ">=4.6.2" },
     { name = "pronto", marker = "extra == 'dev'", specifier = ">=2.7.3" },
@@ -1549,7 +1551,7 @@ wheels = [
 
 [[package]]
 name = "virtualenv"
-version = "21.14.6"
+version = "21.14.12"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "distlib" },
@@ -1558,9 +1560,9 @@ dependencies = [
     { name = "platformdirs" },
     { name = "python-discovery" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/92/f3/589727d02bc832750cfa00ced4315d127535a22a6d7cfcb369b2fe219a2e/virtualenv-21.14.6.tar.gz", hash = "sha256:c6b74616e64bffa9532cfa9dfd54ffbab0dc9b999df2bb8ec0d75e559b983661", size = 5467961, upload-time = "2026-10-08T14:49:57.376Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/c9/2c/1a69b3346931e9a7db9cc00cc0fa847c843a85fa7cf52a598f57261c68df/virtualenv-21.14.12.tar.gz", hash = "sha256:bbcfb78e36c22ad70c6917c4aecb5e63477d3c138e9f88c946f320e31859c76a", size = 5562800, upload-time = "2026-10-21T01:58:51.724Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/c9/1f/e5182163bcee149dda4eec823d88b0f51f2c0c531b12da896f666f0b80c1/virtualenv-21.14.6-py3-none-any.whl", hash = "sha256:eb1a20c5878569b69667f6a1af03458a8512b3afa7be771a2dafe92fdca05bb9", size = 5487469, upload-time = "2026-10-08T14:49:54.988Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/92/f3b8af2d36ddec4dc61dc25655dc010e419ff456cb4ca0e720c8112f1047/virtualenv-21.14.12-py3-none-any.whl", hash = "sha256:7820aeaef23f1f59a96458edfc7f9d3deac937155718de15f1c9a64471e15551", size = 5556824, upload-time = "2026-10-21T01:58:48.505Z" },
 ]
 
 [[package]]