wlc 2.2.0__tar.gz → 3.0.0__tar.gz

wlc-2.2.0/CHANGES.rst → wlc-3.0.0/CHANGES.md

@@ -1,8 +1,39 @@
-2.2.0
------
+# Changelog
+
+## 3.0.0
+
+* Released on 8th October 2026.
+* Breaking Python API changes:
+
+  * Require keyword arguments for client construction, request options,
+    project and language creation, source string creation, upload and download
+    options, throttling error construction, and CLI entry point options.
+  * API model objects now inherit from `UserDict` and are no longer `dict`
+    instances. Use `get_data()` or `dict(obj.items())` when a plain dictionary
+    is required.
+  * `WeblateConfig.find_config()` and `WeblateConfig.find_project_config()` now
+    return `pathlib.Path` objects instead of strings when a file is found.
+* Reject cyclic category hierarchies and category nesting deeper than three
+  levels.
+* Raised minimum dependency versions to exclude vulnerable releases.
+* Added testing with Python 3.15 and improved type annotations.
+* Updated development dependencies, CI actions, and Docker base images.
+
+## 2.2.1
+
+* Released on 24th September 2026.
+* Prevented API keys from appearing in CLI request errors and rejected API keys
+  containing line breaks.
+* Fixed component downloads when a slug contains `repository` and avoided
+  relisting an already resolved component.
+* Reported local filesystem failures as CLI errors and validated component
+  download output paths before fetching data.
+* Updated development dependencies, CI actions, and Docker base images.
+
+## 2.2.0
 
 * Released on 1st September 2026.
-* Hardened authentication by disabling automatic ``netrc`` credentials,
+* Hardened authentication by disabling automatic `netrc` credentials,
   rejecting credentials embedded in URLs, and redacting credentials from HTTP
   failure logs.
 * Scoped insecure HTTP and TLS exceptions to explicitly trusted origins and
@@ -14,8 +45,7 @@
 * Added a threat model and clarified configuration discovery and precedence.
 * Updated development dependencies, CI actions, and Docker base images.
 
-2.1.1
------
+## 2.1.1
 
 * Released on 25th July 2026.
 * Prevented URL parser differential SSRF in server-provided URLs by validating
@@ -23,80 +53,71 @@
 * Improved type annotations.
 * Updated development dependencies, CI actions, and Docker base images.
 
-2.1.0
------
+## 2.1.0
 
 * Released on 30th June 2026.
-* Refuse sending API keys over non-local ``http://`` URLs by default, while
+* Refuse sending API keys over non-local `http://` URLs by default, while
   keeping loopback HTTP supported for local development and adding explicit
-  opt-in via ``--allow-insecure-http``, ``WLC_ALLOW_INSECURE_HTTP``, or trusted
+  opt-in via `--allow-insecure-http`, `WLC_ALLOW_INSECURE_HTTP`, or trusted
   configuration.
 * Fixed paginated listings with query parameters to avoid duplicating
-  parameters from API-provided ``next`` URLs.
-* Updated minimum supported ``requests`` and ``urllib3`` versions.
+  parameters from API-provided `next` URLs.
+* Updated minimum supported `requests` and `urllib3` versions.
 * Improved inline API documentation and output handling internals.
 * Updated development dependencies, CI actions, and Docker base images.
 
-2.0.1
------
+## 2.0.1
 
 * Released on 26th June 2026.
 * Require explicit URL pinning for unscoped API keys when the API URL comes
-  from automatically discovered project configuration: ``WLC_KEY`` requires
-  ``WLC_URL`` and ``--key`` requires ``--url``.
-* Removed ``TRACE`` from the default retryable HTTP methods.
+  from automatically discovered project configuration: `WLC_KEY` requires
+  `WLC_URL` and `--key` requires `--url`.
+* Removed `TRACE` from the default retryable HTTP methods.
 * Added package and container provenance attestations and SBOM publishing for
   release artifacts.
 * Updated development dependencies, CI actions, and Docker base images.
 
-2.0.0
------
+## 2.0.0
 
 * Released on 21st April 2026.
 * Possibly breaking changes:
 
-  * Renamed the retry configuration option from ``method_whitelist`` to ``allowed_methods``.
-  * Tightened configuration loading: explicit ``--config`` is authoritative, missing explicit config files fail, and project discovery uses the nearest config file.
+  * Renamed the retry configuration option from `method_whitelist` to `allowed_methods`.
+  * Tightened configuration loading: explicit `--config` is authoritative, missing explicit config files fail, and project discovery uses the nearest config file.
   * Tightened URL, download, and output safety: invalid or cross-origin URLs are rejected, binary downloads to terminals are refused, and text, CSV, and HTML output is escaped.
-
-* Added ``WLC_URL`` and ``WLC_KEY`` environment variable support.
+* Added `WLC_URL` and `WLC_KEY` environment variable support.
 * Added unit-level CLI commands.
 * Updated models and statistics for the current Weblate API while preserving older statistics responses.
 * Fixed retry configuration and request adapter wiring.
-* Escaped generated HTML output (`GHSA-gx2m-mcc2-r4p3 <https://github.com/WeblateOrg/wlc/security/advisories/GHSA-gx2m-mcc2-r4p3>`__), hardened CSV and terminal output, and redacted authorization headers from debug logs.
+* Escaped generated HTML output ([GHSA-gx2m-mcc2-r4p3](https://github.com/WeblateOrg/wlc/security/advisories/GHSA-gx2m-mcc2-r4p3)), hardened CSV and terminal output, and redacted authorization headers from debug logs.
 * Improved nested category handling, unit editing, help texts, and error messages.
 * Split implementation modules, moved tests out of the installed package, and updated packaging, dependencies, Docker images, and CI.
 
-1.17.2
-------
+## 1.17.2
 
 * Released on 16th January 2026.
 * Fixes path traversal: Unsanitized API slugs in download command (CVE-2026-23535).
 
-1.17.1
-------
+## 1.17.1
 
 * Released on 13th January 2026.
-* Unscoped ``key`` in configuration triggers error.
+* Unscoped `key` in configuration triggers error.
 
-1.17.0
-------
+## 1.17.0
 
 * Released on 12th January 2026.
-* Configuration change might be needed to move API keys to a new location, see https://docs.weblate.org/en/latest/wlc.html#legacy-configuration.
-* Dropped support for unscoped ``key`` in configuration (CVE-2026-22251).
+* Configuration change might be needed to move API keys to a new location, see <https://docs.weblate.org/en/latest/wlc.html#legacy-configuration>.
+* Dropped support for unscoped `key` in configuration (CVE-2026-22251).
 * Tightened hostname-based SSL verification skip (CVE-2026-22250).
 * Modernized packaging.
 * Improved type annotations.
 
-1.16.1
-------
+## 1.16.1
 
 * Released on 10th October 2025.
 * Fixed packages publishing.
 
-1.16
-----
+## 1.16
 
 * Released on 10th October 2025.
 * Fixed downloading components based on configuration.
@@ -105,14 +126,12 @@
 * Dropped support for Python 3.8 and 3.9.
 * Added support for Python 3.13 and 3.14.
 
-1.15
-----
+## 1.15
 
 * Released on 3rd September 2024.
 * Fixed installation on certain filesystems.
 
-1.14
-----
+## 1.14
 
 * Released on 23rd February 2024.
 * Dropped support for Python 3.6 and 3.7.
@@ -120,8 +139,7 @@
 * Added support for categories.
 * Added support for the linked_component field.
 
-1.13
-----
+## 1.13
 
 * Released on 24th March 2022.
 * Support all wlc upload methods.
@@ -129,23 +147,20 @@
 * Allow uploading files when creating a component.
 * Allow downloading at component, project, and site level.
 
-1.12
-----
+## 1.12
 
 * Released on 19th May 2021.
 * Improved error messages when permission was denied.
 * Added type hints to the codebase.
 
-1.11
-----
+## 1.11
 
 * Released on 17th March 2021.
 * Fixed long filenames in test fixtures.
 * Updated base docker image.
 * Add support for specifying format when uploading files.
 
-1.10
-----
+## 1.10
 
 * Released on 11th February 2021.
 * Added ability to create new projects, components, and translations
@@ -158,46 +173,39 @@
 * Using requests.session to keep a single http request open instead of reinitializing them.
 * Added timeout config variable
 
-1.9
----
+## 1.9
 
 * Released on 21st December 2020.
 * Added Docker image published as weblate/wlc on Docker Hub.
 
-1.8
----
+## 1.8
 
 * Released on 11th September 2020.
 * Compatibility with Weblate 4.3 which moves source language from component to a project.
 
-1.7
----
+## 1.7
 
 * Released on 3rd September 2020.
 * Fixed installation of wlc command-line.
 
-1.6
----
+## 1.6
 
 * Released on 1st September 2020.
 * Post payload as JSON to allow handling complex data structures.
 * Added support for finding configuration file on Windows in AppData dir.
 * Improved error reporting.
 
-1.5
----
+## 1.5
 
 * Released on 19th June 2020.
 * Fixed compatibility of some API calls with Weblate 4.1.
 
-1.4
----
+## 1.4
 
 * Released on 3rd June 2020.
 * Fixed compatibility of some API calls with Weblate 4.1.
 
-1.3
----
+## 1.3
 
 * Released on 6th May 2020.
 * Mark Python 3.8 as supported, dropped support for Python 3.5.
@@ -207,8 +215,7 @@
 * Added support for filtering components and translations.
 * Better report errors when accessing API.
 
-1.2
----
+## 1.2
 
 * Released on 15th October 2019.
 * Fix stats invocation.
@@ -216,42 +223,36 @@
 * Added support for replace upload.
 * Added support for project, component and translation removal.
 
-1.1
----
+## 1.1
 
 * Released on 1st February, 2019.
 * Fixed listing of language objects.
 
-1.0
----
+## 1.0
 
 * Released on 31st January, 2019.
 * Added support for more parameters on file upload.
 
-0.10
-----
+## 0.10
 
 * Released on 21th October, 2018.
 * Fixed POST operations in the API.
 * Added --debug parameter to diagnose HTTP problems.
 
-0.9
----
+## 0.9
 
 * Released on 17th October, 2018.
 * Switched to requests
 * Added support for cleanup command.
 * Added support for upload command.
 
-0.8
----
+## 0.8
 
 * Released on 3rd March, 2017.
 * Various code cleanups.
 * Tested with Python 3.6.
 
-0.7
----
+## 0.7
 
 * Released on 16th December, 2016.
 * Added reset operation.
@@ -259,27 +260,23 @@
 * Added changes listing.
 * Added file downloads.
 
-0.6
----
+## 0.6
 
 * Released on 20th September, 2016.
 * Fixed error when invoked without command.
 * Tested on Windows and OS X (in addition to Linux).
 
-0.5
----
+## 0.5
 
 * Released on 11th July, 2016.
 * Added locking commands.
 
-0.4
----
+## 0.4
 
 * Released on 8th July, 2016.
 * Moved Git repository.
 
-0.3
----
+## 0.3
 
 * Released on 19th May, 2016.
 * First version for general usage.

{wlc-2.2.0 → wlc-3.0.0}/MANIFEST.in

@@ -4,7 +4,7 @@ include SECURITY.md
 include LICENSE
 include wl
 recursive-include LICENSES *
-include CHANGES.rst
+include CHANGES.md
 include MANIFEST.in
 include completion/wlc
 graft tests

{wlc-2.2.0 → wlc-3.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: wlc
-Version: 2.2.0
+Version: 3.0.0
 Summary: A command-line utility for Weblate, translation tool with tight version control integration
 Author-email: Michal Čihař <michal@weblate.org>
 License-Expression: GPL-3.0-or-later
@@ -24,6 +24,7 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
 Classifier: Topic :: Software Development :: Internationalization
 Classifier: Topic :: Software Development :: Localization
 Classifier: Topic :: Utilities
@@ -31,28 +32,35 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: argcomplete
+Requires-Dist: certifi>=2026.7.22
+Requires-Dist: idna>=3.15
 Requires-Dist: python-dateutil
-Requires-Dist: pyxdg
+Requires-Dist: pyxdg>=0.26
 Requires-Dist: requests>=2.33.0
-Requires-Dist: urllib3>=2.7.0
+Requires-Dist: urllib3>=2.8.0
 Dynamic: license-file
 
-<a href="https://weblate.org/"><img alt="Weblate" src="https://s.weblate.org/cdn/Logo-Darktext-borders.png" height="80px" /></a>
-
-**Weblate is libre software web-based continuous localization system,
-used by over 2500 libre projects and companies in more than 165 countries.**
-
 # wlc
 
-wlc is a [Weblate](https://weblate.org/) command-line client and Python library
-using [Weblate's REST API](https://docs.weblate.org/en/latest/api.html).
-
 [![Website](https://img.shields.io/badge/website-weblate.org-blue.svg)](https://weblate.org/)
 [![Translation status](https://hosted.weblate.org/widgets/weblate/-/svg-badge.svg)](https://hosted.weblate.org/engage/weblate/?utm_source=widget)
 [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/552/badge)](https://bestpractices.coreinfrastructure.org/projects/552)
 [![PyPI package](https://img.shields.io/pypi/v/wlc.svg)](https://pypi.org/project/wlc/)
 [![Documentation](https://readthedocs.org/projects/weblate/badge/)](https://docs.weblate.org/en/latest/wlc.html)
 
+wlc is a [Weblate](https://weblate.org/) command-line client and Python library
+using [Weblate's REST API](https://docs.weblate.org/en/latest/api.html).
+
+<p>
+  <a href="https://weblate.org/">
+    <img alt="Weblate"
+         src="https://s.weblate.org/cdn/Logo-Darktext-borders.png"
+         height="55">
+  </a>
+</p>
+
+Part of [Weblate](https://weblate.org/) — a privacy-respecting localization platform built on open-source foundations.
+
 ## Installation
 
 Install wlc from PyPI:

{wlc-2.2.0 → wlc-3.0.0}/README.md

@@ -1,19 +1,24 @@
-<a href="https://weblate.org/"><img alt="Weblate" src="https://s.weblate.org/cdn/Logo-Darktext-borders.png" height="80px" /></a>
-
-**Weblate is libre software web-based continuous localization system,
-used by over 2500 libre projects and companies in more than 165 countries.**
-
 # wlc
 
-wlc is a [Weblate](https://weblate.org/) command-line client and Python library
-using [Weblate's REST API](https://docs.weblate.org/en/latest/api.html).
-
 [![Website](https://img.shields.io/badge/website-weblate.org-blue.svg)](https://weblate.org/)
 [![Translation status](https://hosted.weblate.org/widgets/weblate/-/svg-badge.svg)](https://hosted.weblate.org/engage/weblate/?utm_source=widget)
 [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/552/badge)](https://bestpractices.coreinfrastructure.org/projects/552)
 [![PyPI package](https://img.shields.io/pypi/v/wlc.svg)](https://pypi.org/project/wlc/)
 [![Documentation](https://readthedocs.org/projects/weblate/badge/)](https://docs.weblate.org/en/latest/wlc.html)
 
+wlc is a [Weblate](https://weblate.org/) command-line client and Python library
+using [Weblate's REST API](https://docs.weblate.org/en/latest/api.html).
+
+<p>
+  <a href="https://weblate.org/">
+    <img alt="Weblate"
+         src="https://s.weblate.org/cdn/Logo-Darktext-borders.png"
+         height="55">
+  </a>
+</p>
+
+Part of [Weblate](https://weblate.org/) — a privacy-respecting localization platform built on open-source foundations.
+
 ## Installation
 
 Install wlc from PyPI:

{wlc-2.2.0 → wlc-3.0.0}/THREAT_MODEL.md

@@ -2,11 +2,11 @@
 
 Project: wlc (Weblate command-line client and Python API client)
 
-Last reviewed for wlc 2.2.0 at base commit
-`1e63ad96951734ba26ba240f1ccfa80be4a8c645`, including the accompanying
-changes in this revision.
+Last reviewed for wlc 3.0.0 at base commit
+`3f09f18c634b8925b90df518f6fbd56af42d3381`, including the accompanying
+release changes in this revision.
 
-Date: 2026-09-01.
+Date: 2026-10-08.
 
 Status: Accepted, 2026-09-01.
 
@@ -276,12 +276,13 @@ code, Python runtime, or operating system. *(maintainer)*
 | Server-provided request targets remain on the configured API origin after normalization by the parser used by the HTTP transport. | The request goes through the `Weblate` client. Origin means scheme, normalized host, and effective port. | Pagination, refresh, repository, upload, download, or another response-derived URL causes a request to a different origin. | High when credentials or user data are sent; otherwise Medium. | *(documented)* (source: [client implementation](wlc/client.py), [URL tests](tests/test_urls.py)) |
 | HTTP redirects are not followed automatically. | The request goes through the `Weblate` client. | A 3xx response causes a follow-up request, or is accepted as a successful API response. | High when credentials or user data cross a boundary; otherwise Medium. | *(documented)* (source: [client implementation](wlc/client.py), [URL tests](tests/test_urls.py)) |
 | API keys are not sent over non-loopback cleartext HTTP by default. | A key is present and no trusted source explicitly enabled insecure HTTP. The request goes through the `Weblate` client. | The client sends the key to a non-loopback `http://` destination. | High. | *(documented)* (source: [client implementation](wlc/client.py), [HTTP tests](tests/test_insecure_http.py)) |
+| API keys containing carriage returns or line feeds are rejected before HTTP request construction. | The request goes through the `Weblate` client. | A key containing a line break reaches Requests header processing. | High. | *(documented)* (source: [client implementation](wlc/client.py), [client tests](tests/test_wlc.py), [CLI tests](tests/test_main.py)) |
 | TLS certificates are verified by default and verification exceptions are scoped to the selected origin. | The destination is HTTPS and no trusted source supplied a matching origin or explicit transient exception under the configuration rules. | Verification is disabled for an unrelated origin, or without an explicit trusted opt-in. | High. | *(documented)* (source: [configuration implementation](wlc/config.py), [client implementation](wlc/client.py), [TLS tests](tests/test_insecure_ssl.py)) |
 | Automatically discovered project configuration cannot enable authenticated insecure HTTP, disable TLS verification, or supply insecure origin entries. | The project file is discovered automatically rather than supplied as explicit configuration. | A project-only setting weakens HTTP or TLS transport, or a CLI/environment exception is accepted without a URL from the same source. | High. | *(documented)* (source: [configuration implementation](wlc/config.py), [configuration tests](tests/test_config.py)) |
 | An unscoped CLI or environment key cannot be paired with a project-selected URL unless that same source also pins the URL. | Automatic project discovery supplied the otherwise-effective URL. | `--key` is accepted without `--url`, or `WLC_KEY` is accepted without `WLC_URL`. | High. | *(documented)* (source: [configuration implementation](wlc/config.py), [configuration tests](tests/test_config.py)) |
 | Authentication is accepted only from configured API-key sources; Requests does not automatically add credentials from `.netrc` or the file named by `NETRC`, and credentials embedded in URLs are rejected. | The request goes through the `Weblate` client. | A repository-selected host causes Requests to add or replace authentication using a netrc file, or a URL containing userinfo produces an HTTP request. | High. | *(documented)* (source: [configuration documentation][configuration-docs], [client implementation](wlc/client.py), [client tests](tests/test_wlc.py), [URL tests](tests/test_urls.py)) |
 | An explicit `--config` file prevents automatic user and project configuration discovery. | The CLI successfully reads the explicit file. CLI/environment overrides still apply normally. | Settings from a discovered user or project file affect the configuration. | Medium. | *(documented)* (source: [configuration implementation](wlc/config.py), [configuration tests](tests/test_config.py)) |
-| wlc debug logging redacts authorization and proxy-authorization headers, scrubs their values from request-failure messages, and does not log request bodies or uploaded file contents. | Logging uses wlc's debug helpers. Parameter values can still be logged and must not be used for secrets. | A generated debug entry contains an API token, JSON/body values, or uploaded contents supplied only through the corresponding request fields. | High for credentials; otherwise Medium. | *(documented)* (source: [debug implementation](wlc/http_debug.py), [debug tests](tests/test_errors.py), [CLI debug tests](tests/test_main.py)) |
+| wlc CLI request errors and debug logging redact authorization values, and debug logging does not include request bodies or uploaded file contents. | Requests use the `Weblate` client and errors are rendered by the wlc CLI or debug helpers. Parameter values can still be logged and must not be used for secrets. | A CLI request error or generated debug entry contains an API token, JSON/body values, or uploaded contents supplied only through the corresponding request fields. | High for credentials; otherwise Medium. | *(documented)* (source: [CLI implementation](wlc/main.py), [debug implementation](wlc/http_debug.py), [debug tests](tests/test_errors.py), [CLI tests](tests/test_main.py)) |
 | Automatically generated component archive filenames cannot use server-provided slugs for path traversal. | wlc chooses the project/component download filename inside a user-selected directory. | A server-provided project or component slug writes outside that directory. | High. | *(documented)* (source: [filename helper](wlc/utils.py), [CLI implementation](wlc/main.py), [download tests](tests/test_download.py)) |
 | Download writes do not follow destination symlinks or overwrite non-regular or multiply linked targets, and destination replacement is checked against races. | The CLI writes a downloaded translation or automatically named archive through its download helper. The containing directory remains under local-user control. | A preplanted or racing symlink, hard link, changed inode, or non-regular destination redirects downloaded bytes to another file or device. | High. | *(documented)* (source: [CLI implementation](wlc/main.py), [download tests](tests/test_download.py)) |
 | Raw translation bytes are not written to an interactive terminal. | A translation download would use standard output and that stream reports itself as a TTY. | Binary translation data is emitted to the interactive terminal instead of being refused. | Medium. | *(documented)* (source: [CLI implementation](wlc/main.py), [CLI tests](tests/test_main.py)) |
@@ -308,7 +309,8 @@ code, Python runtime, or operating system. *(maintainer)*
 - Debug output is diagnostic data rather than a supported structured renderer.
   Header and request-body redaction does not imply terminal-control escaping or
   secrecy for request parameter values, URLs, response reason phrases, or error
-  messages included in diagnostics. *(maintainer)*
+  messages included in diagnostics other than configured authorization values.
+  *(maintainer)*
 - wlc does not enforce a response-size, pagination-count, aggregate-time,
   memory, disk-usage, or retry-cost limit against the selected server. The
   configured per-request timeout and retry policy are operational controls, not

{wlc-2.2.0 → wlc-3.0.0}/pyproject.toml

@@ -1,22 +1,22 @@
 [build-system]
 build-backend = "setuptools.build_meta"
-requires = ["setuptools>=78.0.2"]
+requires = ["setuptools>=83.0.0"]
 
 [dependency-groups]
 dev = [
-  {include-group = "lint"},
-  {include-group = "test"},
-  {include-group = "types"}
+  { include-group = "lint" },
+  { include-group = "test" },
+  { include-group = "types" }
 ]
 lint = [
-  {include-group = "pre-commit"},
-  {include-group = "pylint"}
+  { include-group = "pre-commit" },
+  { include-group = "pylint" }
 ]
 pre-commit = [
-  "prek==0.5.0"
+  "prek==0.5.4"
 ]
 pylint = [
-  "pylint==4.0.8"
+  "pylint==4.1.2"
 ]
 test = [
   "pytest-cov==7.1.0",
@@ -25,11 +25,11 @@ test = [
   "responses==0.26.3"
 ]
 types = [
-  "ty==0.0.77",
-  "mypy==2.3.1",
-  "types-pyxdg==0.28.0.20260518",
+  "ty==0.0.85",
+  "mypy==2.4.0",
+  "types-pyxdg==0.28.0.20261008",
   "types-python-dateutil==2.9.0.20260807",
-  "types-requests==2.33.0.20260712"
+  "types-requests==2.33.0.20261006"
 ]
 
 [project]
@@ -45,16 +45,19 @@ classifiers = [
   "Programming Language :: Python :: 3.12",
   "Programming Language :: Python :: 3.13",
   "Programming Language :: Python :: 3.14",
+  "Programming Language :: Python :: 3.15",
   "Topic :: Software Development :: Internationalization",
   "Topic :: Software Development :: Localization",
   "Topic :: Utilities"
 ]
 dependencies = [
   "argcomplete",
+  "certifi>=2026.7.22",
+  "idna>=3.15",
   "python-dateutil",
-  "pyxdg",
+  "pyxdg>=0.26",
   "requests>=2.33.0",
-  "urllib3>=2.7.0"
+  "urllib3>=2.8.0"
 ]
 description = "A command-line utility for Weblate, translation tool with tight version control integration"
 dynamic = ["version"]
@@ -105,7 +108,7 @@ ignore = [
 
 [tool.check-wheel-contents]
 ignore = [
-  "W002"  # Triggered by API mocks
+  "W002" # Triggered by API mocks
 ]
 
 [tool.coverage.paths]
@@ -134,15 +137,6 @@ exclude_also = [
 [tool.isort]
 profile = "black"
 
-[tool.pylint.main]
-disable = [
-  "too-many-instance-attributes",
-  "too-many-positional-arguments",
-  "too-many-arguments",
-  "missing-function-docstring",
-  "too-many-public-methods"
-]
-
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 
@@ -155,30 +149,16 @@ docstring-code-format = true
 [tool.ruff.lint]
 future-annotations = true
 ignore = [
-  "D10",  # TODO: we are missing many docstrings
-  "incorrect-blank-line-before-class",  # CONFIG: incompatible with D211
-  "multi-line-summary-first-line",  # CONFIG: incompatible with D213
-  "line-too-long",  # CONFIG: formatter
-  "non-imperative-mood",  # TODO: many strings need rephrasing
-  "print",  # WONTFIX: using print() (maybe add noqa)
-  "raise-vanilla-args",  # WONTFIX: Avoid specifying long messages outside the exception class
-  "too-many-arguments",  # WONTFIX: Too many arguments to function call
-  "magic-value-comparison",  # TODO: Magic value used in comparison, consider replacing 201 with a constant variable
-  "docstring-missing-returns",  # WONTFIX
-  "docstring-missing-yields",  # WONTFIX
-  "docstring-missing-exception",  # WONTFIX
-  "too-many-statements-in-try-clause",  # TODO
-  "subclass-builtin",  # TODO
-  "no-self-use",  # TODO
-  "too-many-public-methods",  # TODO
-  "read-whole-file",  # TODO
-  "COM",  # CONFIG: No trailing commas
-  "PT",  # CONFIG: Not using pytest
-  "PTH",  # TODO: Not using pathlib
-  "EM",  # TODO: Exception strings
-  "FBT",  # TODO: Boolean in function definition
-  "ANN",  # TODO: type annotations
-  "error-suffix-on-exception-name"  # TODO: exception naming
+  "incorrect-blank-line-before-class", # CONFIG: incompatible with D211
+  "multi-line-summary-first-line", # CONFIG: incompatible with D213
+  "line-too-long", # CONFIG: formatter
+  "raise-vanilla-args", # WONTFIX: Avoid specifying long messages outside the exception class
+  "too-many-arguments", # WONTFIX: Too many arguments to function call
+  "docstring-missing-returns", # WONTFIX
+  "docstring-missing-yields", # WONTFIX
+  "docstring-missing-exception", # WONTFIX
+  "COM", # CONFIG: No trailing commas
+  "PT" # CONFIG: Not using pytest
 ]
 preview = true
 select = ["ALL"]
@@ -188,8 +168,9 @@ min-file-size = 2
 # Copyright without a year, see https://github.com/astral-sh/ruff/issues/10062
 notice-rgx = "(?i)Copyright\\s+©\\s+"
 
-[tool.ruff.lint.mccabe]
-max-complexity = 16
+[tool.ruff.lint.per-file-ignores]
+# Test names describe their behavior and self might not be used there
+"tests/**" = ["D", "no-self-use"]
 
 [tool.rumdl]
 disable = [