yaga-cli 0.4.0__tar.gz → 0.4.1__tar.gz

{yaga_cli-0.4.0 → yaga_cli-0.4.1}/.github/workflows/ci.yml

@@ -145,7 +145,8 @@ jobs:
           - python-version: "3.15"
             os: windows-latest
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 10
+    # Include setup time and the complete process-heavy suite on Windows.
+    timeout-minutes: ${{ matrix.os == 'windows-latest' && 20 || 10 }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

{yaga_cli-0.4.0 → yaga_cli-0.4.1}/.gitignore

@@ -2,6 +2,8 @@ __pycache__/
 .pytest_cache/
 .ruff_cache/
 .venv/
+.artifacts/
+.cache/
 *.py[cod]
 .coverage
 *.egg-info/

{yaga_cli-0.4.0 → yaga_cli-0.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: yaga-cli
-Version: 0.4.0
+Version: 0.4.1
 Summary: Configurable developer workflow checks for local use and GitHub Actions
 Project-URL: Documentation, https://dariuszpanas.github.io/yaga/
 Project-URL: Changelog, https://dariuszpanas.github.io/yaga/changelog.html
@@ -21,6 +21,7 @@ Classifier: Programming Language :: Python :: 3.14
 Classifier: Programming Language :: Python :: 3.15
 Classifier: Topic :: Software Development :: Quality Assurance
 Requires-Python: >=3.12
+Requires-Dist: pygments<3,>=2.20.0
 Requires-Dist: pyyaml<7,>=6.0.3
 Requires-Dist: typer<1,>=0.27.2
 Provides-Extra: quality

{yaga_cli-0.4.0 → yaga_cli-0.4.1}/docs/changelog.md

@@ -2,6 +2,17 @@
 
 ## [Unreleased]
 
+## [0.4.1] - 2026-10-29
+
+### Fixed
+
+- Require `Pygments>=2.20.0,<3` in base package metadata so minimum-supported installs
+  exclude the versions affected by CVE-2022-40896 and CVE-2026-4539. This constrains the
+  existing Typer/Rich dependency; YAGA does not call the affected language lexers.
+- Check the dependency contract in both wheel and source-distribution metadata, and document
+  advisory auditing of the actual lowest-resolved dependencies before publication separately
+  from their functional CLI qualification.
+
 ## [0.4.0] - 2026-10-29
 
 ### Added

{yaga_cli-0.4.0 → yaga_cli-0.4.1}/docs/getting-started.md

@@ -1,6 +1,6 @@
 # Get started
 
-This guide covers **YAGA 0.4.0 (Beta)**. YAGA requires Python 3.12 or newer. Install the **`yaga-cli`** distribution from PyPI;
+This guide covers **YAGA 0.4.1 (Beta)**. YAGA requires Python 3.12 or newer. Install the **`yaga-cli`** distribution from PyPI;
 the executable and import package are **`yaga`**. The `yaga` distribution is an unrelated project.
 
 The core CLI is tested on Python 3.12 through 3.15. Python 3.15 installations currently use

{yaga_cli-0.4.0 → yaga_cli-0.4.1}/docs/minimum-runtime.md

@@ -42,3 +42,30 @@ of versions. Do not raise dependency floors just to match the development lock.
 This helper does not replace `uv run make ci`, the frozen platform matrix, or the strict build
 gate's hash-locked installation. It adds no hosted workload; a small hosted smoke can be considered
 when the Actions budget permits.
+
+## Security audit of the resolved dependencies
+
+Functional smoke success does not mean a dependency set is free of known advisories. Before
+publication, audit the exact installed versions recorded in the minimum-runtime receipt, in
+addition to auditing the release lock. Keep the audit output and the receipt together.
+
+Generate a requirements file from the receipt's `runtime.distributions` mapping, excluding
+`yaga-cli` itself, with one `name==version` per line. Audit those pins without installing them:
+
+```bash
+uv tool run --from pip-audit==2.10.1 pip-audit --no-deps --disable-pip --strict \
+  --requirement minimum-runtime-requirements.txt --format json --output minimum-runtime-audit.json
+```
+
+Require a successful audit with no skipped distributions or known advisories; inspect the JSON
+rather than treating an unavailable advisory service as a clean result. This command contacts the
+advisory service. It does not execute the recorded dependency versions or replace the installed
+smoke checks. Repeat the audit against the actual pins from fresh public-package installations,
+including lowest resolution, after publication. Retain the audit time because advisory data changes.
+
+YAGA 0.4.1 adds a base `Pygments>=2.20.0,<3` constraint to exclude the versions affected by
+[CVE-2022-40896](https://github.com/advisories/GHSA-mrwq-x4v8-fh7p) and
+[CVE-2026-4539](https://github.com/advisories/GHSA-5239-wwwm-4pmq). This is a security-driven floor
+for the existing Typer/Rich dependency, not an attempt to match every development-lock version.
+YAGA does not call the affected Smithy or ADL lexers; that reachability assessment does not waive
+the dependency audit.

{yaga_cli-0.4.0 → yaga_cli-0.4.1}/docs/releasing.md

@@ -48,16 +48,20 @@ package users. Twine's metadata check does not prove remote images or links are
    above it. The Beta classifier is a maturity label; version `0.1.0` is a normal PyPI version,
    not the PEP 440 prerelease `0.1.0b1`. Use `YAGA 0.1.0` as the GitHub Release title;
    keep the maturity label in package metadata rather than appending `(Beta)` to the title.
-2. Merge the release changes and require all hosted CI lanes to pass for the exact commit,
+2. Run [minimum runtime qualification](minimum-runtime.md) and audit the exact recorded
+   dependency pins with no skipped distributions or known advisories. Also audit the release
+   lock; functional smoke and locked-dependency success do not qualify the lowest set.
+3. Merge the release changes and require all hosted CI lanes to pass for the exact commit,
    including Windows. Resolve dependency PR failures before choosing the candidate.
-3. After publication is explicitly authorized, create and push the matching `v0.1.0` tag at that
+4. After publication is explicitly authorized, create and push the matching `v0.1.0` tag at that
    verified commit. Use the corresponding version for later releases.
-4. The workflow requires the tagged commit to be on the default branch, checks that the tag matches
+5. The workflow requires the tagged commit to be on the default branch, checks that the tag matches
    package metadata and a dated changelog entry, and reruns `uv run make ci`. Only then does it
    offer the `pypi` environment approval and upload the validated distributions with attestations.
-5. Verify the PyPI project files and install `yaga-cli==0.1.0` from PyPI in a clean tool environment.
+6. Verify the PyPI project files and install `yaga-cli==0.1.0` from PyPI in a clean tool environment.
    Confirm `yaga --help` and the automatically created GitHub Release. Its wheel and source
-   archive must be the same artifacts published to PyPI.
+   archive must be the same artifacts published to PyPI. Repeat the lowest-resolved installed
+   smoke and audit its actual dependency pins from the public package; retain both reports.
 
 This workflow accepts final `vMAJOR.MINOR.PATCH` tags and does not publish TestPyPI packages.
 After PyPI publication succeeds, a separate job creates the GitHub Release from the validated

{yaga_cli-0.4.0 → yaga_cli-0.4.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "yaga-cli"
-version = "0.4.0"
+version = "0.4.1"
 description = "Configurable developer workflow checks for local use and GitHub Actions"
 readme = "README.md"
 license = "BSD-3-Clause"
@@ -32,7 +32,9 @@ classifiers = [
     "Programming Language :: Python :: 3.15",
     "Topic :: Software Development :: Quality Assurance",
 ]
+# Keep the transitive renderer dependency above the known lexer advisory floors.
 dependencies = [
+    "pygments>=2.20.0,<3",
     "pyyaml>=6.0.3,<7",
     "typer>=0.27.2,<1",
 ]

yaga_cli-0.4.1/release-notes.md

@@ -0,0 +1,10 @@
+### Fixed
+
+- Require `Pygments>=2.20.0,<3` in base package metadata so minimum-supported installs
+  exclude the versions affected by CVE-2022-40896 and CVE-2026-4539. This constrains the
+  existing Typer/Rich dependency; YAGA does not call the affected language lexers.
+- Check the dependency contract in both wheel and source-distribution metadata, and document
+  advisory auditing of the actual lowest-resolved dependencies before publication separately
+  from their functional CLI qualification.
+
+[PyPI](https://pypi.org/project/yaga-cli/0.4.1/)

{yaga_cli-0.4.0 → yaga_cli-0.4.1}/scripts/check_build.py

@@ -24,8 +24,9 @@ else:
 
 ROOT = Path(__file__).resolve().parents[1]
 MAX_SMOKE_OUTPUT_BYTES = 65_536
+MAX_DISTRIBUTION_METADATA_BYTES = 1024 * 1024
 SMOKE_MESSAGE = "feat(build): execute the built wheel"
-EXPECTED_REQUIRES_DIST = ["pyyaml<7,>=6.0.3", "typer<1,>=0.27.2"]
+EXPECTED_REQUIRES_DIST = ["pygments<3,>=2.20.0", "pyyaml<7,>=6.0.3", "typer<1,>=0.27.2"]
 EXPECTED_OPTIONAL_REQUIRES_DIST = [
     "boto3<2,>=1.37; extra == 'quality-bedrock'",
     "certifi>=2026.10.19; extra == 'quality'",
@@ -213,6 +214,33 @@ def validate_wheel_metadata(raw: bytes) -> None:
     validate_description(payload.decode("utf-8"))
 
 
+def validate_sdist_metadata(source_distribution: tarfile.TarFile) -> None:
+    """Require one bounded root metadata file with the same contract as the wheel."""
+    members = [
+        member
+        for member in source_distribution.getmembers()
+        if member.name.rsplit("/", 1)[-1] == "PKG-INFO"
+    ]
+    if len(members) != 1:
+        raise SystemExit("source distribution must contain exactly one metadata document")
+    member = members[0]
+    if (
+        member.name.count("/") != 1
+        or not member.name.startswith("yaga_cli-")
+        or not member.isfile()
+        or not 0 < member.size <= MAX_DISTRIBUTION_METADATA_BYTES
+    ):
+        raise SystemExit("source distribution metadata must be a bounded regular root file")
+    metadata_file = source_distribution.extractfile(member)
+    if metadata_file is None:
+        raise SystemExit("source distribution metadata could not be read")
+    with metadata_file:
+        raw = metadata_file.read(MAX_DISTRIBUTION_METADATA_BYTES + 1)
+    if len(raw) != member.size:
+        raise SystemExit("source distribution metadata size does not match its header")
+    validate_wheel_metadata(raw)
+
+
 def run_bounded(
     command: list[str],
     *,
@@ -1720,6 +1748,7 @@ def main() -> int:
                 raise SystemExit("wheel must contain exactly one metadata document")
             validate_wheel_metadata(wheel.read(metadata_paths[0]))
         with tarfile.open(source_distributions[0], mode="r:gz") as source_distribution:
+            validate_sdist_metadata(source_distribution)
             names = source_distribution.getnames()
             required_suffixes = {
                 "/action.yml": "the composite Action",

{yaga_cli-0.4.0 → yaga_cli-0.4.1}/src/yaga/version_requirement.py

@@ -7,7 +7,7 @@ import re
 from yaga.errors import ConfigurationError
 
 # Keep this equal to project.version; the build contract tests enforce that boundary.
-VERSION = "0.4.0"
+VERSION = "0.4.1"
 _RELEASE = r"(0|[1-9][0-9]{0,8})\.(0|[1-9][0-9]{0,8})\.(0|[1-9][0-9]{0,8})"
 _CLAUSE = re.compile(r"(>=|<=|==|!=|>|<)\s*" + _RELEASE, re.ASCII)
 

{yaga_cli-0.4.0 → yaga_cli-0.4.1}/tests/test_cli.py

@@ -193,7 +193,7 @@ def test_version_is_available_from_the_installed_command() -> None:
     result = runner.invoke(app, ["--version"])
 
     assert result.exit_code == 0
-    assert result.stdout.strip() == "yaga 0.4.0"
+    assert result.stdout.strip() == "yaga 0.4.1"
 
 
 def test_github_pull_request_command_requires_explicit_signature_opt_out_for_unsigned_bot(

{yaga_cli-0.4.0 → yaga_cli-0.4.1}/tests/test_git_runtime.py

@@ -561,15 +561,24 @@ def test_blocked_input_writer_shares_process_timeout() -> None:
     assert time.monotonic() - before < 2
 
 
+@pytest.mark.parametrize("startup_delay", [0.0, 0.8])
 def test_timeout_terminates_pipe_holding_descendants_within_a_bounded_cleanup(
     tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    startup_delay: float,
 ) -> None:
     started = tmp_path / "timeout-child-started"
+    armed = tmp_path / "timeout-child-armed"
     survived = tmp_path / "timeout-child-survived"
     child_code = (
         "import pathlib,time; "
+        f"time.sleep({startup_delay!r}); "
         f"pathlib.Path({str(started)!r}).write_text('started'); "
-        "time.sleep(1.0); "
+        f"armed=pathlib.Path({str(armed)!r}); "
+        "deadline=time.monotonic()+10; "
+        "\nwhile not armed.exists() and time.monotonic() < deadline: time.sleep(0.01); "
+        "\nif not armed.exists(): raise SystemExit(2)"
+        "\ntime.sleep(1.0); "
         f"pathlib.Path({str(survived)!r}).write_text('survived')"
     )
     parent_code = (
@@ -578,9 +587,43 @@ def test_timeout_terminates_pipe_holding_descendants_within_a_bounded_cleanup(
         f"started=pathlib.Path({str(started)!r}); "
         "deadline=time.monotonic()+5; "
         "\nwhile not started.exists() and time.monotonic() < deadline: time.sleep(0.01); "
+        "\nif not started.exists(): raise SystemExit(2)"
         "\nprint('spawned', flush=True)"
     )
 
+    real_open_process_tree = runtime.open_process_tree
+    ready_at: float | None = None
+
+    class ReadyProcessTree:
+        def __init__(self) -> None:
+            self.tree = real_open_process_tree()
+
+        def creation_flags(self) -> int:
+            return self.tree.creation_flags()
+
+        def starts_new_session(self) -> bool:
+            return self.tree.starts_new_session()
+
+        def attach_and_start(self, process: subprocess.Popen[bytes]) -> None:
+            nonlocal ready_at
+            self.tree.attach_and_start(process)
+            startup_deadline = time.monotonic() + 5.0
+            while process.poll() is None and time.monotonic() < startup_deadline:
+                time.sleep(0.01)
+            if process.poll() != 0 or not started.exists():
+                raise OSError("test setup did not establish a ready pipe-holding descendant")
+            # Begin the real timeout only after both interpreters have started and the
+            # parent has exited. The descendant's survival clock must start here too.
+            armed.write_text("armed")
+            ready_at = time.monotonic()
+
+        def terminate(self, process: subprocess.Popen[bytes]) -> None:
+            self.tree.terminate(process)
+
+        def close(self) -> None:
+            self.tree.close()
+
+    monkeypatch.setattr(runtime, "open_process_tree", ReadyProcessTree)
     before = time.monotonic()
     result = runtime._run_bounded(
         [sys.executable, "-c", parent_code],
@@ -588,12 +631,16 @@ def test_timeout_terminates_pipe_holding_descendants_within_a_bounded_cleanup(
         stderr_limit=1024,
         timeout_seconds=0.6,
     )
-    elapsed = time.monotonic() - before
+    returned_at = time.monotonic()
 
+    assert result.returncode == 0
     assert result.timed_out
     expected_output = b"spawned\r\n" if os.name == "nt" else b"spawned\n"
     assert result.stdout == expected_output
-    assert elapsed < 2.0
+    assert result.stderr == b""
+    assert ready_at is not None
+    assert returned_at - ready_at < 2.0
+    assert returned_at - before < 7.0
     assert started.exists()
     time.sleep(0.6)
     assert not survived.exists()

{yaga_cli-0.4.0 → yaga_cli-0.4.1}/tests/test_installation.py

@@ -68,7 +68,7 @@ def test_windows_worker_waits_and_reports_completion(tmp_path: Path) -> None:
     assert not worker.exists()
 
 
-@pytest.mark.parametrize("requirement", [">=0.1.0", "==0.4.0", ">0.0.9, <1.0.0", "!=2.0.0"])
+@pytest.mark.parametrize("requirement", [">=0.1.0", "==0.4.1", ">0.0.9, <1.0.0", "!=2.0.0"])
 def test_requirement_accepts_current_release(requirement: str) -> None:
     assert check_requirement(requirement) == requirement
 
@@ -82,7 +82,7 @@ def test_requirement_rejects_invalid_syntax(requirement: object) -> None:
         check_requirement(requirement)
 
 
-@pytest.mark.parametrize("requirement", [">0.4.0", "<0.1.0", ">=1.0.0", "!=0.4.0"])
+@pytest.mark.parametrize("requirement", [">0.4.1", "<0.1.0", ">=1.0.0", "!=0.4.1"])
 def test_requirement_rejects_incompatible_release(requirement: str) -> None:
     with pytest.raises(ConfigurationError, match="does not satisfy"):
         check_requirement(requirement)

{yaga_cli-0.4.0 → yaga_cli-0.4.1}/tests/test_tooling.py

@@ -5,7 +5,9 @@ from __future__ import annotations
 import os
 import re
 import sys
+import tarfile
 import tomllib
+from io import BytesIO
 from pathlib import Path
 
 import pytest
@@ -28,6 +30,7 @@ def test_toolchain_supply_chain_inputs_are_exactly_pinned() -> None:
     assert project["project"]["name"] == "yaga-cli"
     assert project["project"]["scripts"] == {"yaga": "yaga.cli:main"}
     assert project["project"]["dependencies"] == [
+        "pygments>=2.20.0,<3",
         "pyyaml>=6.0.3,<7",
         "typer>=0.27.2,<1",
     ]
@@ -218,7 +221,12 @@ def test_toolchain_supply_chain_inputs_are_exactly_pinned() -> None:
     ):
         assert f'"{locked_argument}"' in build_gate
     assert '"--no-hashes"' not in build_gate
-    assert 'EXPECTED_REQUIRES_DIST = ["pyyaml<7,>=6.0.3", "typer<1,>=0.27.2"]' in build_gate
+    assert check_build.EXPECTED_REQUIRES_DIST == [
+        "pygments<3,>=2.20.0",
+        "pyyaml<7,>=6.0.3",
+        "typer<1,>=0.27.2",
+    ]
+    assert "validate_sdist_metadata(source_distribution)" in build_gate
     assert '"PYTHONPATH"' in build_gate
     assert '"YAGA_ACTION_RUNTIME"' in build_gate
     assert "cwd=consumer" in build_gate
@@ -338,11 +346,13 @@ def test_toolchain_supply_chain_inputs_are_exactly_pinned() -> None:
     assert '"--format",\n            "json"' in build_gate
 
 
-def test_wheel_metadata_must_advertise_the_locked_runtime() -> None:
-    valid = (
+@pytest.fixture
+def runtime_metadata() -> bytes:
+    return (
         b"Metadata-Version: 2.4\n"
         b"Requires-Python: >=3.12\n"
         b"Description-Content-Type: text/markdown\n"
+        b"Requires-Dist: pygments<3,>=2.20.0\n"
         b"Requires-Dist: pyyaml<7,>=6.0.3\n"
         b"Requires-Dist: typer<1,>=0.27.2\n"
         b"Requires-Dist: boto3<2,>=1.37; extra == 'quality-bedrock'\n"
@@ -353,9 +363,17 @@ def test_wheel_metadata_must_advertise_the_locked_runtime() -> None:
         b'<img src="https://dariuszpanas.github.io/yaga/assets/branding/'
         b'isometric_terminal_y_logo_transparent.png" alt="YAGA terminal Y logo">'
     )
+
+
+def test_wheel_metadata_must_advertise_the_locked_runtime(runtime_metadata: bytes) -> None:
+    valid = runtime_metadata
     check_build.validate_wheel_metadata(valid)
 
     for malformed in (
+        valid.replace(b"Requires-Dist: pygments<3,>=2.20.0\n", b""),
+        valid.replace(b"pygments<3,>=2.20.0", b"pygments<3,>=2.13.0"),
+        valid.replace(b"pygments<3,>=2.20.0", b"pygments>=2.20.0"),
+        valid.replace(b"pygments<3,>=2.20.0", b"pygments<3,>=2.20.0; extra == 'quality'"),
         valid.replace(b"Requires-Dist: pyyaml<7,>=6.0.3\n", b""),
         valid.replace(b"Requires-Dist: typer<1,>=0.27.2\n", b""),
         valid.replace(b"pyyaml<7,>=6.0.3", b"pyyaml>=6.0.3"),
@@ -376,6 +394,63 @@ def test_wheel_metadata_must_advertise_the_locked_runtime() -> None:
             check_build.validate_wheel_metadata(malformed)
 
 
+def _sdist_metadata_archive(
+    metadata: bytes,
+    *,
+    names: tuple[str, ...] = ("yaga_cli-0.0.0/PKG-INFO",),
+    entry_type: bytes = tarfile.REGTYPE,
+) -> BytesIO:
+    stream = BytesIO()
+    with tarfile.open(fileobj=stream, mode="w") as archive:
+        for name in names:
+            member = tarfile.TarInfo(name)
+            member.type = entry_type
+            member.linkname = "outside-metadata"
+            member.size = len(metadata) if member.isfile() else 0
+            archive.addfile(member, BytesIO(metadata) if member.isfile() else None)
+    stream.seek(0)
+    return stream
+
+
+def test_sdist_metadata_enforces_the_same_runtime_floor(runtime_metadata: bytes) -> None:
+    with tarfile.open(fileobj=_sdist_metadata_archive(runtime_metadata)) as archive:
+        check_build.validate_sdist_metadata(archive)
+    weakened = runtime_metadata.replace(b"pygments<3,>=2.20.0", b"pygments<3,>=2.13.0")
+    with tarfile.open(fileobj=_sdist_metadata_archive(weakened)) as archive:
+        with pytest.raises(SystemExit, match="runtime dependency metadata"):
+            check_build.validate_sdist_metadata(archive)
+
+
+@pytest.mark.parametrize(
+    "names",
+    [(), ("yaga_cli-0.0.0/PKG-INFO",) * 2, ("yaga_cli-0.0.0/nested/PKG-INFO",)],
+)
+def test_sdist_metadata_must_be_unique_at_the_root(
+    runtime_metadata: bytes, names: tuple[str, ...]
+) -> None:
+    with tarfile.open(fileobj=_sdist_metadata_archive(runtime_metadata, names=names)) as archive:
+        with pytest.raises(SystemExit, match="metadata"):
+            check_build.validate_sdist_metadata(archive)
+
+
+@pytest.mark.parametrize("entry_type", [tarfile.SYMTYPE, tarfile.LNKTYPE, tarfile.DIRTYPE])
+def test_sdist_metadata_must_not_follow_links_or_directories(
+    runtime_metadata: bytes, entry_type: bytes
+) -> None:
+    with tarfile.open(
+        fileobj=_sdist_metadata_archive(runtime_metadata, entry_type=entry_type)
+    ) as archive:
+        with pytest.raises(SystemExit, match="regular root file"):
+            check_build.validate_sdist_metadata(archive)
+
+
+def test_sdist_metadata_has_a_byte_limit() -> None:
+    oversized = b"x" * (check_build.MAX_DISTRIBUTION_METADATA_BYTES + 1)
+    with tarfile.open(fileobj=_sdist_metadata_archive(oversized)) as archive:
+        with pytest.raises(SystemExit, match="bounded"):
+            check_build.validate_sdist_metadata(archive)
+
+
 @pytest.mark.parametrize("stream", ["stdout", "stderr"])
 def test_wheel_smoke_process_output_is_bounded(tmp_path: Path, stream: str) -> None:
     command = [

{yaga_cli-0.4.0 → yaga_cli-0.4.1}/uv.lock

@@ -1203,9 +1203,10 @@ wheels = [
 
 [[package]]
 name = "yaga-cli"
-version = "0.4.0"
+version = "0.4.1"
 source = { editable = "." }
 dependencies = [
+    { name = "pygments" },
     { name = "pyyaml" },
     { name = "typer" },
 ]
@@ -1236,6 +1237,7 @@ dev = [
 requires-dist = [
     { name = "boto3", marker = "extra == 'quality-bedrock'", specifier = ">=1.37,<2" },
     { name = "certifi", marker = "extra == 'quality'", specifier = ">=2026.10.19" },
+    { name = "pygments", specifier = ">=2.20.0,<3" },
     { name = "pyyaml", specifier = ">=6.0.3,<7" },
     { name = "torch", marker = "sys_platform == 'linux' and extra == 'quality'", specifier = ">=2.13,<3", index = "https://download.pytorch.org/whl/cpu" },
     { name = "torch", marker = "sys_platform != 'linux' and extra == 'quality'", specifier = ">=2.13,<3" },

yaga_cli-0.4.0/release-notes.md

@@ -1,58 +0,0 @@
-### Added
-
-- Add installed `pull-request description check` and `github pull-request description check`
-  commands for explicit Markdown files, stdin, and GitHub event bodies. Version-one policies
-  check meaningful content, word and character limits, unfinished placeholders, optional task
-  completion, and isolated Typos spelling. Explicit templates require ordered, filled sections
-  and replacement of unchanged prompts. Reports support text, JSON, and GitHub annotations;
-  existing commit checks and composite Actions retain their separate contracts.
-
-- Check description heading structure even without a template. Default to H2 or deeper and at
-  most 120 heading-text characters; reject empty headings and raw HTML heading tags. Recognize
-  top-level Setext headings so a whole paragraph formatted as an H1 or H2 cannot count as prose.
-  Reject templates whose headings conflict with the selected policy.
-
-- Detect suspicious invisible characters, prose tabs, literal escaped line breaks, and unmatched
-  backticks outside code and comments. Reject bare carriage returns and identify unsupported
-  control characters without rendering them. Document literal UTF-8 file authoring to preserve
-  Markdown through shell commands.
-
-- Add `pull-request description check --pr` for the current body of an existing GitHub pull
-  request. Accept an explicit URL or a number with `--repo`, fetch through the installed
-  authenticated `gh` CLI with bounded process execution, and run the same policy/template checks
-  without a checkout or Actions. File, stdin, and event checks remain offline.
-
-- Add a separate minimum-runtime qualification helper that builds a fresh base wheel, installs
-  the lowest resolved runtime dependencies outside the checkout, checks installed imports, and
-  runs the shared CLI smoke checks. Its JSON receipt records actual versions and the wheel hash;
-  the frozen-lock matrix and strict package build gate remain required.
-
-- Make source types, prerequisites, network behavior, reports, repository-plan membership, and
-  Action availability discoverable from installed help and the command guide, with tested local
-  and complete-PR recipes.
-
-- Document the staged-check design assessment, including index semantics, report compatibility,
-  and implementation acceptance criteria. Staged execution is not included in this release.
-
-### Fixed
-
-- Reject Git object-path selectors in changed-path range endpoints before repository access, so
-  a crafted gitlink cannot redirect the selected comparison and hide policy findings.
-
-- Isolate installed-wheel smoke Git setup from ambient repository variables, user/system
-  configuration, and templates, preserving unrelated repositories during qualification.
-
-- Allow an explicit `CHANGE_RANGE` override for local `make ci` qualification. Document the
-  independent full commit range check and the default last-commit-only comparison.
-
-- Require `certifi>=2026.10.19` in the published `quality` extra, including wheel metadata, to
-  prevent supported model-download stacks retaining older affected certificate bundles. This
-  applies when installing/upgrading with the extra; base and Bedrock requirements are unchanged.
-
-- Reject inconsistent Typos success/finding responses instead of silently accepting unexpected
-  output as a clean spelling result.
-
-- Correct the documented repository-plan key, stdout/stderr capture, lifecycle exit codes,
-  quality-provider help, and the fixed GitHub Action's rejecting policy-file input.
-
-[PyPI](https://pypi.org/project/yaga-cli/0.4.0/)