⚠️ SECURITY-#300: Bump vulnerable transitive deps flagged by Dependabot

.github/actions/verify-version/action.yml

@@ -0,0 +1,30 @@
+name: Verify Version
+description: Verify LAST_VERSION matches pyproject.toml and __init__.py
+
+inputs:
+  expected:
+    description: Expected version to check against (defaults to __init__.py version)
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - name: 🔍 Verify version
+      shell: bash
+      run: |
+        EXPECTED="${{ inputs.expected }}"
+        EXPECTED="${EXPECTED#v}"
+        if [ -z "$EXPECTED" ]; then
+          EXPECTED=$(grep -m1 '^__version__ = ' dotflow/__init__.py | sed 's/^__version__ = "\(.*\)"/\1/')
+        fi
+
+        echo "Expected version: $EXPECTED"
+        echo "LAST_VERSION: $(cat LAST_VERSION)"
+        echo "pyproject.toml: $(grep '^version = ' pyproject.toml | head -1)"
+        echo "__init__.py: $(grep '^__version__ = ' dotflow/__init__.py)"
+
+        if [ "$(cat LAST_VERSION)" != "$EXPECTED" ]; then
+          echo "ERROR: Version mismatch!"
+          exit 1
+        fi

.github/workflows/python-publish-pypi-test.yml

@@ -30,6 +30,9 @@ jobs:
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: 🔍 Verify version
+        uses: ./.github/actions/verify-version
+
       - name: 📦 Build Package
         uses: ./.github/actions/build-package
         with:

.github/workflows/python-publish-pypi.yml

@@ -108,18 +108,9 @@ jobs:
           git pull origin ${{ steps.get_branch_deploy.outputs.branch }}
 
       - name: 🔍 Verify version
-        run: |
-          EXPECTED="${{ github.event.release.tag_name }}"
-          EXPECTED="${EXPECTED#v}"
-          echo "Expected version: $EXPECTED"
-          echo "LAST_VERSION: $(cat LAST_VERSION)"
-          echo "pyproject.toml: $(grep '^version = ' pyproject.toml | head -1)"
-          echo "__init__.py: $(grep '^__version__ = ' dotflow/__init__.py)"
-
-          if [ "$(cat LAST_VERSION)" != "$EXPECTED" ]; then
-            echo "ERROR: Version mismatch!"
-            exit 1
-          fi
+        uses: ./.github/actions/verify-version
+        with:
+          expected: ${{ github.event.release.tag_name }}
 
       - name: 📦 Build Package
         uses: ./.github/actions/build-package

docs/nav/development/release-notes.md

@@ -1,5 +1,10 @@
 # Release Notes
 
+## v1.0.1
+
+- [📦 PyPI - Build 1.0.1](https://test.pypi.org/project/dotflow/1.0.1)
+- [⚠️ Security: Bump vulnerable transitive deps flagged by Dependabot (#300)](https://github.com/dotflow-io/dotflow/pull/301)
+
 ## v1.0.0
 
 - [📦 PyPI - Build 1.0.0](https://test.pypi.org/project/dotflow/1.0.0)