From 0175e7698cf04e832aa5dcdd04cf90e8da6ecf25 Mon Sep 17 00:00:00 2001 From: harumiWeb Date: Sat, 26 Sep 2026 18:39:38 +0900 Subject: [PATCH 1/2] chore(release): bump version to 0.8.2 --- CHANGELOG.md | 4 ++++ pyproject.toml | 2 +- tasks/todo.md | 16 ++++++++++++++++ uv.lock | 2 +- 4 files changed, 22 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f99fa23..bfb4c19 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,10 @@ All notable changes to this project are documented in this file. This changelog ## [Unreleased] +## [0.8.2] - 2026-09-26 + +- Updated project dependencies to resolve the reported Dependabot vulnerability alerts. + ## [0.8.1] - 2026-05-14 - Applied security updates for dependent packages. diff --git a/pyproject.toml b/pyproject.toml index e4b87a1..b3cce54 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "exstruct" -version = "0.8.1" +version = "0.8.2" description = "Excel to structured JSON (tables, shapes, charts) for LLM/RAG pipelines" readme = "README.md" license = { file = "LICENSE" } diff --git a/tasks/todo.md b/tasks/todo.md index f715f77..00b789c 100644 --- a/tasks/todo.md +++ b/tasks/todo.md @@ -1,5 +1,21 @@ # Todo +## 2026-09-26 Release v0.8.2 after dependency security updates + +### Planning + +- [x] Confirm dependency refresh PR #140 is merged into `main`. +- [x] Bump the package version and `uv.lock` to `0.8.2`; record the security update in `CHANGELOG.md`. +- [x] Check lockfile consistency and inspect the release diff. +- [ ] Create a release PR against `main` and verify its saved description. + +### Review + +- `pyproject.toml` and the editable `exstruct` entry in `uv.lock` are both `0.8.2`. +- Added a `0.8.2` changelog entry dated 2026-09-26 describing the dependency security updates. +- Verification passed: `uv lock --check`, `uv run task precommit-run`, and `git -c core.whitespace=cr-at-eol diff --check`. +- The pytest suite was not run; this release PR changes package metadata and changelog only. + ## 2026-09-26 Dependabot alerts and Python dependency refresh ### Planning diff --git a/uv.lock b/uv.lock index 06f3579..896b22e 100644 --- a/uv.lock +++ b/uv.lock @@ -921,7 +921,7 @@ wheels = [ [[package]] name = "exstruct" -version = "0.8.1" +version = "0.8.2" source = { editable = "." } dependencies = [ { name = "defusedxml" }, From c966fe206cc60799934db8abcecd764a3785467b Mon Sep 17 00:00:00 2001 From: harumiWeb Date: Sat, 26 Sep 2026 18:41:57 +0900 Subject: [PATCH 2/2] docs: record v0.8.2 release PR --- tasks/todo.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tasks/todo.md b/tasks/todo.md index 00b789c..75a29cc 100644 --- a/tasks/todo.md +++ b/tasks/todo.md @@ -7,7 +7,7 @@ - [x] Confirm dependency refresh PR #140 is merged into `main`. - [x] Bump the package version and `uv.lock` to `0.8.2`; record the security update in `CHANGELOG.md`. - [x] Check lockfile consistency and inspect the release diff. -- [ ] Create a release PR against `main` and verify its saved description. +- [x] Create a release PR against `main` and verify its saved description. ### Review @@ -15,6 +15,7 @@ - Added a `0.8.2` changelog entry dated 2026-09-26 describing the dependency security updates. - Verification passed: `uv lock --check`, `uv run task precommit-run`, and `git -c core.whitespace=cr-at-eol diff --check`. - The pytest suite was not run; this release PR changes package metadata and changelog only. +- Opened [PR #141](https://github.com/harumiWeb/exstruct/pull/141) against `main`; read back and validated the saved PR body. Hosted checks were pending at initial inspection. ## 2026-09-26 Dependabot alerts and Python dependency refresh