Tags: kospex/kospex

release: kospex 0.1.0

Bump version to 0.1.0 and date the CHANGELOG.

- pyproject.toml 0.0.40 -> 0.1.0 (single source of truth)
- CHANGELOG Unreleased -> 0.1.0 - 2026-09-11; the upgrade-notes count
  corrected from eight to ten
- click 8.3.1 -> 8.3.3 for CVE-2026-7246 (GHSA-47fr-3ffg-hgmw), command
  injection in click.edit() (CWE-78). kospex does not call click.edit(),
  but the exact pin forced the vulnerable version onto every install.
- npm audit fix: postcss-selector-parser 6.1.2 -> 6.1.4
  (GHSA-w9m9-85wc-3x92, uncontrolled recursion); static assets rebuilt
  and unchanged
- requirements.txt regenerated from a clean wheel venv and matched to the
  SBOM. It now includes pip, which sqlite-utils 4.x requires and which the
  old freeze filter dropped.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01PqQL97UAbixkkEEXXpSBrQ

release: kospex 0.0.40

Bump version to 0.0.40 and date the CHANGELOG.

- pyproject.toml 0.0.39 -> 0.0.40 (single source of truth)
- CHANGELOG [Unreleased] -> 0.0.40 - 2026-07-27
- npm audit fix: postcss 8.5.14 -> 8.5.23 (GHSA-r28c-9q8g-f849,
  path traversal via sourceMappingURL), nanoid 3.3.11 -> 3.3.16;
  static assets rebuilt via npm run build
- requirements.txt regenerated from a clean venv

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

release: bump version to 0.0.39, restore templates/static to wheel

0.0.38's wheel shipped no template/static assets (kweb2 routes raised
TemplateNotFound) because [tool.setuptools.packages.find] include =
["kospex*"] excluded the sibling src/templates and src/static dirs.
Extend include to ["kospex*","templates*","static*"] + namespaces = true.
Verified: wheel contains 50 templates + 8 static assets, confirmed in a
clean Linux wheel install (Docker rockylinux:9).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

release: regenerate requirements.txt for 0.0.38

Refresh from a clean Docker venv as part of pre-release validation.
Captures transitive bumps (certifi, idna, platformdirs, python-multipart,
starlette 1.0.0->1.3.1, wcwidth) and confirms panopticas==0.0.16. Stripped
the self-referential editable kospex line that pip freeze emits.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Bump date on v0.0.37

Release 0.0.36 — changelog, docs, requirements, and version bump

Bumped version to 0.0.36. Updated CHANGELOG.md with full release notes.
Updated CLAUDE.md with kospex stats and kgit sync-repo docs.
Refreshed requirements.txt from clean Docker install.
Added release plan and git-ingest change documentation.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>