Skip to content

chore: finalize 8.0.1 notes and repair CodeQL validation #464

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vinitkumar merged 1 commit into from
Oct 16, 2026
Merged

chore: finalize 8.0.1 notes and repair CodeQL validation #464

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,6 @@ jobs:
uses: github/codeql-action/autobuild@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
with:
category: "/language:${{ matrix.language }}"
2 changes: 1 addition & 1 deletion HISTORY.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
8.0.1 / Unreleased
8.0.1 / 2026-10-16
==================

* security: require ``urllib3>=2.8.0`` to exclude versions affected by CVE-2026-97687, CVE-2026-97688, and CVE-2026-97689 (PR #456)
Expand Down
12 changes: 9 additions & 3 deletions RELEASE_NOTES.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# json2xml 8.0.1

Unreleased — publication date will be recorded when the release is scheduled.
Release date: 2026-10-16. Publication is pending final validation.

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Keep the release marked unreleased until final validation

This records a release date even though RELEASE_NOTES.md:37-39 says validation is still pending and publication must remain blocked. The deployment checklist in CONTRIBUTING.rst:191-201 requires replacing the unreleased markers only when publishing the verified commit; if validation fails or publication slips past October 16, both this line and the matching HISTORY.rst entry will falsely describe an unpublished release as dated. Leave both markers unreleased until the final checks pass and the GitHub release is ready to publish.

Useful? React with 👍 / 👎.


## Security fixes

Expand Down Expand Up @@ -32,13 +32,19 @@ Downstream projects that maintain their own lockfiles should regenerate them and

The security fix in [PR #456](https://github.com/vinitkumar/json2xml/pull/456) passed all 37 reported GitHub checks and the Snyk and Read the Docs commit statuses. Hosted tests covered CPython 3.11–3.15, free-threaded 3.14, and PyPy 3.11 across Linux, macOS, Windows, and Linux ARM64 where configured.

Local validation of that fix passed Ruff, ty, 509 Python tests with 149 optional Rust tests skipped, and 100% statement coverage. The locked dependency audit and wheel/source builds passed. Native Rust tests were not run locally because Cargo was unavailable; no Rust sources changed.
Previously recorded validation of PR #456 (not rerun in this release environment) passed Ruff, ty, 509 Python tests with 149 optional Rust tests skipped, and 100% statement coverage. The locked dependency audit and wheel/source builds passed. Native Rust tests were not run locally because Cargo was unavailable; no Rust sources changed.

The 8.0.1 release preparation also passed local Ruff, ty, 509 tests with 149 optional Rust tests skipped, 100% statement coverage, lockfile validation, the dependency audit, and architecture documentation checks. Both built distributions passed Twine metadata checks and declare version 8.0.1, Python >=3.11, and urllib3>=2.8.0. The release commit's hosted CI must pass before publication; record those results and the publication date before publishing.
Previously recorded PR #457 preparation validation (not verification of the final release commit) passed local Ruff, ty, 509 tests with 149 optional Rust tests skipped, 100% statement coverage, lockfile validation, the dependency audit, and architecture documentation checks. Both built distributions passed Twine metadata checks and declare version 8.0.1, Python >=3.11, and urllib3>=2.8.0. Final release validation remains pending. On 2026-10-16, remote master `a8f5d5ed0fa802f47a25583f7538243c51bcb5bd` passed hosted Python tests and lint, but CodeQL failed because its analysis action used 4.38.2 with configuration generated by 4.38.3. This preparation aligns all CodeQL actions to 4.38.3; hosted checks must pass on the exact final commit before publication.

In the saved release environment, `uv lock --check` passed. `make check-all` could not install its locked dependencies because package downloads were blocked; Cargo and `lat` were unavailable. No new passing local tests, Rust tests, build, Twine, or architecture checks are claimed. Publication must remain blocked until the required final checks and package verification are completed.

@sourcery-ai sourcery-ai Bot Oct 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Medium · Current audit status is omitted

When the release environment's uv audit cannot reach OSV, the saved-environment summary records the lock check and blocked make check-all but omits that uv audit could not reach OSV, so readers cannot tell the release dependency audit still lacks a current result.

State explicitly that the current uv audit could not reach OSV and remains pending successful verification.

Prompt for AI agents 
In `RELEASE_NOTES.md` at line 39:

**Current audit status is omitted**

When the release environment's `uv audit` cannot reach OSV, the saved-environment summary records the lock check and blocked `make check-all` but omits that `uv audit` could not reach OSV, so readers cannot tell the release dependency audit still lacks a current result.

State explicitly that the current `uv audit` could not reach OSV and remains pending successful verification.


## Changelog

- [#456](https://github.com/vinitkumar/json2xml/pull/456): require urllib3 2.8.0 for security fixes.
- [#457](https://github.com/vinitkumar/json2xml/pull/457): prepare version metadata and security release documentation.
- [#458](https://github.com/vinitkumar/json2xml/pull/458): update documentation type hints dependency.
- [#459](https://github.com/vinitkumar/json2xml/pull/459), [#460](https://github.com/vinitkumar/json2xml/pull/460), and [#463](https://github.com/vinitkumar/json2xml/pull/463): update setup-uv and artifact actions.
- [#461](https://github.com/vinitkumar/json2xml/pull/461) and [#462](https://github.com/vinitkumar/json2xml/pull/462): update CodeQL initialization and autobuild; align analysis to the same 4.38.3 commit before release.
- [Full changelog from v8.0.0 to v8.0.1](https://github.com/vinitkumar/json2xml/compare/v8.0.0...v8.0.1) (available after the release tag is created).

Generate the GitHub release changelog from the previous **Python** tag, `v8.0.0`, and combine it with this release's curated security notes. Do not use a `rust-v*` tag as the comparison baseline.
Expand Down
Loading