release: v0.3.0 — insecure-deserialization check, Apache-2.0 - #23
Merged
Conversation
Rolls Unreleased into 0.3.0, bumps pyproject to match, and moves the two install
pins that name the current release (the README and the composite action's default).
The moving `v1` tag needs repointing after this tag lands. release.yml already
documents that as the practice ("the moving major tag `v1` is repointed on each
release"), but it had not happened since v0.1.2 — `v1` still points at c5ab468,
ten commits and two minor releases back, which predates the Signetry rename. Anyone
pinning Signetry/reviewer@v1 has been getting pre-rename code, including the site's
own front page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cuts signetry-reviewer v0.3.0: the
deser.introducedcheck and the Apache-2.0relicense.
Unreleased→[0.3.0] — 2026-09-01,pyproject.toml→0.3.0, and the two pinsthat name the current release move with it — the README install command and the
composite action's default (
action.yml, theelsebranch used when a caller passesno
versioninput). Localruff+pytestgreen.v1has stopped movingrelease.ymlalready states the practice: "the moving major tagv1is repointed oneach release and must NOT trigger this workflow". It has not been repointed since
v0.1.2—v1currently points atc5ab468, ten commits and two minor releasesback, which is before the Signetry rename (
5f2e4f0,cd3bea0).So every consumer pinning
Signetry/reviewer@v1has been resolving pre-rename code —including this project's own landing page, which advertises
@v1as the way thereviewer is consumed.
v1gets repointed tov0.3.0once this merges and the tag is cut.Worth noting for later: the site's version check validates a
@vNpin only forexistence, deliberately not for currency, so it passed green throughout. That rule is
right for a genuinely moving tag, but it cannot detect one that has stopped moving.