From 2571a5ca3e281083ee9c6f24898a8d91b99f9a23 Mon Sep 17 00:00:00 2001 From: Hugo Date: Mon, 2 Nov 2026 05:03:07 +0100 Subject: [PATCH 1/3] docs(changelog): note the compatibility of the changes since 0.24.0 The filters a template's render reaches change with #284 and #285, and with them the advisories reported as exploitable-vulnerability, both ways; LineIndex is new in coretrace_python.source (#288). --- CHANGELOG.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5fec4c4..e72ba3a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,15 @@ ## Unreleased +### Compatibility and migration + +- The filters a template's render reaches change, and with them the advisories reported + as `exploitable-vulnerability` through a filter, which may appear or disappear: a + render now follows a cycle of includes as far as Django may render it (#284), and + places a template's blocks where its chain of extends places them (#285). +- Plugin API, additive: `coretrace_python.source.LineIndex` gives the line and column of + each offset of a text, lines counted as `lines_of` counts them (#288). + ### Templates - A cycle of includes no longer stops the collection of the filters a render reaches From eec0d4e4fdf1201f4f371f6b7c2a00234754e20f Mon Sep 17 00:00:00 2001 From: Hugo Date: Mon, 2 Nov 2026 05:03:07 +0100 Subject: [PATCH 2/3] docs(changelog): list the documentation changes since 0.24.0 --- CHANGELOG.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index e72ba3a..ac1b105 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -37,6 +37,11 @@ include, extends and load (#288): a template of 2 MB applying 160,000 filters took 50 s to analyse, and now takes 3 s. +### Documentation + +- `docs/usage.md` documents how a cycle of includes is followed (#284) and where the + chain of extends places a template's blocks (#285). + ## 0.24.0 (2026-10-23) ### Compatibility and migration From ea9f93c9a68196d5055e74da874d3584b03238a3 Mon Sep 17 00:00:00 2001 From: Hugo Date: Mon, 2 Nov 2026 05:03:07 +0100 Subject: [PATCH 3/3] chore: release 0.25.0 --- CHANGELOG.md | 2 +- docs/usage.md | 6 +++--- pyproject.toml | 2 +- src/coretrace_python/__init__.py | 2 +- tests/test_release.py | 2 +- 5 files changed, 7 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ac1b105..1d3cc5c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,6 @@ # Changelog -## Unreleased +## 0.25.0 (2026-11-01) ### Compatibility and migration diff --git a/docs/usage.md b/docs/usage.md index 04a1dfe..4877e0c 100644 --- a/docs/usage.md +++ b/docs/usage.md @@ -374,7 +374,7 @@ the directory of the checked file; a path outside it is printed as it is. ```json { "schema_version": 1, - "tool": {"name": "coretrace-python-analyzer", "version": "0.24.0"}, + "tool": {"name": "coretrace-python-analyzer", "version": "0.25.0"}, "root": "/home/me/project", "findings": [ { @@ -438,7 +438,7 @@ bytes. A single-file check lists no components. ```json "tool": { - "name": "coretrace-python-analyzer", "version": "0.24.0", + "name": "coretrace-python-analyzer", "version": "0.25.0", "components": [ {"kind": "plugin", "name": "curated-advisories", "version": "2026.09.25", "digest": "sha256:…"}, {"kind": "advisories", "name": "advisories.json", "digest": "sha256:…"} @@ -823,7 +823,7 @@ project's behalf would go unseen. Without a lock file, a package is never `not_affected`. The document's `@id` derives from its statements, so two runs with the same result share it; its `author` is `Unknown Author`, as OpenVEX tools write when they cannot know it. Its `tooling` names the analyzer and each component with its digest -(`coretrace-python-analyzer 0.24.0; curated-advisories 2026.09.25 (sha256:…)`), so the +(`coretrace-python-analyzer 0.25.0; curated-advisories 2026.09.25 (sha256:…)`), so the `@id` changes with the advisory data a statement was decided with. ## Large projects diff --git a/pyproject.toml b/pyproject.toml index 4ed18b7..d3a7367 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "hatchling.build" [project] name = "coretrace-python-analyzer" -version = "0.24.0" +version = "0.25.0" description = "Static security analysis infrastructure for Python code" readme = "README.md" requires-python = ">=3.11" diff --git a/src/coretrace_python/__init__.py b/src/coretrace_python/__init__.py index 9dfe729..6a308ce 100644 --- a/src/coretrace_python/__init__.py +++ b/src/coretrace_python/__init__.py @@ -1,4 +1,4 @@ """CoreTrace's Python static analysis frontend.""" -__version__ = "0.24.0" +__version__ = "0.25.0" diff --git a/tests/test_release.py b/tests/test_release.py index a7fc5f3..8b89256 100644 --- a/tests/test_release.py +++ b/tests/test_release.py @@ -30,7 +30,7 @@ def require_changelog() -> None: def test_the_version_is_declared_once_and_mirrored() -> None: project = tomllib.loads((REPO / "pyproject.toml").read_text(encoding="utf-8"))["project"] - assert project["version"] == coretrace_python.__version__ == "0.24.0" + assert project["version"] == coretrace_python.__version__ == "0.25.0" def test_the_changelog_starts_with_the_current_version() -> None: