Bump to 12.0.9 and update the actions

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 11.1.0
+current_version = 12.0.9
 commit = True
 tag = True
 

.github/workflows/docs.yml

@@ -14,9 +14,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v7
     - name: Set up Python 3
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v7
       with:
         python-version: '3.x'
     - name: Install requirements

.github/workflows/issue.yml

@@ -6,7 +6,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: Renato66/auto-label@v2
+      - uses: Renato66/auto-label@v3
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           ignore-comments: true

.github/workflows/python.yml

@@ -11,9 +11,9 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v7
     - name: Set up Python 3.10
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v7
       with:
         python-version: "3.10"
     - name: Install dependencies
@@ -31,9 +31,9 @@ jobs:
         python-version: ["3.10", "3.11", "3.12"]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v7
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v7
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install dependencies
@@ -45,30 +45,7 @@ jobs:
         [[ "$GITHUB_REPOSITORY" == "terminusdb/terminusdb-client-python" && "$GITHUB_EVENT_NAME" == "push" ]] && export TERMINUSX_TOKEN='${{ secrets.TERMINUSX_TOKEN_DEV }}'
         tox -e test
     - name: Coverage report
-      uses: codecov/codecov-action@v2
+      uses: codecov/codecov-action@v7
       with:
         files: ./cov.xml
         verbose: true
-
-  deploy:
-    runs-on: ubuntu-latest
-    needs: build
-    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
-    permissions:
-      id-token: write
-    steps:
-    - uses: actions/checkout@v3
-    - name: Set up Python 3.10
-      uses: actions/setup-python@v4
-      with:
-        python-version: "3.10"
-    - name: Run setup.py sdist
-      run: |
-        pip install poetry
-        poetry build
-        tar -xf dist/*.tar.gz
-        unzip -n dist/*.whl
-        head -20 *.dist-info/METADATA
-
-    - name: Deploy to pypi
-      uses: pypa/gh-action-pypi-publish@release/v1

.github/workflows/release.yml

@@ -0,0 +1,34 @@
+name: Build and release on PyPI
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  setup-build-publish-deploy:
+    name: Setup, Build, Publish, and Deploy
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v7
+    - name: Set up Python 3.12
+      uses: actions/setup-python@v7
+      with:
+        python-version: "3.12"
+    - name: Verify release tag matches package version
+      run: |
+        PKG_VERSION=$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['tool']['poetry']['version'])")
+        TAG="${GITHUB_REF_NAME#v}"
+        if [ "$PKG_VERSION" != "$TAG" ]; then
+          echo "Release tag ${GITHUB_REF_NAME} does not match pyproject.toml version ${PKG_VERSION}"
+          exit 1
+        fi
+    - name: Build with Poetry
+      run: |
+        pip install poetry
+        poetry build
+    - name: Deploy to PyPI
+      uses: pypa/gh-action-pypi-publish@release/v1

RELEASE_NOTES.md

@@ -1,4 +1,42 @@
-# TerminusDB Python Client Release Notes
+# TerminusDB Python Client 12.0.9
+
+The 12.0.9 client aligns with the TerminusDB 12.0.x server line and resumes releases on PyPI under the `terminusdb` package name. The intermediate version declarations (12.0.6–12.0.8) were never tagged or released, so this entry covers all changes since v12.0.5.
+
+Headline changes:
+
+* **Upsert-capable document writes.** `insert_document` gains `overwrite` (replace an existing document sharing an `@id` instead of erroring) and `merge_repeats` (tolerate duplicate document IDs within one request); `update_document` gains `merge_repeats` [#472](https://github.com/terminusdb/terminusdb-client-python/pull/472)
+* **Unfolding, end to end.** `diff` gains an `unfold` option, and the Python schema layer supports `@unfold` and `@shared` on document metadata [#471](https://github.com/terminusdb/terminusdb-client-python/pull/471) [#480](https://github.com/terminusdb/terminusdb-client-python/pull/480)
+* **WOQL `triple_relation`** relates a triple's object to a reference value — including the thirteen Allen interval relations on `xdd:dateTimeInterval` — plus custom dict support during typecasting [#481](https://github.com/terminusdb/terminusdb-client-python/pull/481)
+* **Python 3.9 dropped** to clear vulnerable dependency pins; Python 3.10 or later is now required [#478](https://github.com/terminusdb/terminusdb-client-python/pull/478)
+
+## New functionality
+
+* `insert_document`: `overwrite` for upsert behaviour, `merge_repeats` for duplicate IDs in the same request; `update_document`: `merge_repeats` [#472](https://github.com/terminusdb/terminusdb-client-python/pull/472)
+* `unfold` option on the diff endpoint [#471](https://github.com/terminusdb/terminusdb-client-python/pull/471)
+* `@unfold` and `@shared` support in the Python schema layer [#480](https://github.com/terminusdb/terminusdb-client-python/pull/480)
+* WOQL `triple_relation` predicate and custom dict support during typecasting [#481](https://github.com/terminusdb/terminusdb-client-python/pull/481)
+* `WOQLQuery.idgen_uuid_v7` and `UuidV7Key` schema class for time-ordered UUID v7 identifiers [#473](https://github.com/terminusdb/terminusdb-client-python/pull/473)
+* `DocParamsGet` documents the full document GET parameter set [#484](https://github.com/terminusdb/terminusdb-client-python/pull/484)
+
+## Bugfixes
+
+* Accept unprefixed document ids and fix backend id parsing for compressed ids [#479](https://github.com/terminusdb/terminusdb-client-python/pull/479)
+* Fix `pull` and `DatabaseError` bugs; `DatabaseError` now parses dict error responses (`api:message`, `vio:message`) [#484](https://github.com/terminusdb/terminusdb-client-python/pull/484)
+* Interval and `xsd:dateTime` boundary test fixes [#477](https://github.com/terminusdb/terminusdb-client-python/pull/477) [#483](https://github.com/terminusdb/terminusdb-client-python/pull/483)
+* Patch Insert/Delete ops documented with `@capture`/`@ref`, with an added integration test [#476](https://github.com/terminusdb/terminusdb-client-python/pull/476)
+
+## Maintenance
+
+* Align the `pyproject.toml` and `__version__.py` version declarations, which had drifted to 12.0.5 and 12.0.7 respectively [#485](https://github.com/terminusdb/terminusdb-client-python/pull/485)
+* Publish via a dedicated release workflow triggered on GitHub Releases, with tag↔version verification and PyPI trusted publishing
+* Dependency updates: certifi, idna, pygments [#468](https://github.com/terminusdb/terminusdb-client-python/pull/468) [#469](https://github.com/terminusdb/terminusdb-client-python/pull/469) [#475](https://github.com/terminusdb/terminusdb-client-python/pull/475)
+* `Client.py` unit test coverage raised to 95% [#484](https://github.com/terminusdb/terminusdb-client-python/pull/484)
+
+## Deprecations
+
+* Drop Python 3.9 support to clear vulnerable dependency pins [#478](https://github.com/terminusdb/terminusdb-client-python/pull/478)
+
+**Full Changelog**: https://github.com/terminusdb/terminusdb-client-python/compare/v12.0.5...v12.0.9
 
 ## v11.1.0
 

docs/release_steps.md

@@ -3,8 +3,8 @@
 ## Quick Release
 
 1. Update release notes (`RELEASE_NOTES.md`)
-2. Bump version (bumpversion [patch|minor|major])
-3. Push new tag (`git push origin main --tags`)
+2. Bump version (`bumpversion [patch|minor|major]`) and push `main` with the bump commit
+3. Create a GitHub Release with a `vX.Y.Z` tag — publishing it triggers the release workflow, which verifies the tag matches `pyproject.toml` and deploys to PyPI
 
 ### Bump version (updates files + creates tag)
 
@@ -14,33 +14,26 @@ To not create a tag, use `--no-tag`.
 bumpversion [patch|minor|major]
 ```
 
-### Create and push tag (triggers automated PyPI deployment)
+### Create the release (triggers automated PyPI deployment)
 
-```bash
-git push origin main --tags
-```
+Draft a GitHub Release at https://github.com/terminusdb/terminusdb-client-python/releases/new with a new `vX.Y.Z` tag matching the bumped version, then publish it. The `release.yml` workflow checks that the tag equals `pyproject.toml`'s version and fails otherwise.
 
 **Monitor**: https://github.com/terminusdb/terminusdb-client-python/actions
 
 ## Details
 
-### Create tag manually
-
-```bash
-git tag -s v11.1.0 -m "Release v11.1.0"
-git push origin main --tags
-```
-
 ### What bumpversion updates
 - `terminusdb_client/__version__.py`
 - `pyproject.toml`
 - `.bumpversion.cfg`
 
 ### Automated deployment
-Pushing a tag triggers GitHub Actions to:
-- Run tests (Python 3.9-3.12)
+Publishing a GitHub Release triggers `.github/workflows/release.yml` to:
+- Verify the release tag matches `pyproject.toml`'s version
 - Build with Poetry
-- Publish to PyPI
+- Publish to PyPI as `terminusdb` via trusted publishing (`id-token`)
+
+PyPI trusted publishing must be registered for the `release.yml` workflow file in the `terminusdb` project settings on PyPI.
 
 ### Manual deployment (if needed)
 ```bash
@@ -55,4 +48,4 @@ poetry publish
 ## Prerequisites
 
 - Install: `pip install bumpversion`
-- PyPI publishing handled via `PYPI_API_TOKEN` secret in GitHub Actions
+- PyPI publishing uses trusted publishing (OIDC) — no API token secret needed