From 1fa75255181103ef2038ee5b9f2ffd5f5b81ec3f Mon Sep 17 00:00:00 2001 From: Rick van Hattem Date: Fri, 6 Nov 2026 10:01:37 +0100 Subject: [PATCH 1/2] Repo hygiene: SECURITY.md, pinned actions, uniform project.urls - Add SECURITY.md pointing to GitHub private advisory form - Pin pypa/gh-action-pypi-publish to v1.14.3 SHA (was floating release/v1) - Complete [project.urls] (Repository/Documentation/Issues/Changelog/Funding) Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_013r9LX6taXi8NfwLyPQeEqf --- .github/workflows/release.yml | 2 +- SECURITY.md | 18 ++++++++++++++++++ pyproject.toml | 1 + 3 files changed, 20 insertions(+), 1 deletion(-) create mode 100644 SECURITY.md diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 83b75401..35364ee6 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -106,4 +106,4 @@ jobs: name: dist path: dist/ - name: Publish via Trusted Publishing - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3 diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..0a85c693 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,18 @@ +# Security policy + +## Supported versions + +Security fixes land on the latest release. Earlier releases are not +maintained. + +## Reporting a vulnerability + +Report vulnerabilities privately through GitHub's advisory form: + + + +That keeps the report out of the public issue tracker until a fix is +available. If you cannot use the form, mail Wolph@Wol.ph instead. + +Please include the progressbar2 version, the configuration that triggers the issue +and a minimal reproduction. Expect an acknowledgement within a week. diff --git a/pyproject.toml b/pyproject.toml index 8b3f9d36..7f84c364 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -114,6 +114,7 @@ bugs = 'https://github.com/wolph/python-progressbar/issues' documentation = 'https://progressbar-2.readthedocs.io/en/latest/' repository = 'https://github.com/wolph/python-progressbar/' Funding = 'https://github.com/sponsors/wolph' +Changelog = 'https://github.com/wolph/python-progressbar/releases' [project.scripts] progressbar = 'progressbar.__main__:main' From f842440f41f41c9b26307836e4662e9edd37a8ec Mon Sep 17 00:00:00 2001 From: Rick van Hattem Date: Fri, 6 Nov 2026 10:41:33 +0100 Subject: [PATCH 2/2] SECURITY.md: markdown lint fixes (MD034, MD013) Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_013r9LX6taXi8NfwLyPQeEqf --- SECURITY.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 0a85c693..9fd1e6b7 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -12,7 +12,7 @@ Report vulnerabilities privately through GitHub's advisory form: That keeps the report out of the public issue tracker until a fix is -available. If you cannot use the form, mail Wolph@Wol.ph instead. +available. If you cannot use the form, mail instead. -Please include the progressbar2 version, the configuration that triggers the issue -and a minimal reproduction. Expect an acknowledgement within a week. +Please include the progressbar2 version, the configuration that triggers the +issue and a minimal reproduction. Expect an acknowledgement within a week. \ No newline at end of file