From d45d12b3a334b65e6ad0f89b181238153cd6c493 Mon Sep 17 00:00:00 2001 From: Rick van Hattem Date: Fri, 6 Nov 2026 10:01:38 +0100 Subject: [PATCH 1/2] Repo hygiene: SECURITY.md, pinned actions, uniform project.urls - Add SECURITY.md pointing to GitHub private advisory form - Pin pypa/gh-action-pypi-publish to v1.14.3 SHA (was floating release/v1) - Complete [project.urls] (Repository/Documentation/Issues/Changelog/Funding) Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_013r9LX6taXi8NfwLyPQeEqf --- .github/workflows/publish.yml | 2 +- SECURITY.md | 18 ++++++++++++++++++ pyproject.toml | 1 + 3 files changed, 20 insertions(+), 1 deletion(-) create mode 100644 SECURITY.md diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index d267043..0591d1d 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -29,6 +29,6 @@ jobs: with: name: dist path: dist/ - - uses: pypa/gh-action-pypi-publish@release/v1 + - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3 with: attestations: true diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..b20485b --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,18 @@ +# Security policy + +## Supported versions + +Security fixes land on the latest release. Earlier releases are not +maintained. + +## Reporting a vulnerability + +Report vulnerabilities privately through GitHub's advisory form: + + + +That keeps the report out of the public issue tracker until a fix is +available. If you cannot use the form, mail Wolph@Wol.ph instead. + +Please include the python-utils version, the configuration that triggers the issue +and a minimal reproduction. Expect an acknowledgement within a week. diff --git a/pyproject.toml b/pyproject.toml index def39e7..1fbda4a 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -52,6 +52,7 @@ Documentation = 'https://python-utils.readthedocs.io/' Repository = 'https://github.com/WoLpH/python-utils' Changelog = 'https://github.com/WoLpH/python-utils/releases' Funding = 'https://github.com/sponsors/wolph' +Issues = 'https://github.com/wolph/python-utils/issues' [project.optional-dependencies] loguru = ['loguru'] From 7feb9433e9b10972c29b2b58c3109180db2a948c Mon Sep 17 00:00:00 2001 From: Rick van Hattem Date: Fri, 6 Nov 2026 10:41:35 +0100 Subject: [PATCH 2/2] SECURITY.md: markdown lint fixes (MD034, MD013) Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_013r9LX6taXi8NfwLyPQeEqf --- SECURITY.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index b20485b..218ce32 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -12,7 +12,7 @@ Report vulnerabilities privately through GitHub's advisory form: That keeps the report out of the public issue tracker until a fix is -available. If you cannot use the form, mail Wolph@Wol.ph instead. +available. If you cannot use the form, mail instead. -Please include the python-utils version, the configuration that triggers the issue -and a minimal reproduction. Expect an acknowledgement within a week. +Please include the python-utils version, the configuration that triggers the +issue and a minimal reproduction. Expect an acknowledgement within a week. \ No newline at end of file