From 01b101c92838ea75a9c5e7b86dd5dbb90d3e52c1 Mon Sep 17 00:00:00 2001 From: t0kubetsu Date: Wed, 12 Aug 2026 16:07:11 +0200 Subject: [PATCH 1/2] fix(packaging): canonical SPDX license expression and PEP 639 build floor - license = "GPL-3.0-only" instead of the deprecated "GPL-3.0" SPDX identifier. Same license, canonical machine-readable spelling; setuptools warns on deprecated identifiers and PyPI validates them. - Build requirement raised to setuptools>=77, the first release implementing PEP 639 (a string license holding an SPDX expression, plus license-files). setuptools>=68 allowed versions that reject a string license value, so a clean-environment build could resolve a setuptools too old for this metadata. Version bumped to 0.3.2 with the matching CHANGELOG section and comparison links. Verified: 421 tests pass, ruff clean. --- CHANGELOG.md | 17 ++++++++++++++++- headersvalidator/__init__.py | 2 +- pyproject.toml | 6 +++--- 3 files changed, 20 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 32b1c2d..db69688 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -16,6 +16,20 @@ Version numbers follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html --- +## [0.3.2] — 2026-08-12 + +### Changed +- `pyproject.toml`: `license` is now the canonical SPDX expression + `GPL-3.0-only` instead of the deprecated `GPL-3.0` identifier. The license + itself is unchanged — only its machine-readable spelling. +- `pyproject.toml`: the build requirement is now `setuptools>=77`, the first + release implementing PEP 639 (a string `license` holding an SPDX expression, + plus `license-files`). The previous `setuptools>=68` allowed versions that + reject a string `license` value, so a build in a clean environment could + resolve a setuptools too old to understand this metadata. + +--- + ## [0.3.1] — 2026-07-15 ### Fixed @@ -296,7 +310,8 @@ Version numbers follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html --- -[Unreleased]: https://github.com/NC3-TestingPlatform/headersvalidator/compare/v0.3.1...HEAD +[Unreleased]: https://github.com/NC3-TestingPlatform/headersvalidator/compare/v0.3.2...HEAD +[0.3.2]: https://github.com/NC3-TestingPlatform/headersvalidator/compare/v0.3.1...v0.3.2 [0.3.1]: https://github.com/NC3-TestingPlatform/headersvalidator/compare/v0.3.0...v0.3.1 [0.3.0]: https://github.com/NC3-TestingPlatform/headersvalidator/compare/v0.2.3...v0.3.0 [0.2.3]: https://github.com/NC3-TestingPlatform/headersvalidator/compare/v0.2.2...v0.2.3 diff --git a/headersvalidator/__init__.py b/headersvalidator/__init__.py index d803426..2368b37 100644 --- a/headersvalidator/__init__.py +++ b/headersvalidator/__init__.py @@ -5,7 +5,7 @@ try: __version__ = version("headersvalidator") except PackageNotFoundError: # pragma: no cover – only when package not installed - __version__ = "0.3.1" + __version__ = "0.3.2" # NullHandler so library users who have not configured logging # do not see "No handler found" warnings (PEP 3118 / logging HOWTO). diff --git a/pyproject.toml b/pyproject.toml index d83b72c..5eaef41 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,14 +1,14 @@ [build-system] -requires = ["setuptools>=68", "wheel"] +requires = ["setuptools>=77", "wheel"] build-backend = "setuptools.build_meta" [project] name = "headersvalidator" -version = "0.3.1" +version = "0.3.2" description = "HTTP response header validator — RFC 9110, RFC 9111, OWASP, IANA" readme = "README.md" requires-python = ">=3.11" -license = "GPL-3.0" +license = "GPL-3.0-only" license-files = ["LICENSE"] authors = [{ name = "t0kubetsu" }] keywords = [ From 1eba7686dfe91735948d045ab057a378200ea75d Mon Sep 17 00:00:00 2001 From: t0kubetsu Date: Wed, 12 Aug 2026 16:15:38 +0200 Subject: [PATCH 2/2] docs(changelog): move shipped entries into the new version section The version bump left already-shipped changes under [Unreleased], so the versioned section and its GitHub release notes would have omitted work shipped from the same revision. CHANGELOG rule: never leave content under [Unreleased] after bumping the version. Caught by Greptile on the mailvalidator PR; the same defect was present in this module. --- CHANGELOG.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index db69688..0bb8a39 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,15 +9,15 @@ Version numbers follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html ## [Unreleased] +--- + +## [0.3.2] — 2026-08-12 + ### Removed - `nc3.lu.svg`, a saved scan report accidentally committed with v0.3.1. Top-level `.svg`/`.html`/`.txt` report outputs are now git-ignored to prevent a recurrence. ---- - -## [0.3.2] — 2026-08-12 - ### Changed - `pyproject.toml`: `license` is now the canonical SPDX expression `GPL-3.0-only` instead of the deprecated `GPL-3.0` identifier. The license