|
1 | | -# CHANGELOG.md |
2 | | - |
3 | 1 | # Changelog |
4 | | -All notable changes to this project will be documented in this file. |
5 | 2 |
|
6 | | -Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and versions follow [SemVer](https://semver.org/). |
7 | | -Version numbers are derived from Git tags via `hatch-vcs` (tags must be `vX.Y.Z`). |
| 3 | +All notable changes to this project are documented in this file. |
| 4 | + |
| 5 | +Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and versions follow [SemVer](https://semver.org/). Versions are derived from Git tags via `hatch-vcs` (`vX.Y.Z`). |
8 | 6 |
|
9 | 7 | ## [Unreleased] |
| 8 | + |
10 | 9 | ### Added |
11 | | -- New policy `update-in-place` to preserve original version operators (`==`, `~=`, etc.) while updating the version number. |
| 10 | +- Root `--version` / `-V` CLI option for quick version checks. |
| 11 | +- Built-in MCP server (`reqsync mcp`, `reqsync-mcp`) with `reqsync_sync` tool outputting structured JSON. |
| 12 | +- New programmatic integration helpers in `reqsync.api` (`options_from_mapping`, `run_sync_payload`). |
| 13 | +- Advisory lock timeout support via `lock_timeout_sec` / `--lock-timeout-sec`. |
| 14 | +- Automatic backup pruning via `backup_keep_last` / `--backup-keep-last` (default keeps 5 timestamped backups per file). |
| 15 | +- Git cleanliness guard wiring for `--allow-dirty` behavior. |
| 16 | +- Test bootstrap `tests/conftest.py` to scrub `__pycache__` and ensure src importability. |
| 17 | + |
| 18 | +### Changed |
| 19 | +- Core sync engine rewritten for clearer include/constraint graph handling and deterministic processing. |
| 20 | +- `--check` mode now correctly reports real drift state (no forced true-positive). |
| 21 | +- Hash guard now applies to all processed files (root + includes), not only the root file. |
| 22 | +- CLI updated with `--stdout-json` for direct agent/toolchain ingestion. |
| 23 | +- Documentation fully aligned to current command model (`reqsync run [OPTIONS]`, `reqsync mcp ...`). |
12 | 24 |
|
13 | | -### Planned |
14 | | -- Per-package cap strategies (next-minor, calendar-based) via config. |
15 | | -- Git cleanliness guard (block writes on dirty repo unless `--allow-dirty`). |
16 | | -- Optional pretty console output using `rich`. |
| 25 | +### Fixed |
| 26 | +- Removed brittle CLI error-code string matching in favor of typed exceptions. |
| 27 | +- Corrected metadata author email and aligned runtime dependencies with actual runtime features. |
17 | 28 |
|
18 | 29 | --- |
19 | 30 |
|
20 | 31 | ## [v0.1.0] — 2025-08-18 |
21 | | -### Added |
22 | | -- Core command `reqsync run` to: |
23 | | - - Upgrade the active environment with `pip install -U -r <file>` (skippable with `--no-upgrade`). |
24 | | - - Rewrite requirement lines to **lower-bound** floors (`>= installed_version`) while preserving: |
25 | | - - extras (`pkg[extra1,extra2]`) |
26 | | - - markers (`; sys_platform == "win32"`) |
27 | | - - inline comments and spacing |
28 | | - - file encoding (BOM) and newline style (LF/CRLF) |
29 | | - - Backup existing files and perform atomic writes with rollback on failure. |
30 | | -- **Venv guard**: refuses to run outside a virtualenv by default; override with `--system-ok`. |
31 | | -- **Safety gates**: |
32 | | - - Abort if any line contains `--hash=` unless `--allow-hashes` is set (then hashed stanzas are skipped, never edited). |
33 | | - - Skip VCS/URL/local paths and editables (`-e/--editable`) and all pip directives (`-r`, `-c`, `--index-url`, etc.). |
34 | | - - File locking with `portalocker` to prevent concurrent edits. |
35 | | -- **Policy engine**: |
36 | | - - `lower-bound` (default), `floor-only`, and `floor-and-cap` (cap defaults to next major). |
37 | | - - Controls for pre/dev and local versions: `--allow-prerelease`, `--keep-local`. |
38 | | -- **Includes and constraints**: |
39 | | - - Recursive processing of `-r` includes (on by default). |
40 | | - - Detect but don’t modify constraint files unless `--update-constraints` is set. |
41 | | - - Option `--last-wins` to resolve duplicates across included files. |
42 | | -- **UX & CI**: |
43 | | - - `--dry-run` with optional `--show-diff` unified diff. |
44 | | - - `--check` mode exits nonzero if changes would be made (no writes). |
45 | | - - `--json-report` to emit a machine-readable change log for tooling. |
46 | | - - Allowlisted `--pip-args` passthrough for indexes/proxies (safe subset only). |
47 | | - - `--only`/`--exclude` globs to scope which packages are updated. |
48 | | - - Verbosity flags (`-v`, `-vv`) and optional file logging with secret redaction. |
49 | | -- **APIs & docs**: |
50 | | - - Clean Python API: `reqsync.core.sync(Options)` returning a structured `Result`. |
51 | | - - Docs: USAGE, CONFIG, INTEGRATION. Examples: config presets and minimal API usage. |
52 | | -- **Tooling & release**: |
53 | | - - `pyproject.toml` with `hatchling` + `hatch-vcs` dynamic versioning. |
54 | | - - CI workflow (lint, type-check, test, build, twine check, wheel smoke test). |
55 | | - - PyPI Trusted Publishing workflow via OIDC (no secrets). |
56 | | - |
57 | | -### Fixed |
58 | | -- N/A. First release. |
59 | | - |
60 | | -### Security |
61 | | -- Redacts common token shapes from logs (index credentials, tokens) by default. |
62 | 32 |
|
63 | | -### Known limitations (by design) |
64 | | -- Does not recompute or update `--hash` lines. Use `pip-compile` if you need hashed lockfiles. |
65 | | -- Does not manage transitive dependency locks. Pair with a `constraints.txt` if you need determinism. |
66 | | -- Assumes the active interpreter’s environment is the source of truth. |
| 33 | +Initial public release. |
67 | 34 |
|
68 | 35 | --- |
69 | 36 |
|
|
0 commit comments