Skip to content

chore(release): 0.11.0 #355

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
seant-aws merged 2 commits into from
Aug 20, 2026
Merged

chore(release): 0.11.0 #355

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1bdff8f
chore(release): 0.11.0
client-software-ci Aug 19, 2026
acaa145
chore(release): 0.11.0
seant-aws Aug 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,15 @@
## 0.11.0 (2026-08-20)

### ⚠ BREAKING CHANGES

* shorten the session working directory name for Windows MAX_PATH — session working dir is no longer prefixed with session ID; `embedded_files<random>` renamed to `ef<random>` (#348)

@github-actions github-actions Bot Aug 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The embedded_files<random> -> ef<random> rename described here did not actually land on this head. Session._create_files_directory still passes the long prefix (src/openjd/sessions/_session.py:2193):

return TempDir(
    dir=self.working_directory,
    prefix="embedded_files",
    user=self._user,
    logger=self._logger,
)

grep -rn 3Cprefix="ef"3E src/ test/ finds nothing, and 3252e69 (#348) touched only _session.py, _tempdir.py and test_session.py, leaving _create_files_directory untouched — its commit message says it intended to shorten this prefix, but that hunk is absent.

So the entry documents a breaking rename that consumers cannot observe. Either drop that clause, or land the prefix change before cutting 0.11.0 — the latter seems to be the intent, since the point of #348 was recovering MAX_PATH budget and embedded_files costs 12 more characters than ef on every embedded-file path.

@github-actions github-actions Bot Aug 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The hand-edit dropped the commit-hash links that every other entry in this file carries, and this section is not just read on GitHub — it is extracted and published verbatim.

.github/workflows/release_publish.yml feeds .github/scripts/get_latest_changelog.py, which slices everything from the top of the file down to the second ^##\s heading and prints it as the release body. So this section becomes the GitHub Release notes for 0.11.0 as-is.

Two consequences of removing the ([3252e69](.../commit/3252e69...)) suffixes:

  • Bare #348 renders as a link inside a GitHub Release body, but the commit is no longer reachable from the notes at all. Every prior release in this file (0.10.14 back to 0.7.x) links the commit; 0.11.0 would be the first that does not.
  • The .semantic_release/CHANGELOG.md.j2 template emits those links unconditionally, so the next semantic-release run will produce the linked form again for 0.11.1+. That leaves 0.11.0 as a one-off gap in the middle of an otherwise uniform file rather than a deliberate new convention.

If the goal was to drop the redundant duplicate feat! line and merge the four trusted-path commits into one readable entry — both reasonable — the commit links can be kept while doing it: * … (#348) ([3252e69](https://github.com/OpenJobDescription/openjd-sessions-for-python/commit/3252e693eec2cb31a0546f12e0e39f5778d9eb9d)).

Minor, same edit: the five new headings/bullets carry trailing spaces (### ⚠ BREAKING CHANGES , * … (#348) , ### Bug Fixes , * … (#349) ). Two trailing spaces are a Markdown hard line break, and one is just noise; no other line in the file has them.


### Bug Fixes

* resolve system commands from trusted dirs, not PATH (#351)
* do not cache failed command lookups (#351)

@github-actions github-actions Bot Aug 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These two entries document fixes to code that has never been released, so they are noise for anyone reading 0.11.0's notes.

src/openjd/sessions/_system_commands.py is created in this same release — 419b434 adds it (+147 lines, the entry on line 9). The two lines below it then fix that brand-new file:

  • 3574ced "do not cache failed command lookups" — the negative-result caching it removes was introduced by 419b434. git show 419b434 --stat shows _system_commands.py | 147 +++++ (new file); git show 3574ced --stat shows it modifying that same file.
  • 3744653 "address automated review findings on the trusted-path resolver" — same window, same file, and the summary describes review churn rather than an observable behavior change.

A consumer upgrading 0.10.14 -> 0.11.0 never saw the buggy cache, so "do not cache failed command lookups" describes a state they were never in, and "address automated review findings" gives them nothing to act on. Every other entry in this file describes a delta from the previously released version.

Suggest collapsing lines 9-11 into the single entry that is actually consumer-visible, e.g.:

* resolve system commands from trusted absolute directories instead of PATH (#351)

This matters more than usual because the notes are published verbatim: .github/workflows/release_publish.yml -> .github/scripts/get_latest_changelog.py slices from the top of the file to the second ^##\s heading and prints it as the GitHub Release body. Three bullets where one applies makes the one real change harder to spot.

* address automated review findings on the trusted-path resolver (#351)

@github-actions github-actions Bot Aug 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Two entries the release tooling generated at 1bdff8f were dropped in the hand-edit at 9266f55, and one of them is arguably the most consequential change in the release for downstream consumers:

  • fix: raise openjd-model floor to >= 0.11.4 (ea0ea7f) — this narrows the accepted dependency range from openjd-model >= 0.11.2,< 0.12 to >= 0.11.4,< 0.12. Anyone pinned to 0.11.2/0.11.3 will fail to resolve 0.11.0 of this package, and the changelog now gives them no explanation. A raised dependency floor belongs in the notes.
  • fix: use absolute paths for system commands to prevent PATH injection (d3b978f) — a security fix. Folding it into the chore(github): bump actions/checkout from 4 to 7 #349 line is defensible if that was intentional, but it is worth being explicit given it is the first commit in that hardening series.


## 0.10.14 (2026-08-11)

### Features
Expand Down
Loading