Tags give the ability to mark specific points in history as being important
-
V1.4.10
3b66a1b6 · ·Release 1.4.10 This release prepares the packaging pipeline for Trusted Publishing to TestPyPI and PyPI, and fixes broken documentation links in the PyPI project description. --- * **TestPyPI branch publishing** — Added manual GitLab CI jobs that build and publish uniquely versioned branch artifacts to TestPyPI using Trusted Publishing * **PyPI Trusted Publishing** — Added manual tag-based GitLab CI jobs for Trusted Publishing to `pypi.org` --- * Fixed dead links in the PyPI-rendered README by switching package-description links to stable GitLab URLs * Updated publishing and release documentation to cover GitLab registry, TestPyPI, and public PyPI flows --- * Updated release tooling to recognize PEP 440-style `rc` versions * Added CI version rewriting for branch TestPyPI publishes to avoid immutable upload conflicts ---
-
V1.4.9
02ff5dca · ·Release 1.4.9 This release lowers the minimum supported Python version from 3.13 to 3.11 and aligns the project documentation and CI defaults with that broader compatibility target. --- * **Python 3.11 support** — Relaxed the package metadata from `>=3.13,<4.0` to `>=3.11,<4.0` --- * Local validation completed on Python 3.11.15 * `poetry run pytest` passed: `160 passed` * `poetry build` produced both the sdist and wheel successfully --- * Updated developer and migration docs to describe Python 3.11+ support * Updated examples and Windows Poetry environment setup guidance to use Python 3.11 * Updated GitLab CI defaults to use `python:3.11-slim` --- * No breaking API changes * No configuration changes required * Existing supported Python versions remain supported * Additional support is now declared for Python 3.11 and 3.12 ---
-
V1.4.8
a0f563f6 · ·Release 1.4.8 This is a **security maintenance release** that refreshes vulnerable development dependencies used in the SprigConfig test and tooling workflow. --- * **Fixed CVE-2026-40192** — Updated `pillow` from `12.1.1` to `12.2.0` * **Fixed CVE-2025-71176** — Updated `pytest` from `8.4.2` to `9.0.3` * **Tooling compatibility refresh** — Updated `pytest-cov` from `6.2.1` to `7.1.0` to stay aligned with the refreshed pytest toolchain --- * Local tests passed after refreshing the dependency set * `pip-audit` reports `No known vulnerabilities found` --- * No runtime dependency changes * No breaking changes to SprigConfig behavior * No API changes * No configuration changes required ---
-
V1.4.7
e0cd8f18 · ·Release 1.4.7 This is a **security patch release** that updates the `cryptography` runtime dependency to remediate `CVE-2026-39892`. --- * **Fixed CVE-2026-39892** — Updated `cryptography` from `46.0.6` to `46.0.7` * **Vulnerability scope** — `cryptography` versions `45.0.0` through `46.0.6` could overflow buffers when APIs that accept Python buffers (for example, `Hash.update()`) received a non-contiguous buffer * **Audit verification** — `pip-audit` reports `No known vulnerabilities found` after refreshing the lockfile * **Release intent** — Keeps SprigConfig on the patched upstream release with no expected application-level behavior changes --- * No breaking changes * No API changes * No configuration changes required * Existing functionality unchanged ---
-
V1.4.6
e6821577 · ·Release 1.4.6 This is a security maintenance release that refreshes vulnerable dependencies and documents how to triage advisories when scanners report no vendor-confirmed fix version. - Runtime dependency refresh: Updated cryptography from 46.0.5 to 46.0.6 - Docs and developer tooling refresh: Updated the resolved docs/dev dependency graph, including requests, Pygments, mkdocs, and mkdocs-material - Audit verification: pip-audit now reports No known vulnerabilities found - Added dependency triage guidance for advisories that have no published fix version yet - Documented how to distinguish shipped runtime dependencies from docs/dev-only tooling exposure during security review - No breaking changes - No API changes - No configuration changes required
-
V1.4.5
88147353 · ·Release 1.4.5 This is a **bug fix and developer experience release** that corrects environment variable expansion when using an empty default value (e.g., `${VAR:}`) and adds a pre-commit hook to warn about skip-worktree files. --- * **Empty default in env var expansion** — `${VAR:}` (colon with no value after it) was not being expanded, leaving the literal string in the config. The regex required one or more characters after the colon (`+`); changed to zero or more (`*`) so an empty default correctly resolves to `""` when the variable is unset. --- * Added empty-default env var expansion tests for all three config formats: * `test_env_var_empty_default_expands_to_empty_string_yml` (YAML) * `test_env_var_empty_default_expands_to_empty_string_json` (JSON) * `test_toml_env_var_empty_default` (TOML) * All tests use `monkeypatch.delenv` to guarantee the variable is absent, preventing false positives from host environment leakage --- * **Pre-commit skip-worktree reminder** — New `skip-worktree-reminder` hook in `.pre-commit-config.yaml` that lists all files with `skip-worktree` set on every commit. This prevents developers from accidentally missing intentional changes to tracked test config files that git silently ignores. * Non-blocking (informational only) — prints the file list and instructions to un-skip * Added `scripts/check-skip-worktree.sh` helper script --- * No breaking changes * No API changes * No configuration changes required * Configs using `${VAR:default}` with a non-empty default are unaffected --- -
V1.4.4
9e5089c4 · ·Release 1.4.4 This is a **security patch release** addressing a vulnerability in the cryptography dependency. --- * **Fixed CVE-2026-26007** — Updated `cryptography` from 46.0.1 to 46.0.5 to address security vulnerability * **Pillow security update** — Added `pillow` 12.1.1 to dev dependencies to address vulnerability (weasyprint 68.1 did not pull in the patched version) --- * No breaking changes * No API changes * No configuration changes required * Existing functionality unchanged ---
-
V1.4.3
242ea3e0 · ·Release 1.4.3 This is a **documentation and developer experience release** that greatly improves error diagnostics for circular imports, adds comprehensive parser documentation, and fixes UTF-8 BOM handling for cross-platform compatibility. --- * **Enhanced Circular Import Detection** - `config_loader.py` now shows the full cycle path in error messages: * Clear visualization of import chain (e.g., `a.yml -> b.yml -> c.yml -> a.yml`) * Makes debugging complex import graphs significantly easier * Error messages now include the complete cycle for faster resolution * **Parser Module Documentation** - New comprehensive documentation files: * `src/sprigconfig/parsers/__init__.md` - Parser architecture overview * `src/sprigconfig/parsers/yaml_parser.md` - YAML parser implementation details * `src/sprigconfig/parsers/json_parser.md` - JSON parser implementation details * `src/sprigconfig/parsers/toml_parser.md` - TOML parser implementation details * Fully documents the internal parser abstraction layer * **Test Documentation** - New test module guides: * `tests/test_injection.md` - Dependency injection test patterns * `tests/test_instantiate.md` - Dynamic instantiation test coverage * `tests/test_target_config.md` - Target configuration test strategies --- * **UTF-8 BOM Handling** - `test_import_trace.py` and `test_meta_sources.py`: * Added explicit `utf-8-sig` encoding for YAML file reading * Prevents Windows-created files with UTF-8 BOM from causing parser issues * Cross-platform file compatibility significantly improved * Ensures consistent behavior across Windows, macOS, and Linux --- * **docs/index.md** - Comparison table expanded: * Added "Spring Python" row highlighting Spring Boot feature parity * Added "Dependency Injection" row comparing DI approaches * Added "Dynamic Instantiation" row explaining `_target_` support * **docs/faq.md** - New Dependency Injection section: * Common questions about DI patterns * Comparison with traditional `Config.get()` approach * Best practices for choosing DI patterns * **docs/getting-started.md** - Improved navigation and accuracy: * Added links to new features (dynamic instantiation, DI patterns) * Fixed relative paths for cross-document linking * Enhanced table of contents for better discoverability * **Roadmaps Updated** - Both `docs/roadmap.md` and `sprig-config-module/ROADMAP.md`: * Updated to reflect 1.4.3 release completion * Clarified feature delivery timeline --- * No breaking changes * No API changes * No configuration changes required * Existing functionality unchanged * All changes are additive (documentation and improved error messages) ---
-
V1.4.2
cc591995 · ·Release 1.4.2 This is a **security patch release** addressing a path traversal vulnerability in a transitive dependency. --- * **Fixed CVE-2026-23949** — Updated `jaraco-context` to 6.1.0 to address Zip Slip path traversal vulnerability in tarball extraction --- * No breaking changes * No API changes * No configuration changes required * Existing functionality unchanged ---
-
V1.4.1
92b8f2be · ·Release 1.4.1 This is a **security patch release** addressing two dependency vulnerabilities with minimal production impact. --- * **Fixed CVE-2025-68616** — Updated `weasyprint` to 68.0 to address security vulnerability * **Fixed CVE-2026-22701** — Updated `filelock` from 3.20.2 to 3.20.3 and `virtualenv` from 20.36.0 to 20.36.1 to address security vulnerabilities --- * Removed CodeQL scanning from CI pipeline (temporarily disabled due to tooling issues) --- * No breaking changes * No API changes * No configuration changes required * Existing functionality unchanged ---
-
V1.4.0
25deb326 · ·Release 1.4.0 introducing **Hydra-style `_target_` support for dynamic class instantiation from configuration**. This enables powerful patterns like hexagonal architecture with swappable adapters instantiated directly from config files. --- * **Dynamic Class Instantiation** - Hydra-style `_target_` support: * Specify a class path in config: `_target_: "my.module.ClassName"` * Automatically extract parameters from config section * Instantiate class directly from configuration * Perfect for hexagonal architecture and adapter patterns * **`instantiate()` Function** - New public API in `sprigconfig`: * `instantiate(config_section)` - Creates instance from `_target_` * Automatic parameter extraction based on `__init__` signature * Type conversion via type hints (int, float, bool, str, list, dict) * `_recursive_=True` (default) - Recursively instantiate nested `_target_` objects * `_convert_types_=True` (default) - Apply type conversion to parameters * **Type Conversion System**: * Automatic conversion based on Python type hints * Preserves LazySecret and Config objects (never converted) * Clear error messages with full context * **Seamless @config_inject Integration**: * Instantiated objects work perfectly with `@config_inject` decorator * Constructor parameters come from `_target_` config * Other values still available for `@config_inject` in methods * Two DI patterns work together harmoniously * **Comprehensive Documentation**: * Module documentation: `src/sprigconfig/instantiate.md` * Full API reference with examples * Design principles and use cases * Error handling and security notes --- **Config (YAML):** ```yaml database: _target_: app.adapters.PostgresAdapter host: localhost port: 5432 pool_size: 10 username: ${DB_USER} password: ${DB_PASSWORD} ``` **Python:** ```python from sprigconfig import ConfigSingleton, instantiate cfg = ConfigSingleton.get() db = instantiate(cfg.database) ``` --- * 24 comprehensive tests covering all features * **Format-agnostic testing**: Validates YAML, JSON, and TOML configs * **Integration tests**: Verify `@config_inject` compatibility * All tests use real config files (not inline dicts only) * 157 total tests pass (24 new + 133 existing) --- * **No breaking changes** - Fully backward compatible * `_target_` is just another config key if not used with `instantiate()` * Existing code continues to work unchanged * Opt-in feature - must explicitly call `instantiate()` --- * **1.4.0** - Feature-complete stable release * **1.5.0+** - Future enhancements (partial support, validation framework, etc.) --- -
V1.4.0-RC1
0fb2c111 · ·Release 1.4.0-RC1 This is a **pre-release for Phase 4** introducing **Hydra-style `_target_` support for dynamic class instantiation from configuration**. This enables powerful patterns like hexagonal architecture with swappable adapters instantiated directly from config files. **⚠️ Pre-Release**: This is a release candidate. API may change based on feedback. Not recommended for production use. --- * **Dynamic Class Instantiation** - Hydra-style `_target_` support: * Specify a class path in config: `_target_: "my.module.ClassName"` * Automatically extract parameters from config section * Instantiate class directly from configuration * Perfect for hexagonal architecture and adapter patterns * **`instantiate()` Function** - New public API in `sprigconfig`: * `instantiate(config_section)` - Creates instance from `_target_` * Automatic parameter extraction based on `__init__` signature * Type conversion via type hints (int, float, bool, str, list, dict) * `_recursive_=True` (default) - Recursively instantiate nested `_target_` objects * `_convert_types_=True` (default) - Apply type conversion to parameters * **Type Conversion System**: * Automatic conversion based on Python type hints * Preserves LazySecret and Config objects (never converted) * Clear error messages with full context * **Seamless @config_inject Integration**: * Instantiated objects work perfectly with `@config_inject` decorator * Constructor parameters come from `_target_` config * Other values still available for `@config_inject` in methods * Two DI patterns work together harmoniously * **Comprehensive Documentation**: * Module documentation: `src/sprigconfig/instantiate.md` * Full API reference with examples * Design principles and use cases * Error handling and security notes --- **Config (YAML):** ```yaml database: _target_: app.adapters.PostgresAdapter host: localhost port: 5432 pool_size: 10 username: ${DB_USER} password: ${DB_PASSWORD} ``` **Python:** ```python from sprigconfig import ConfigSingleton, instantiate cfg = ConfigSingleton.get() db = instantiate(cfg.database) ``` --- * 24 comprehensive tests covering all features * **Format-agnostic testing**: Validates YAML, JSON, and TOML configs * **Integration tests**: Verify `@config_inject` compatibility * All tests use real config files (not inline dicts only) * 157 total tests pass (24 new + 133 existing) --- * **No breaking changes** - Fully backward compatible * `_target_` is just another config key if not used with `instantiate()` * Existing code continues to work unchanged * Opt-in feature - must explicitly call `instantiate()` --- * **1.4.0** - Feature-complete stable release * **1.5.0+** - Future enhancements (partial support, validation framework, etc.) --- -
V1.3.0
d8c78f50 · ·Release 1.3.0 This is a **major feature release** that adds Spring Boot-style dependency injection to SprigConfig, enabling cleaner, more declarative code through descriptors and decorators. --- * **Dependency Injection** - Three new patterns for configuration injection: * **`ConfigValue`** - Field-level descriptor for lazy config binding with type conversion * **`@ConfigurationProperties`** - Class-level decorator for auto-binding config sections * **`@config_inject`** - Function parameter injection decorator with override support * **Type Conversion System**: * Automatic type conversion based on Python type hints (int, float, bool, str, list, dict) * Clear error messages with full context when conversion fails * Preserves LazySecret and Config objects (no conversion) * **LazySecret Integration**: * Configurable `decrypt` parameter (default: False for security) * `decrypt=False` - Returns LazySecret object (encrypted in memory) * `decrypt=True` - Auto-decrypts at binding time (plaintext in memory) * Zero-trust security by default * **Nested Object Binding**: * Auto-instantiate nested config classes recursively * Preserves `._config` attribute for access to underlying Config object * Supports multiple levels of nesting * **Test-Only Refresh**: * `ConfigValue` descriptors auto-refresh after config reload (reads from new singleton) * `@ConfigurationProperties` instances require re-instantiation after reload * No production code for reload (maintains immutability guarantee) * **Documentation**: * Comprehensive implementation guide: `docs/dependency-injection-explained.md` * Module docstrings in `src/sprigconfig/injection.py` * Updated README with dependency injection examples * Updated CLAUDE.md with dependency injection patterns --- * **Public API Exports** - Added to `sprigconfig/__init__.py`: * `ConfigValue` - Field-level descriptor * `ConfigurationProperties` - Class-level decorator * `config_inject` - Function injection decorator --- * **No breaking changes** - 100% backward compatible * **Config.get()** - Works exactly as before, will be supported indefinitely * **ConfigSingleton** - No changes to initialization or access patterns * **LazySecret** - No changes to existing secret handling * **Dependency injection is opt-in** - Existing code requires zero changes * **Gradual adoption** - Can mix `Config.get()` and dependency injection patterns in same codebase --- **Before (Traditional):** ```python cfg = ConfigSingleton.get() db_url = cfg.get("database.url") db_port = cfg.get("database.port", 5432) api_key = cfg.get("api.key").get() # LazySecret ``` **After (Dependency Injection):** ```python from sprigconfig import ConfigValue, ConfigurationProperties class MyService: db_url: str = ConfigValue("database.url") db_port: int = ConfigValue("database.port", default=5432) api_key: str = ConfigValue("api.key", decrypt=True) @ConfigurationProperties(prefix="database") class DatabaseConfig: url: str port: int ``` --- * **Reduced Boilerplate** - No more repetitive `Config.get()` calls * **Type Safety** - Automatic type conversion based on type hints * **Security** - Zero-trust LazySecret handling (encrypted by default) * **Clear Errors** - Rich error messages with full context * **Testing** - Auto-refresh behavior for descriptors in tests * **Flexibility** - Three patterns for different use cases --- Potential additions for future releases (not in this version): * Validation framework (`@Min`, `@Max`, `@Pattern`) * Complex type hints (`list[str]`, `Optional[str]`) * Production config reload (file watcher, hot reload) * Nested collection binding (`list[NestedConfig]`) --- -
V1.3.0-RC1
831dbc11 · ·Release Candidate: v1.3.0-rc1 - Spring Boot-Style Dependency Injection ## 🎉 Major New Feature: Dependency Injection SprigConfig now supports Spring Boot-style configuration injection, making it easier than ever to bind configuration values to your Python classes. ## ✨ What's New ### Three Dependency Injection Patterns 1. **ConfigValue Descriptor** - Field-level lazy binding ```python class MyService: db_url: str = ConfigValue("database.url") timeout: int = ConfigValue("api.timeout", default=30) 2. @ConfigurationProperties - Section binding @ConfigurationProperties(prefix="database") class DatabaseConfig: host: str port: int username: str 3. @config_inject - Function parameter injection @config_inject def connect(host: str = ConfigValue("database.host")): return connect_to(host) 🚀 Key Features - Lazy evaluation - ConfigValue fetches fresh values on each access - Type conversion - Automatic conversion based on type hints (str, int, float, bool, list, dict) - LazySecret support - Optional auto-decryption with decrypt=True - Default values - Fallback values for missing config keys - Clear error messages - Helpful context when keys are missing or type conversion fails - No Config object needed - Users never need to touch the Config class directly 📊 Quality Metrics - ✅ 51 comprehensive tests with 82% code coverage - ✅ All existing tests pass (backward compatible) - ✅ Detailed implementation documentation - ✅ Integration tests validate all patterns work together 📝 Documentation - docs/dependency-injection-explained.md - Deep dive into how it works - Comprehensive docstrings in src/sprigconfig/injection.py - Examples in test suite (tests/test_injection.py) ⚠️ Breaking Changes None - this release is fully backward compatible. 🧪 What to Test As a release candidate, please test: 1. ConfigValue binding with your existing config files 2. @ConfigurationProperties with nested config sections 3. LazySecret handling with both decrypt=True and decrypt=False 4. Type conversions for your use cases 5. Error messages when config keys are missing 🔗 Related - Branch: feature/dependency-injection - Closes: # --- Not recommended for production - please report any issues before stable 1.3.0 release. -
V1.2.5
c99ab648 · ·Release 1.2.5 This is a **security and developer tooling release** that addresses a dependency vulnerability and adds comprehensive security scanning capabilities for both CI/CD and local development. --- * **Fixed CVE-2025-21441**: Updated `urllib3` from 2.6.2 to 2.6.3 to address security vulnerability --- * **pip-audit** for dependency vulnerability scanning in GitLab CI/CD pipeline * **Pre-commit hooks** for local security scanning: * pip-audit (dependency vulnerabilities) - non-blocking, informational only * Bandit (Python code security analysis) - runs on commits * ruff (linting) * **Dependency management documentation** (`docs/dependency-management.md`) covering: * Viewing and understanding dependency trees * Finding why packages are installed (Poetry equivalent of `yarn why`) * Updating dependencies safely * Security scanning workflows * Vulnerability remediation procedures --- * Replaced Snyk with pip-audit for dependency scanning (official PyPA tool, no authentication required) * Added `pre-commit`, `pip-audit`, and `bandit` to dev dependencies --- * No breaking changes * No API changes * No configuration changes required * Existing functionality unchanged --- * Run `poetry install` to get new dev dependencies (pre-commit, pip-audit, bandit) * Install pre-commit hooks: `poetry run pre-commit install` * Scan dependencies manually: `poetry run pip-audit` * Scan code manually: `poetry run bandit -r src` * See `docs/dependency-management.md` for complete dependency management guide ---
-
V1.2.4
36abb0fd · ·### Release 1.2.4 — Full TOML Support This release completes **TOML configuration support**, bringing it to full parity with YAML and JSON. **Highlights** * TOML configs now support imports, profile overlays, and environment variable expansion * Import resolution correctly handles format aliases (e.g. `.yaml` / `.yml`) * Loader logic hardened around format vs extension semantics * Comprehensive tests added to validate TOML behavior and parity **Compatibility** * Fully backward compatible * No API or configuration changes required This is a **patch release** that completes existing functionality without altering behavior for current users.
-
V1.2.3
37af3685 · ·## [1.2.3] — 2025-12-20 ### 🎯 Summary This is a **documentation metadata synchronization release** to ensure PyPI correctly links to the hosted GitHub Pages documentation. There are **no functional or behavioral changes**. --- ### 🔄 Changed - Updated package metadata so PyPI points to the official documentation site hosted on GitHub Pages - No code changes --- ### 🔒 Backward Compatibility - No runtime changes - No API changes - No configuration changes - Fully backward compatible