CHANGELOG¶
v0.26.28 (2026-10-08)¶
Chore¶
- chore(deps-dev): bump virtualenv from 20.36.1 to 21.7.13 (#145)
Bumps virtualenv from 20.36.1 to 21.7.13. - Release notes - Changelog - Commits
updated-dependencies: - dependency-name: virtualenv dependency-version: 21.7.13 dependency-type: indirect ...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (9746afc)
v0.26.27 (2026-10-07)¶
Chore¶
- chore(deps): bump urllib3 from 2.7.0 to 2.8.0 (#144)
Bumps urllib3 from 2.7.0 to 2.8.0. - Release notes - Changelog - Commits
updated-dependencies: - dependency-name: urllib3 dependency-version: 2.8.0 dependency-type: direct:production ...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (ae2626f)
v0.26.26 (2026-10-07)¶
Chore¶
- chore(deps-dev): bump gitpython from 3.1.58 to 3.1.62 (#143)
Bumps gitpython from 3.1.58 to 3.1.62. - Release notes - Changelog - Commits
updated-dependencies: - dependency-name: gitpython dependency-version: 3.1.62 dependency-type: indirect ...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (4bc66fa)
v0.26.25 (2026-08-08)¶
Documentation¶
- docs: point users to castiron, the successor (#142)
supabase-pydantic's README and docs contained zero mentions of castiron, so its users had no way to learn the successor exists. This adds the pointer and states the project's status plainly.
- README: a maintenance-mode notice under the intro — fixes and dependency updates continue, nothing is being removed, and no end-of-life date has been set; new feature work has moved to castiron.
- New docs page (getting-started/castiron.md) with a shipped-vs-not capability table, the OpenAPI source's blind spots, and an explicit "there is no automated migration" section.
- Welcome page: a status admonition linking that page.
- mkdocs nav: one entry for the new page.
Deliberately conservative about castiron: it is 0.1.0 and pre-alpha, with one command, one source (OpenAPI/PostgREST) and one emitter (Pydantic v2). It does not connect to a live database, emit SQLAlchemy models, read MySQL, or generate seed data — all of which supabase-pydantic does today. The "should you move yet?" section leads with "stay". No EOL or deprecation date is announced, because none has been decided.
Also drops two forward-looking clauses ("more updates are coming!", "more models & database support to come") that the new notice contradicts.
Prose only: no code, no CHANGELOG.md, no version change. @kmbhm1 (74d5bf8)
v0.26.24 (2026-08-07)¶
Chore¶
- chore(deps-dev): patch 26 dependabot alerts (#141)
All 26 open Dependabot alerts on this repo are dev-scope transitive or direct dev dependencies in poetry.lock, across three packages:
- GitPython 3.1.50 -> 3.1.58 (14 GHSAs, 11 high): argument-injection / unsafe-option-guard bypasses enabling arbitrary file read, overwrite, env-var exfiltration and command execution. Pulled in by python-semantic-release. Highest patched version required was 3.1.57.
- pillow 12.2.0 -> 12.3.0 (14 GHSAs, 11 high): heap OOB writes in ImageCmsTransform.apply / Image.paste / ImageFilter.RankFilter, decompression-bomb bypasses in the font and PDF paths, and a WindowsViewer command injection. Pulled in by matplotlib.
- pymdown-extensions 10.21.3 -> 11.0.1: path traversal in the b64 extension. The fix only exists in 11.x, so the direct dev constraint moves to ^11.0.1; mkdocs-material 9.5.50 capped it at <11.0, so it moves to 9.7.7, which dropped the upper bound.
No runtime dependency changed, so installed users are unaffected. Docs
still build under mkdocs build --strict on the new pymdown-extensions
major, and the full gate (ruff, mypy, pytest 566 passed / 91.59% cov,
vulture) is clean.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> (0582e5e)
v0.26.23 (2026-05-20)¶
Chore¶
- chore(deps-dev): bump pymdown-extensions from 10.19.1 to 10.21.3 (#140)
Bumps pymdown-extensions from 10.19.1 to 10.21.3. - Release notes - Commits
updated-dependencies: - dependency-name: pymdown-extensions dependency-version: 10.21.3 dependency-type: direct:development ...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (f036112)
v0.26.22 (2026-05-20)¶
Chore¶
- chore(deps): bump idna from 3.10 to 3.15 (#139)
Bumps idna from 3.10 to 3.15. - Release notes - Changelog - Commits
updated-dependencies: - dependency-name: idna dependency-version: '3.15' dependency-type: indirect ...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (e186d72)
v0.26.21 (2026-05-12)¶
Chore¶
- chore(deps): bump urllib3 from 2.6.3 to 2.7.0 (#138)
Bumps urllib3 from 2.6.3 to 2.7.0. - Release notes - Changelog - Commits
updated-dependencies: - dependency-name: urllib3 dependency-version: 2.7.0 dependency-type: direct:production ...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (7d0acf4)
v0.26.20 (2026-05-09)¶
Chore¶
- chore(deps-dev): bump gitpython from 3.1.47 to 3.1.50 (#137)
Bumps gitpython from 3.1.47 to 3.1.50. - Release notes - Changelog - Commits
updated-dependencies:
... and so on. For the full changelog, please see the releases page.