CHANGELOG¶
v0.26.25 (2026-08-08)¶
Documentation¶
- docs: point users to castiron, the successor (#142)
supabase-pydantic's README and docs contained zero mentions of castiron, so its users had no way to learn the successor exists. This adds the pointer and states the project's status plainly.
- README: a maintenance-mode notice under the intro — fixes and dependency updates continue, nothing is being removed, and no end-of-life date has been set; new feature work has moved to castiron.
- New docs page (getting-started/castiron.md) with a shipped-vs-not capability table, the OpenAPI source's blind spots, and an explicit "there is no automated migration" section.
- Welcome page: a status admonition linking that page.
- mkdocs nav: one entry for the new page.
Deliberately conservative about castiron: it is 0.1.0 and pre-alpha, with one command, one source (OpenAPI/PostgREST) and one emitter (Pydantic v2). It does not connect to a live database, emit SQLAlchemy models, read MySQL, or generate seed data — all of which supabase-pydantic does today. The "should you move yet?" section leads with "stay". No EOL or deprecation date is announced, because none has been decided.
Also drops two forward-looking clauses ("more updates are coming!", "more models & database support to come") that the new notice contradicts.
Prose only: no code, no CHANGELOG.md, no version change. @kmbhm1 (74d5bf8)
v0.26.24 (2026-08-07)¶
Chore¶
- chore(deps-dev): patch 26 dependabot alerts (#141)
All 26 open Dependabot alerts on this repo are dev-scope transitive or direct dev dependencies in poetry.lock, across three packages:
- GitPython 3.1.50 -> 3.1.58 (14 GHSAs, 11 high): argument-injection / unsafe-option-guard bypasses enabling arbitrary file read, overwrite, env-var exfiltration and command execution. Pulled in by python-semantic-release. Highest patched version required was 3.1.57.
- pillow 12.2.0 -> 12.3.0 (14 GHSAs, 11 high): heap OOB writes in ImageCmsTransform.apply / Image.paste / ImageFilter.RankFilter, decompression-bomb bypasses in the font and PDF paths, and a WindowsViewer command injection. Pulled in by matplotlib.
- pymdown-extensions 10.21.3 -> 11.0.1: path traversal in the b64 extension. The fix only exists in 11.x, so the direct dev constraint moves to ^11.0.1; mkdocs-material 9.5.50 capped it at <11.0, so it moves to 9.7.7, which dropped the upper bound.
No runtime dependency changed, so installed users are unaffected. Docs
still build under mkdocs build --strict on the new pymdown-extensions
major, and the full gate (ruff, mypy, pytest 566 passed / 91.59% cov,
vulture) is clean.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> (0582e5e)
v0.26.23 (2026-05-20)¶
Chore¶
- chore(deps-dev): bump pymdown-extensions from 10.19.1 to 10.21.3 (#140)
Bumps pymdown-extensions from 10.19.1 to 10.21.3. - Release notes - Commits
updated-dependencies: - dependency-name: pymdown-extensions dependency-version: 10.21.3 dependency-type: direct:development ...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (f036112)
v0.26.22 (2026-05-20)¶
Chore¶
- chore(deps): bump idna from 3.10 to 3.15 (#139)
Bumps idna from 3.10 to 3.15. - Release notes - Changelog - Commits
updated-dependencies: - dependency-name: idna dependency-version: '3.15' dependency-type: indirect ...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (e186d72)
v0.26.21 (2026-05-12)¶
Chore¶
- chore(deps): bump urllib3 from 2.6.3 to 2.7.0 (#138)
Bumps urllib3 from 2.6.3 to 2.7.0. - Release notes - Changelog - Commits
updated-dependencies: - dependency-name: urllib3 dependency-version: 2.7.0 dependency-type: direct:production ...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (7d0acf4)
v0.26.20 (2026-05-09)¶
Chore¶
- chore(deps-dev): bump gitpython from 3.1.47 to 3.1.50 (#137)
Bumps gitpython from 3.1.47 to 3.1.50. - Release notes - Changelog - Commits
updated-dependencies: - dependency-name: gitpython dependency-version: 3.1.50 dependency-type: indirect ...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (84e72ed)
v0.26.19 (2026-04-26)¶
Chore¶
- chore(deps-dev): bump gitpython from 3.1.44 to 3.1.47 (#136)
Bumps gitpython from 3.1.44 to 3.1.47. - Release notes - Changelog - Commits
updated-dependencies: - dependency-name: gitpython dependency-version: 3.1.47 dependency-type: indirect ...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (df9d819)
v0.26.18 (2026-04-23)¶
Chore¶
- chore(deps): bump python-dotenv from 1.0.1 to 1.2.2 (#135)
Bumps python-dotenv from 1.0.1 to 1.2.2. - Release notes - Changelog - Commits
updated-dependencies: - dependency-name: python-dotenv dependency-version: 1.2.2 dependency-type: direct:production ...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (b59b8cf)
v0.26.17 (2026-04-23)¶
Chore¶
- chore(deps): bump python-dotenv from 1.0.1 to 1.2.2 (#134)
Bumps python-dotenv from 1.0.1 to 1.2.2. - Release notes - Changelog - Commits
updated-dependencies:
... and so on. For the full changelog, please see the releases page.