From 7b4722d3f2590997f6af7a8dda179ce3f74cd7db Mon Sep 17 00:00:00 2001 From: Holden Date: Fri, 12 Jun 2026 03:53:16 +0000 Subject: [PATCH] =?UTF-8?q?release:=20v0.2.3=20=E2=80=94=20security=20fixe?= =?UTF-8?q?s=20and=20CI=20improvements?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Sonnet 4.6 --- CHANGELOG.md | 12 ++++++++++++ pyproject.toml | 2 +- uv.lock | 2 +- 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2655076..906500b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [0.2.3] - 2026-06-12 + +### Fixed + +- **Clear-text API key storage**: `config.py` no longer writes `API_KEY` to `.immich_config.json`. The key must come from an environment variable or `.env` file. Interactive mode now prints a tip directing users to `.env`. Resolves CodeQL `py/clear-text-storage-sensitive-data`. + +### Changed + +- **CI workflow permissions**: `test.yml` and `lint.yml` now declare `permissions: contents: read`, following least-privilege principle and resolving `actions/missing-workflow-permissions` scanner alerts. +- **CI lockfile race condition**: removed the `verify-lockfile` pre-job from `docker-publish.yml` and `release.yml`. The `update-lockfile.yml` bot maintains the lockfile; the verify step raced against it on the same push event and caused false failures. `release.yml` now runs `uv lock` inline so tag-triggered builds are always self-consistent. +- **Docs moved to wiki**: `docs/` folder removed from the repository. Setup, Troubleshooting, and FAQ pages are now at the [GitHub wiki](https://github.com/sudolulo/winnow/wiki). + ## [0.2.2] - 2026-06-12 ### Added diff --git a/pyproject.toml b/pyproject.toml index 65ce249..dbbf07b 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "winnow" -version = "0.2.2" +version = "0.2.3" description = "Immich to Frigate training sets" license = "MIT" requires-python = ">=3.12" diff --git a/uv.lock b/uv.lock index b0b6c07..14af358 100644 --- a/uv.lock +++ b/uv.lock @@ -2289,7 +2289,7 @@ wheels = [ [[package]] name = "winnow" -version = "0.2.2" +version = "0.2.3" source = { editable = "." } dependencies = [ { name = "croniter" },