Bound runtime dependency ranges and pin build backend (#103) * Bound runtime dependency ranges and pin build backend Add version bounds to the runtime dependencies: requests was fully unbounded and typing-extensions had no upper bound, so a fresh install could resolve either to any just-published release. As a library, socketdev declares bounded ranges rather than exact pins - exact pins in package metadata would conflict with consumers that pin their own dependencies, including socket-python-cli, which pins its entire runtime closure (socketsecurity 2.5.10+) and relies on this package's ranges staying compatible. Floors match the versions already resolved and tested in uv.lock; ceilings exclude the next major. Also pins the hatchling build backend used for sdist builds. Dependabot (uv ecosystem, 7-day cooldown) already keeps the lockfile fresh within these bounds. Companion to the socket-python-cli dependency pinning work (CE-359). Co-Authored-By: Claude Fable 5 Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> * Add CHANGELOG.md Seed a changelog in the socket-python-cli format, starting at 3.4.3, with a pointer to GitHub releases for earlier history. Co-Authored-By: Claude Fable 5 Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> * Backfill changelog from GitHub release notes Import all 53 published releases (v1.0.15 through v3.4.2) from the auto-generated GitHub release notes: one dated entry per version, pre-releases labeled, body headings demoted one level so version headings stay the top-level structure. Co-Authored-By: Claude Fable 5 Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> * Bump version to 3.5.0 The new requests floor is a newly binding constraint for consumers on older versions, so this warrants a minor bump rather than a patch. Co-Authored-By: Claude Fable 5 Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> * Fix static project version and use a Python 3.9-compatible hatchling The [project] version in pyproject.toml is static ([tool.hatch.version] is only consulted when version is declared dynamic), so bumping version.py alone left the packaging metadata and uv.lock at 3.4.2. Set the static version to 3.5.0 to match. Pin hatchling to 1.27.0 instead of 1.31.0: 1.28+ requires Python 3.10, while this package's requires-python still includes 3.9, so the newer pin would break sdist builds on 3.9. Addresses PR#103 review findings. Co-Authored-By: Claude Fable 5 Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> * Declare the version dynamic so version.py is the single source of truth Per review on PR#103: with dynamic = ["version"], hatchling reads socketdev/version.py (the file version-check.yml already validates), so packaging metadata can never drift from the checked version again. Co-Authored-By: Claude Fable 5 Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> --------- Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> Co-authored-by: Claude Fable 5

Uh oh!