Skip to content

0.5.5 (2026-05-17)

Security hardening, Python 3.13 support, and credential cleanup in tests and documentation.

🐛 Fixes

  • Health check in test-api.sh fixed to validate {"status":"ok"} instead of "healthy".
  • Onboarding test script (test-onboarding.sh) aligned with the wizard flow (no auto-created project on registration).
  • EmailService mock path fixed in test_password_management.py (was pointing to users.services instead of integrations.email_service).
  • Resend adapter mocks fixed to use Emails.send_async instead of Domains.list_async.
  • Diagram description character limit added (50,000) to mitigate large input risks.

♻️ Refactors

  • Hardcoded test passwords replaced with dynamic generation via generate_test_password() and scripts/test-helpers.sh.
  • passlib replaced with direct bcrypt calls to remove dependency on the crypt module (removed in Python 3.13).
  • Test API keys in Resend tests changed to non-secret-looking strings (test-resend-api-key).

⬆️ Upgrades

  • Python 3.13 support: pyproject.toml constraint updated to >=3.12,<3.14.
  • Backend Docker base image updated to python:3.13-slim-trixie.
  • bcrypt bumped from 4.0.1 to ^4.1 (Python 3.13 compatible).
  • passlib removed from dependencies.
  • Tooling config (black, ruff, mypy) updated to py313.

📝 Docs

  • Hardcoded password examples (Password123, NewPassword456, etc.) replaced with placeholders in backend/README.md, INSTALL.md, deploy/, docs/.
  • Password policy in backend/README.md updated (minimum 12 characters + special character).
  • Code quality standard added in CLAUDE.md: never hardcode credentials in tests/scripts.
  • MongoDB connection examples changed to placeholder format (<db-user>:<db-password>).