v0.15.0

What's Changed

• use python_full_version for dependency resolution by @grische in #53
• fix dangerous default values by @grische in #50
• use standard gitignore file by @grische in #49
• add argument to skip server copy by @philnewm in #43
• add cache for simple requirements: pkg, pkg>1.2, pkg>=1.2.3 by @shamilbi in #38
• add more tests and a CI for pytest by @grische in #48
• Resolve relative URLs by @ghykk in #39
• use Black's default line length of 88 by @grische in #57
• add tests for MetadataParser by @grische in #56
• fix: remove files with digest mismatch by @grische in #54
• add argument to allow download a range of versions of a package by @philnewm in #45
• add argument to filter package type by @philnewm in #44
• add Github Action for ruff formatting by @grische in #47
• fix: only download files for matching platforms by @grische in #58
• upload-time by @shamilbi in #60
• Bump actions/setup-python from 6.0.0 to 6.1.0 by @dependabot[bot] in #68
• Bump actions/checkout from 5.0.0 to 6.0.1 by @dependabot[bot] in #69
• evaluate env markers for requirements by @grische in #59
• fix: support Python 3.7 again by @grische in #73
• ci: fix ruff workflow name by @grische in #72
• +contrib/show-old.sh by @shamilbi in #29
• Bump actions/setup-python from 6.1.0 to 6.2.0 by @dependabot[bot] in #77
• Bump actions/checkout from 5.0.0 to 6.0.2 by @dependabot[bot] in #78
• Bump astral-sh/ruff-action from 3.5.1 to 3.6.1 by @dependabot[bot] in #79
• ci: install pytest version from pyproject.toml by @grische in #75
• download only the best-matching wheel by @grische in #61
• chore(deps): bump astral-sh/ruff-action from 3.6.1 to 4.0.0 by @dependabot[bot] in #87
• chore(deps): bump actions/checkout from 6.0.2 to 7.0.0 by @dependabot[bot] in #90
• chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 by @dependabot[bot] in #91
• fix: Skipping (take 3) by @shamilbi in #83
• chore(deps): bump astral-sh/ruff-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #92
• fix: TypeError when no sha256 hash is available by @grische in #94
• ci: add action for Claude Code PR review by @grische in #88
• ci: run LLM review via workflow_dispatch only by @grische in #103
• fix: don't abort the mirror run when a dependency download fails by @grische in #101
• fix: add timeouts to package index requests by @grische in #98
• fix: prevent path traversal via filenames from the package index by @grische in GHSA-c57w-9q2x-54pc

New Contributors

• @grische made their first contribution in #53
• @philnewm made their first contribution in #43
• @ghykk made their first contribution in #39
• @dependabot[bot] made their first contribution in #68

Full Changelog: v0.14.4...v0.15.0

Bugfix: some wheels not downloaded

Some package wheels were not downloaded due to overly strict Python interpreter version matching. This version fixes this bug, but comes with a known issue that a small number of unnecessary wheels may also be downloaded. This will be fixed in a future version.

Bugfix: parsing 'requires_python' of certain dependencies may fail

v0.14.3

Version 0.14.3

Upgrade "packaging" dependency to solve issues with non-standard file names

v0.14.2

Bump version

Bugfix: platform_tag should be optional

v0.14.1

Bump version

Multiple mirrors, multi-line values and more

1. Support multi-line values in configuration files (@shamilbi)
2. Support multiple mirrors via --config (@shamilbi)
3. Support other indexes to mirror via --index-url (@shamilbi)
4. Add platform tag to the environment (@bzbrosch)
5. Various bugfixes (@shamilbi)

Bugfix: mirroring will fail if no matched files found

v0.13.4

Bump version to 0.13.4

Bugfix: mirroring can fail for some packages

When filtering files of a package to mirror, Morgan checks whether the file's required Python version matches all environments. If a package defines its required version as a simple number instead of an actual specifier (e.g. '3' instead of the correct '==3'), then Morgan would fail when determining whether the file should be downloaded.

This release fixes the issue by forcing such files to have a valid specifier, and also ignoring files that still fail Morgan's verification.

Bugfix: downloaded files may not match all environments

When Morgan mirrors packages, it chooses the most recent version that satisfies the requirement strings, and the environments. However, when matching environments, it would select files (and therefore version) that matches at least one of the Python versions of the environments, which could lead to Morgan choosing versions that do not support all of the Python versions.

This commit fixes this bug by requiring the selected versions match ALL of the Python versions defined in the environments. This could potentially lead to Morgan not finding matches at all, but this would be fixed in a subsequent release by treating each environment independently of the others.

Support any 1.x metadata version when mirroring

This release updates Morgan's mirroring code to support any package metadata version in the 1.x family, not just 1.0.