release: 26.4

CHANGELOG.md

@@ -2,29 +2,34 @@
 
 ## Unreleased
 
+## 26.4 (2026-10-11)
+
 - **Breaking:** Drop support for Python 3.10, end of life since 2026-10-01. The floor is now Python 3.11.
-- Cover jQuery in the migration guide: what replaces the `jquery_url` setting and the jQuery tags, and that django-bootstrap3's default pointed at a CDN alias still serving jQuery 1.11.1, so choosing a version is likely a jump of two majors. Also say to delete the old `BOOTSTRAP3` block, since `W001` only inspects `BOOTSTRAP5` and a leftover block reads like live configuration with nothing warning about it.
-- Document migrating from django-bootstrap3 in `MIGRATE.md`: renamed settings and their changed defaults, the removed `buttons`, `bootstrap_icon` and `bootstrap_message_classes`, renamed tag arguments, and the Bootstrap class changes that take most of the work.
 - **Breaking:** Remove `django_bootstrap5.text.text_concat`. It is a general string helper, not a Bootstrap concern, and nothing in the package has ever called it: its one caller joined an icon to a button label and went away when icon support was removed, before this package was forked. It was never documented. If you import it, the replacement is three lines (#889).
 - Remove `BaseRenderer.get_size_class`, which nothing called. The module-level `get_size_class` in `django_bootstrap5.size` is the one in use, and the method shadowed its name inside the class body.
 - Fix a `template_name` set on a `RadioSelect`, `CheckboxSelectMultiple` or `ClearableFileInput` subclass being overwritten by this package's own widget template (#388). Widgets that still carry Django's default template are unaffected.
 - Accept a non-string URL value in `css_url`, `javascript_url` and `theme_url`, so a lazy `static()` value can be used directly instead of only inside the dict form (#616). Passing one raised `ValueError: dictionary update sequence element #0 has length 1; 2 is required`, because anything that was not a `str` was treated as a dict of attributes. The docs now cover serving Bootstrap from your own static files, which needs the URL resolved at render time so `ManifestStaticFilesStorage` can supply the hashed filename.
 - Recognize `week`, `search` and `color` input-type widgets as form-control widgets, so `addon_before`/`addon_after` work on them, and warn instead of silently dropping addons on a widget that cannot have them (#743, #872). Floating labels stay unsupported for `color`, where Bootstrap sizes the swatch itself.
 - Add the documented `inline_field_class` setting to `BOOTSTRAP5_DEFAULTS`, where it was missing. Its effective default is unchanged.
+- Store `src/django_bootstrap5/widgets.py` with LF line endings, like every other file and as `.editorconfig` requires. It was the only file in the repository with CRLF.
 - Support `addon_before`/`addon_after` on fields with `layout="floating"` (#866). The `form-floating` element is now nested inside the `input-group`, as Bootstrap's floating-label input-group markup requires, instead of the two being alternatives. This removes the warning added in 26.3 (#833), which existed because the combination was unsupported.
 - Add a system check that warns about keys in the `BOOTSTRAP5` setting that the package does not read, such as a setting removed in an earlier release or one carried over from django-bootstrap3 or django-bootstrap4 (`django_bootstrap5.W001`, #867). Silence it with `SILENCED_SYSTEM_CHECKS` if you keep extra keys deliberately.
-- Test on Python 3.15 (release candidate) against Django 6.1 and `main`. The job is non-blocking and 3.15 is not yet advertised as supported.
+- Harden the release and Dependabot workflows, and write down the dependency update policy in MAINTAINING.md. The Dependabot auto-merge job gated on `github.actor`, which is spoofable in a `pull_request_target` context, and now gates on the pull request author, with `fetch-metadata` as a second check. The publishing job no longer restores a build cache, so a poisoned entry cannot reach what is uploaded to PyPI. Every job in every workflow now carries `timeout-minutes`, and `ci.yml` declares `permissions: contents: read`.
+- Fail `just lint` on invisible and bidirectional control characters, which can make source read differently to a human than to the compiler (Trojan Source, CVE-2021-42574).
+- Cover every statement and branch in the test suite, and hold it there with `fail_under = 100`, checked by a `coverage report` step in CI. Until that step existed the floor was set but never run.
 - Fail the CI gate when any job fails, not only the test matrix. A failing docs or packaging build could previously be merged.
+- Test on Python 3.15 against Django 6.1 and `main`. The job is non-blocking and 3.15 is not advertised as supported, because no Django release claims it yet.
 - Drop a duplicate `coverage[toml]` entry from the `test` dependency group and sort it alphabetically.
 - Add `just release-check` to list `src/` changes against changelog entries before a release.
-- Fix the release process in MAINTAINING.md: the version bump goes through a PR, not a direct push to protected `main`.
-- Note in MAINTAINING.md why the `Django` dependency carries no upper bound.
-- Cover every statement and branch in the test suite, and hold it there with `fail_under = 100`.
-- Store `src/django_bootstrap5/widgets.py` with LF line endings, like every other file and as `.editorconfig` requires. It was the only file in the repository with CRLF.
-
 - Show commits that touch nothing in `src/` in `just release-check` as a second group, instead of hiding them. Tooling, CI and documentation changes belong in the release notes too, and the old output read as a complete list while being a filtered one.
 - Fail `just build` when `uv.lock` does not name the version in `pyproject.toml`, and add `just relock` to fix it. `uv sync --frozen` does not check the project's own version, so a stale lock passed every packaging check.
+- Add the shared AI assistance policy to CONTRIBUTING.md. Using an AI assistant is fine; saying so when it wrote a meaningful part of a change is the requirement, and it is not held against you.
+- Document migrating from django-bootstrap3 in `MIGRATE.md`: renamed settings and their changed defaults, the removed `buttons`, `bootstrap_icon` and `bootstrap_message_classes`, renamed tag arguments, and the Bootstrap class changes that take most of the work.
+- Cover jQuery in the migration guide: what replaces the `jquery_url` setting and the jQuery tags, and that django-bootstrap3's default pointed at a CDN alias still serving jQuery 1.11.1, so choosing a version is likely a jump of two majors. Also say to delete the old `BOOTSTRAP3` block, since `W001` only inspects `BOOTSTRAP5` and a leftover block reads like live configuration with nothing warning about it.
+- Fix the release process in MAINTAINING.md: the version bump goes through a PR, not a direct push to protected `main`.
 - Say in MAINTAINING.md that `just release-check` reporting no `Unreleased` entries straight after a cut means nothing is pending, not that the changelog was lost.
+- Note in MAINTAINING.md why the `Django` dependency carries no upper bound.
+
 ## 26.3 (2026-08-28)
 
 - Drop support for Django 4.2 (EOL).

pyproject.toml

@@ -31,7 +31,7 @@ license-files = ["LICENSE", "AUTHORS"]
 name = "django-bootstrap5"
 readme = "README.md"
 requires-python = ">=3.11"
-version = "26.3"
+version = "26.4"
 
 [project.optional-dependencies]
 jinja = ["Jinja2>=3.0,<4"]