meshbay.git/packages/meshbay-hub/pyproject.toml, branch 0.20

chore: bump version to 0.20.0

2026-10-15T15:45:41Z

Co-Authored-By: Claude Opus 5.5

build(deps): require PyJWT 2.15

2026-10-15T12:24:50Z

pip-audit reports two advisories against 2.14.0, both fixed in 2.15.0. PYSEC-2026-4141 reaches the hub: federation.py decodes a peer's token without verifying it first, and a deeply nested payload raises a RecursionError there, an unauthenticated 500. PYSEC-2026-4183 does not: no key is imported from a JWK. The builds resolve the newest release anyway; the floor keeps an older environment from satisfying them. Co-Authored-By: Claude Opus 5.5

chore: bump version to 0.19.0

2026-10-07T20:43:00Z

Co-Authored-By: Claude Opus 5.5

chore: license MeshBay — LGPL protocol layer, AGPL for the rest

2026-10-05T07:20:38Z

The protocol layer is LGPL-3.0-or-later in every language it exists in, so any client may use it whatever its own licence: meshbay-common, and the files marked with an SPDX line — keyderive.js, crypto.js, playlist-crypto.js, transport*.js; keyring.js, transcripts.js and argon2-wasm.js on the desktop; Kdf.kt, Keyring.kt and Transcripts.kt on Android. Everything else is AGPL-3.0-or-later, which the RPM specs and package.json already declared without a licence file to back them. Two AGPL section 7 permissions: - group applications may be under any licence when they use the interface only through a named surface (static/licenses/APPLICATION-EXCEPTION.txt); the reference application is 0BSD so that copying it brings no AGPL code; - the Android application may be conveyed linked with Google Play services. Third-party code is accounted for: THIRD-PARTY-NOTICES.txt is generated from what a build ships (packaging/third_party_notices.py) for the deb/rpm venv and the frozen Windows node — PyAV's wheel grafts in libx264 and libx265, which its BSD licence does not mention — and the vendored browser libraries get their licence texts and htm-preact.js its provenance. Wheels carry SPDX metadata, RPMs %license, debs a DEP-5 copyright file, every Windows target LICENSE.txt. test_licensing.py holds the line: the LGPL layer imports nothing under the AGPL, the reference application nothing outside the application interface, and every SPDX line is one of the known ones. Co-Authored-By: Claude Opus 5.5

chore: bump version to 0.18.0

2026-10-03T13:06:44Z

Co-Authored-By: Claude Opus 5.5

chore: bump version to 0.17.0, and the client minimum with it

2026-09-30T13:16:25Z

Co-Authored-By: Claude Opus 5.5

fix(hub): depend on sqlalchemy[asyncio]

2026-09-27T20:20:14Z

The async engine needs greenlet, which only the asyncio extra pulls in. It happened to be installed on Linux through another dependency; a fresh Windows venv had none, and every hub test using the database failed at start-up. Co-Authored-By: Claude Opus 5.5

chore: bump version to 0.16.0

2026-09-25T11:05:19Z

Co-Authored-By: Claude Opus 5.5

chore: bump version to 0.15.0

2026-09-20T06:20:35Z

Co-Authored-By: Claude Opus 5

chore: bump version to 0.14.0

2026-09-14T12:45:19Z

Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01T6jPTeocXA1BePekdsgPya