From 10da166f3ed2e6ac1cb5111e3a020f43d45f7473 Mon Sep 17 00:00:00 2001 From: Victor Kuznetsov Date: Tue, 25 Aug 2026 13:36:50 -0700 Subject: [PATCH] Record the release-verification uv cache caveat and the pending lightning bump pre-commit: 1) maintain.sh - docs-only change, last full run minutes ago: exit 1 on the known uv-secure lightning triage, ruff/pyright/1386 tests green; 2) /simplify - docs only; 3) docs sync - these are the doc updates; 4) CLAUDE.md - no change --- docs/known-limitations.md | 6 +++++- docs/release-and-distribution.md | 6 ++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/docs/known-limitations.md b/docs/known-limitations.md index 137df50..934bde7 100644 --- a/docs/known-limitations.md +++ b/docs/known-limitations.md @@ -407,7 +407,11 @@ remain identical because isolated decoder hits can otherwise be content noise. It accepts Variant P schemas 0-2. Variant Q requires a different model, and schema 3 is rejected at the measured precision threshold. Its NumPy 1.x runtime limits the extra to Python 3.11-3.12; the rest of the package remains supported -through Python 3.14. The calibration history is in +through Python 3.14. Through 0.29.0 the extra also resolves lightning 2.6.5 +(PYSEC-2026-3624, no fixed release yet); the vulnerable `load_from_checkpoint` +path is unreachable here because TrustMark loads its checksummed checkpoints +with plain `torch.load`. Bump lightning and cut a patch release when a fix +ships. The calibration history is in [module internals](module-internals.md#metadata-and-provenance). External AI versus real image classifiers are out of scope. The project diff --git a/docs/release-and-distribution.md b/docs/release-and-distribution.md index 347beb2..917f157 100644 --- a/docs/release-and-distribution.md +++ b/docs/release-and-distribution.md @@ -117,3 +117,9 @@ After publication, verify: - the distribution workflow completed successfully; - the ComfyUI Registry node requires the new library version; - a clean install can run `remove-ai-watermarks --version`. + +A clean-install check run immediately after publication can fail with "no +version of remove-ai-watermarks==X.Y.Z" even though the simple index already +lists it: uv serves its cached pre-release view of the index. Re-run with a +fresh cache (`UV_CACHE_DIR=$(mktemp -d)`) before treating it as a release +failure.