[dependabot]

Updates the requirements on weclappy to permit the latest version.

Release notes

Sourced from weclappy's releases.

weclappy 1.0.1

Documentation release: the README now leads with a positioning line, a short example and a Highlights list so the client's capabilities are visible on GitHub and PyPI. No code changes since 1.0.0.

Changelog

Sourced from weclappy's changelog.

[1.0.1] - 2026-10-08

Changed

• README leads with a positioning line, a five-line example and a Highlights list so the client's capabilities are visible on the first screen of GitHub and PyPI. Documentation only; no code changes.

[1.0.0] - 2026-10-08

First stable release. The public API is now frozen under Semantic Versioning; see the versioning and support policy.

Note: the [0.7.0] - 2026-07-17 entry that existed on the development branch was never released to PyPI. Its changes are included below; 1.0.0 is the direct successor of 0.6.0.

Migration

1.0.0 contains breaking changes for every 0.x user. Read Migration from 0.x before upgrading, and pin weclappy>=1.0,<2.

Deprecated

• The id= keyword on get, put, delete, upload and download still works but emits a DeprecationWarning; use entity_id=. Removed in 2.0.

Security

• Writes are never retried after an ambiguous outcome. 0.6.0 mounted a urllib3 Retry that repeated POST, PUT and DELETE on 500, 502, 503, 504 and 429, so a write that weclapp had already committed could be executed twice (duplicate invoices, double stock bookings). Writes are now retried only when the connection was provably never established.
• Redirects are never followed, so a 307/308 cannot replay a write body and the AuthenticationToken cannot follow a redirect to another host.
• Endpoints must be relative and same-origin; absolute URLs, other hosts, .. segments and fragments raise ValueError.
• entity_id and action path segments are percent-encoded; values with /, ? or # are rejected, so untrusted ids cannot reach other endpoints.
• Logs and RequestMetrics never contain the API key, query strings or bodies.
• MIT license, private vulnerability reporting, and PyPI Trusted Publishing with tag, version and changelog gates.

Added

• Adaptive load control: ConcurrencyController (AIMD per epoch driven by X-Weclapp-Wait-Ms and X-Weclapp-Wait-Reason), ConcurrencySettings, ConcurrencySnapshot and Signal. Weclapp(max_concurrency=10) sets the ceiling; Weclapp(concurrency=...) shares one controller between clients of the same tenant. Writes wait for an active 429 cooldown.
• RetryPolicy with separate budgets: transient (5xx and transport, 3 × 0.3 s

... (truncated)

Commits

• 54c1d95 release: 1.0.1 (documentation)
• cea8f8f docs: lead the README with highlights (#15)
• bc81435 docs: lead the README with highlights
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)