erdify 0.12.3 — dev-dependency security fixes and CI maintenance

[FabianClemenz]

erdify 0.12.3 is out 🎉

A maintenance patch — no runtime or user-facing change. erdify stays dependency-free to install; this clears security advisories in the development toolchain and refreshes CI.

Security

• Updated two transitive development dependencies that had open advisories, clearing all six Dependabot alerts (4 high, 2 moderate):
  • sqlparse 0.5.5 → 0.6.0 — GHSA-prg7-hcfm-mfcr (ReDoS via dollar-quoted SQL literals), plus GHSA-pwgv-4x5q-6m9f, GHSA-f2ff-p2ww-7p4p, GHSA-3496-9g83-7v6x
  • pymdown-extensions 10.21.3 → 11.0.1 — GHSA-gm37-52c6-37mw, GHSA-9xwg-3r6f-jcx2

No released version of erdify was ever affected, including 0.12.2 and earlier. erdify declares no runtime dependencies, and neither package ships with it — sqlparse arrives via django in the dev group, pymdown-extensions via mkdocs-material in the docs group. Both are build/test/docs tooling only. There is no exposure to fix on your side.

Changed

• Dependabot now holds freshly published versions back for 7 days before proposing a version update, so the ecosystem has time to catch a compromised or broken release. Security updates are deliberately exempt and still land immediately.
• Bumped CI actions to their latest majors: astral-sh/setup-uv (9.0.0 → 10.0.1), actions/configure-pages (5.0.0 → 6.0.0), actions/upload-pages-artifact (4.0.0 → 5.0.0), and actions/deploy-pages (4.0.5 → 5.0.0) — repository infrastructure only.

Nothing to do on your side — upgrade whenever convenient:

pip install --upgrade erdify
# or
uv add --upgrade erdify

---

📦 Release · 📖 Docs · 📝 Changelog