justinjoy · Oct 25, 2026 · Oct 25, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -8,10 +8,23 @@ wirelog floor and a validated wirelog ref (see
 
 ## [Unreleased]
 
+## [1.1.3] - 2026-10-25
+
 ### Added
 - CPython 3.15 wheels for Linux, macOS, and Windows, with CI and wheel
   installation coverage and required artifact checks before publishing.
 
+### Changed
+- Update release actions to `actions/upload-artifact@v7.0.2`,
+  `actions/download-artifact@v8.0.2`, and `pypa/cibuildwheel@v4.3.1`.
+- Bundled wirelog remains `v0.70.0` at peeled SHA
+  `c353350232c35356b34085abf5780a2fcb81e80f`; the minimum compatible
+  runtime remains `0.52.0`.
+
+### Fixed
+- Accept Python 3.15's updated `__index__` protocol error wording in
+  typed-row regression tests.
+
 ## [1.1.2] - 2026-09-22
 
 ### Changed
@@ -351,7 +364,8 @@ runtime wirelog version remaining `0.44.0`.
   wirelog#852. They are available in the later [1.0.0] line, whose
   validated wirelog ref is v0.50.0. Tracked in wirelog#859.
 
-[Unreleased]: https://github.com/semantic-reasoning/PyreWire/compare/v1.1.2...HEAD
+[Unreleased]: https://github.com/semantic-reasoning/PyreWire/compare/v1.1.3...HEAD
+[1.1.3]: https://github.com/semantic-reasoning/PyreWire/compare/v1.1.2...v1.1.3
 [1.1.2]: https://github.com/semantic-reasoning/PyreWire/compare/v1.1.1...v1.1.2
 [1.1.1]: https://github.com/semantic-reasoning/PyreWire/compare/v1.0.6...v1.1.1
 [1.0.6]: https://github.com/semantic-reasoning/PyreWire/compare/v1.0.5...v1.0.6

diff --git a/docs/release-candidate-checklist.md b/docs/release-candidate-checklist.md
@@ -1,17 +1,17 @@
-# v1.1.2 release candidate checklist
+# v1.1.3 release candidate checklist
 
-The v1.1.2 tag must not be cut until every gate below passes on the exact release commit.
+The v1.1.3 tag must not be cut until every gate below passes on the exact release commit.
 Freeze the release commit first:
 
 ```bash
 git rev-parse HEAD
 ```
 
-Record that SHA in the release issue or release PR. The `v1.1.2` tag must point to that exact SHA before any publication step. If any gate fails, do not tag or publish; open or link a GitHub issue, PR, or follow-up task that captures the failure before retrying.
+Record that SHA in the release issue or release PR. The `v1.1.3` tag must point to that exact SHA before any publication step. If any gate fails, do not tag or publish; open or link a GitHub issue, PR, or follow-up task that captures the failure before retrying.
 
 | Gate | Owner | Verification | Required evidence | Failure action |
 | --- | --- | --- | --- | --- |
-| Release commit freeze | Release manager | Command: `git rev-parse HEAD`; manual verification that `v1.1.2` will be created at that SHA. | Recorded release commit SHA and confirmation that the `v1.1.2` tag points to the same SHA. | Link a GitHub issue, PR, or follow-up task and restart the checklist from the corrected commit. |
+| Release commit freeze | Release manager | Command: `git rev-parse HEAD`; manual verification that `v1.1.3` will be created at that SHA. | Recorded release commit SHA and confirmation that the `v1.1.3` tag points to the same SHA. | Link a GitHub issue, PR, or follow-up task and restart the checklist from the corrected commit. |
 | Formatting | Release manager | Command: `black --check .`; command: `isort --check-only .`. | Passing command logs from the frozen release commit. | Link a GitHub issue, PR, or follow-up task before retrying or tagging. |
 | Lint and typing | Release manager | Command: `flake8 .`; command: `mypy src/pyrewire`. | Passing command logs from the frozen release commit. | Link a GitHub issue, PR, or follow-up task before retrying or tagging. |
 | Test suite | Release manager | Command: `pytest -q`. | Passing pytest log from the frozen release commit. | Link a GitHub issue, PR, or follow-up task before retrying or tagging. |
@@ -24,11 +24,11 @@ Record that SHA in the release issue or release PR. The `v1.1.2` tag must point
 | Dependabot coverage | Release manager | Manual verification of `.github/dependabot.yml`: Dependabot is configured for both `github-actions` and `pip` at `/` on a regular schedule. | Linked review note referencing the merged `.github/dependabot.yml` and both ecosystems. | Link a GitHub issue, PR, or follow-up task before retrying or tagging. |
 | Release workflow dry run review | Release manager | Manual verification of `.github/workflows/release.yml`: it builds wheels, runs dynamic-link verification, performs clean install tests, verifies release-local wheels and sdist artifacts before publish, uses trusted publishing via OIDC, keeps least-privilege top-level permissions, restricts `id-token: write` to the publish jobs, separates TestPyPI and production PyPI trusted publishing into explicit `testpypi` and `pypi` GitHub environments, and publishes production only after tag-triggered gates pass. Do not actually tag or publish production during RC validation. | Linked review note confirming the tag-triggered `release.yml` gates, least-privilege/OIDC scope, separate publish environments, and no pre-tag production publish occurred. | Link a GitHub issue, PR, or follow-up task before retrying or tagging. |
 | TestPyPI dry run evidence | Release manager + Packaging owner | Manual verification: on the frozen RC commit, manually dispatch `.github/workflows/release.yml` with `publish-testpypi: true` and complete a TestPyPI end-to-end dry run before any production tag push. Use install command shape: `python -m pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple pyrewire==<candidate-version>`. | Frozen commit SHA, successful `release.yml` workflow run URL, TestPyPI project/version URL, artifact filenames and candidate version, SHA256 hashes, successful TestPyPI upload logs, clean install command logs/results for Linux/macOS/Windows supported Python versions, import smoke output for `pyrewire.__version__` and `pyrewire.wirelog_version()`, confirmation wheel install uses bundled `libwirelog` with no system `libwirelog`, and documented sdist behavior if any sdist install behavior is intentional. Production PyPI release remains gated on this dry-run evidence. | Link a GitHub issue, PR, or follow-up task before retrying or tagging. |
-| Artifact attestation verification | Release manager | Workflow: `.github/workflows/release.yml` publish jobs generate release artifact attestations using `actions/attest@v4`. For tagged release artifacts, command: `gh attestation verify <artifact> -R semantic-reasoning/PyreWire --signer-workflow semantic-reasoning/PyreWire/.github/workflows/release.yml --source-ref refs/tags/v1.1.2` for every release wheel (`dist/pyrewire-*.whl`) and the sdist (`dist/pyrewire-*.tar.gz`). For RC/frozen-commit validation before the final tag exists, also verify with `--source-digest <frozen-sha>`. Repo-only `-R` verification alone is not sufficient for this gate. | Successful `release.yml` run URL, release tag or frozen RC commit SHA, artifact filenames, SHA256 hashes for each wheel/sdist, and successful `gh attestation verify` output showing enforced signer workflow and source identity (`--source-ref refs/tags/v1.1.2` or `--source-digest <frozen-sha>`) for each verified artifact. | Link a GitHub issue, PR, or follow-up task before retrying or tagging. |
+| Artifact attestation verification | Release manager | Workflow: `.github/workflows/release.yml` publish jobs generate release artifact attestations using `actions/attest@v4`. For tagged release artifacts, command: `gh attestation verify <artifact> -R semantic-reasoning/PyreWire --signer-workflow semantic-reasoning/PyreWire/.github/workflows/release.yml --source-ref refs/tags/v1.1.3` for every release wheel (`dist/pyrewire-*.whl`) and the sdist (`dist/pyrewire-*.tar.gz`). For RC/frozen-commit validation before the final tag exists, also verify with `--source-digest <frozen-sha>`. Repo-only `-R` verification alone is not sufficient for this gate. | Successful `release.yml` run URL, release tag or frozen RC commit SHA, artifact filenames, SHA256 hashes for each wheel/sdist, and successful `gh attestation verify` output showing enforced signer workflow and source identity (`--source-ref refs/tags/v1.1.3` or `--source-digest <frozen-sha>`) for each verified artifact. | Link a GitHub issue, PR, or follow-up task before retrying or tagging. |
 | Wheel dynamic-link check | Packaging owner | Command: `python scripts/ci/check_dynamic_link.py wheelhouse/*.whl`. | Passing command log for the release wheel artifacts. | Link a GitHub issue, PR, or follow-up task before retrying or tagging. |
 | Clean wheel install | Bindings owner | Manual verification in a clean environment with no system `libwirelog`: install the candidate wheel, import `pyrewire`, confirm PyreWire version, confirm bundled wirelog version, and run integration tests. | Environment description, install command log, import/version log, wirelog version log, and integration test log. | Link a GitHub issue, PR, or follow-up task before retrying or tagging. |
-| Release notes and changelog | Release manager | Manual verification that the v1.1.2 changelog section is extractable and matches the GitHub Release body generated from `CHANGELOG.md`. | Extracted release notes artifact or command log plus reviewer confirmation. | Link a GitHub issue, PR, or follow-up task before retrying or tagging. |
-| Metadata, API, support, and security consistency | Release manager | Manual verification that package metadata, public API stability, support matrix, and security policy all describe the same v1.1.2 contract. | Linked review note covering `pyproject.toml`, API stability docs, support docs, and `SECURITY.md`. | Link a GitHub issue, PR, or follow-up task before retrying or tagging. |
+| Release notes and changelog | Release manager | Manual verification that the v1.1.3 changelog section is extractable and matches the GitHub Release body generated from `CHANGELOG.md`. | Extracted release notes artifact or command log plus reviewer confirmation. | Link a GitHub issue, PR, or follow-up task before retrying or tagging. |
+| Metadata, API, support, and security consistency | Release manager | Manual verification that package metadata, public API stability, support matrix, and security policy all describe the same v1.1.3 contract. | Linked review note covering `pyproject.toml`, API stability docs, support docs, and `SECURITY.md`. | Link a GitHub issue, PR, or follow-up task before retrying or tagging. |
 
 Attestation verification for this gate requires signer workflow and source identity constraints; repo-only verification is not treated as sufficient provenance evidence for PyreWire release artifacts.
 This does not independently attest upstream wirelog builds. For bundled wirelog traceability, rely on the pinned wirelog v0.70.0 SHA `c353350232c35356b34085abf5780a2fcb81e80f` in release configuration and docs, plus the wheel dynamic-link and clean-install gates above.

diff --git a/docs/versioning.md b/docs/versioning.md
@@ -69,6 +69,7 @@ The minimum compatible runtime wirelog version remains `0.52.0`.
 | `1.0.6`         | `0.52.0`        | `300f3e5150095c85331b561f1f42d99c27b4746f` | Validated against wirelog `v0.60.0` (peeled tag SHA); runtime minimum remains `0.52.0`. Bundled engine bumped to v0.60.0; the exported ABI is additive (19 new symbols, none removed) and the SONAME is unchanged. wirelog#1021 refuses a recursive `min()`/`max()` that shares an SCC with another relation - an engine-level compatibility break that reaches any program PyreWire runs. |
 | `1.1.1`         | `0.52.0`        | `39a57cf3c4cdf02f97df0e951fe8ecea7a831e2c` | Validated against wirelog `v0.62.0` (peeled tag SHA); runtime minimum remains `0.52.0`. Typed Session methods require `0.60.0` or newer. Includes the arithmetic precedence change from wirelog `0.61.0`; expressions may produce different results (see changelog). |
 | `1.1.2`         | `0.52.0`        | `c353350232c35356b34085abf5780a2fcb81e80f` | Validated against wirelog `v0.70.0` (peeled tag SHA); runtime minimum remains `0.52.0`. Bundled-engine refresh; the PyreWire public API is unchanged. |
+| `1.1.3`         | `0.52.0`        | `c353350232c35356b34085abf5780a2fcb81e80f` | Adds CPython 3.15 wheels and CI coverage. Bundled wirelog remains `v0.70.0`; the runtime minimum and public API are unchanged. |
 
 The table grows with every release; the source of truth is the
 [CHANGELOG](https://github.com/semantic-reasoning/PyreWire/blob/main/CHANGELOG.md).
diff --git a/pyproject.toml b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pyrewire"
-version = "1.1.2"
+version = "1.1.3"
 description = "Python wrapper for wirelog - declarative dataflow analysis"
 readme = "README.md"
 requires-python = ">=3.11"

diff --git a/src/pyrewire/__init__.py b/src/pyrewire/__init__.py
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: Apache-2.0 OR GPL-3.0-or-later
 """PyreWire - Python wrapper for wirelog declarative dataflow analysis."""
 
-__version__ = "1.1.2"
+__version__ = "1.1.3"
 __author__ = "PyreWire Contributors"
 __license__ = "Apache-2.0 OR GPL-3.0-or-later"
 

diff --git a/tests/docs/test_release_candidate_checklist.py b/tests/docs/test_release_candidate_checklist.py
@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: Apache-2.0 OR GPL-3.0-or-later
-"""Regression coverage for the v1.1.2 release candidate checklist."""
+"""Regression coverage for the v1.1.3 release candidate checklist."""
 
 from __future__ import annotations
 
@@ -74,7 +74,7 @@ def test_release_commit_freeze_and_tag_gating_are_explicit():
     text = _checklist()
 
     assert "git rev-parse HEAD" in text
-    assert "The `v1.1.2` tag must point to that exact SHA" in text
+    assert "The `v1.1.3` tag must point to that exact SHA" in text
     assert "must not be cut until every gate below passes on the exact release commit" in text
     assert "do not tag or publish" in text
 
@@ -166,7 +166,7 @@ def test_testpypi_dry_run_gate_and_evidence_requirements_are_documented():
 def test_release_notes_and_consistency_checks_are_documented():
     text = _checklist()
     for required in (
-        "v1.1.2 changelog section",
+        "v1.1.3 changelog section",
         "GitHub Release body",
         "CHANGELOG.md",
         "package metadata",
@@ -186,7 +186,7 @@ def test_release_security_baseline_and_provenance_scope_are_documented():
         "Dependabot is configured for both `github-actions` and `pip` at `/` on a regular schedule",
         "gh attestation verify <artifact> -R semantic-reasoning/PyreWire",
         "--signer-workflow semantic-reasoning/PyreWire/.github/workflows/release.yml",
-        "--source-ref refs/tags/v1.1.2",
+        "--source-ref refs/tags/v1.1.3",
         "--source-digest <frozen-sha>",
         "Repo-only `-R` verification alone is not sufficient for this gate",
         "release.yml` run URL",

diff --git a/tests/test_changelog_format.py b/tests/test_changelog_format.py
@@ -202,7 +202,7 @@ def test_release_compare_links_are_tag_to_tag():
     changelog = (_repo_root() / "CHANGELOG.md").read_text(encoding="utf-8")
 
     assert (
-        "[Unreleased]: https://github.com/semantic-reasoning/PyreWire/compare/v1.1.2...HEAD"
+        "[Unreleased]: https://github.com/semantic-reasoning/PyreWire/compare/v1.1.3...HEAD"
         in changelog
     )
     assert (

diff --git a/tests/test_release_metadata.py b/tests/test_release_metadata.py
@@ -28,9 +28,9 @@ def _runtime_version_literal() -> str:
     return match.group(1)
 
 
-def test_project_and_runtime_versions_are_112():
-    assert _pyproject()["project"]["version"] == "1.1.2"
-    assert _runtime_version_literal() == "1.1.2"
+def test_project_and_runtime_versions_are_113():
+    assert _pyproject()["project"]["version"] == "1.1.3"
+    assert _runtime_version_literal() == "1.1.3"
 
 
 def test_project_classifiers_mark_stable_python_311_through_315():