chore: release 0.25.0

CHANGELOG.md

@@ -1,6 +1,15 @@
 # Changelog
 
-## Unreleased
+## 0.25.0 (2026-11-01)
+
+### Compatibility and migration
+
+- The filters a template's render reaches change, and with them the advisories reported
+  as `exploitable-vulnerability` through a filter, which may appear or disappear: a
+  render now follows a cycle of includes as far as Django may render it (#284), and
+  places a template's blocks where its chain of extends places them (#285).
+- Plugin API, additive: `coretrace_python.source.LineIndex` gives the line and column of
+  each offset of a text, lines counted as `lines_of` counts them (#288).
 
 ### Templates
 
@@ -28,6 +37,11 @@
   include, extends and load (#288): a template of 2 MB applying 160,000 filters took
   50 s to analyse, and now takes 3 s.
 
+### Documentation
+
+- `docs/usage.md` documents how a cycle of includes is followed (#284) and where the
+  chain of extends places a template's blocks (#285).
+
 ## 0.24.0 (2026-10-23)
 
 ### Compatibility and migration

docs/usage.md

@@ -374,7 +374,7 @@ the directory of the checked file; a path outside it is printed as it is.
 ```json
 {
   "schema_version": 1,
-  "tool": {"name": "coretrace-python-analyzer", "version": "0.24.0"},
+  "tool": {"name": "coretrace-python-analyzer", "version": "0.25.0"},
   "root": "/home/me/project",
   "findings": [
     {
@@ -438,7 +438,7 @@ bytes. A single-file check lists no components.
 
 ```json
 "tool": {
-  "name": "coretrace-python-analyzer", "version": "0.24.0",
+  "name": "coretrace-python-analyzer", "version": "0.25.0",
   "components": [
     {"kind": "plugin", "name": "curated-advisories", "version": "2026.09.25", "digest": "sha256:…"},
     {"kind": "advisories", "name": "advisories.json", "digest": "sha256:…"}
@@ -823,7 +823,7 @@ project's behalf would go unseen. Without a lock file, a package is never
 `not_affected`. The document's `@id` derives from its statements, so two runs with the
 same result share it; its `author` is `Unknown Author`, as OpenVEX tools write when they
 cannot know it. Its `tooling` names the analyzer and each component with its digest
-(`coretrace-python-analyzer 0.24.0; curated-advisories 2026.09.25 (sha256:…)`), so the
+(`coretrace-python-analyzer 0.25.0; curated-advisories 2026.09.25 (sha256:…)`), so the
 `@id` changes with the advisory data a statement was decided with.
 
 ## Large projects

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "coretrace-python-analyzer"
-version = "0.24.0"
+version = "0.25.0"
 description = "Static security analysis infrastructure for Python code"
 readme = "README.md"
 requires-python = ">=3.11"

src/coretrace_python/__init__.py

@@ -1,4 +1,4 @@
 """CoreTrace's Python static analysis frontend."""
 
-__version__ = "0.24.0"
+__version__ = "0.25.0"
 

tests/test_release.py

@@ -30,7 +30,7 @@ def require_changelog() -> None:
 def test_the_version_is_declared_once_and_mirrored() -> None:
     project = tomllib.loads((REPO / "pyproject.toml").read_text(encoding="utf-8"))["project"]
 
-    assert project["version"] == coretrace_python.__version__ == "0.24.0"
+    assert project["version"] == coretrace_python.__version__ == "0.25.0"
 
 
 def test_the_changelog_starts_with_the_current_version() -> None: