release: 0.25.1 — dependency bumps, plus green docs and Windows CI

Folds in the three open Dependabot PRs:

- #45  GitHub Actions: astral-sh/setup-uv v8.2.0 -> v9.0.0,
       docker/setup-buildx-action v3 -> v4, docker/login-action v3 -> v4,
       docker/build-push-action v6 -> v7
- #59  cryptography 49.0.0 -> 50.0.0
- #60  the python-minor-and-patch group (typer, platformdirs, duckdb,
       numpy, sqlglot, mypy, ruff, ty, mkdocs-material, pymdown-extensions)

The lock is a full `uv lock --upgrade`, so it lands a superset of what the
individual PRs proposed. vgi-rpc stays pinned at 0.39.1.

Two CI failures already red on main are fixed alongside:

- Docs (strict): `Worker.resolve_token` linked `[`TokenIdentity`][]`, whose
  canonical path is a private vgi-rpc module griffe cannot resolve
  statically. Demoted to a code span and documented what the type is in
  docs/api/auth.md instead of pointing autorefs at a target that cannot exist.

- Windows (3.13 and 3.14): the `resolve_token` example in CLAUDE.md carried an
  em dash in a comment. pytest_examples pipes example source to ruff with
  `universal_newlines=True`, which encodes via the locale codec — cp1252 on
  Windows — and ruff then rejects the stream as invalid UTF-8. Replaced with
  ASCII. The other non-ASCII doc examples are outside DOC_FILES or marked
  `# illustrative`, so they are never linted.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: rustyconover

.github/workflows/ci.yml

@@ -30,7 +30,7 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.2.0
+        uses: astral-sh/setup-uv@v9.0.0
 
       - name: Set up Python ${{ matrix.python-version }}
         run: uv python install ${{ matrix.python-version }}
@@ -48,7 +48,7 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.2.0
+        uses: astral-sh/setup-uv@v9.0.0
 
       - name: Install dependencies
         run: uv sync --all-extras
@@ -81,7 +81,7 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.2.0
+        uses: astral-sh/setup-uv@v9.0.0
 
       - name: Set up Python 3.14
         run: uv python install 3.14
@@ -139,7 +139,7 @@ jobs:
           path: vgi-rpc
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.2.0
+        uses: astral-sh/setup-uv@v9.0.0
 
       - name: Set up Python 3.14
         run: uv python install 3.14

.github/workflows/docs.yml

@@ -18,7 +18,7 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.2.0
+        uses: astral-sh/setup-uv@v9.0.0
 
       - name: Set up Python
         run: uv python install 3.14

.github/workflows/integration.yml

@@ -76,7 +76,7 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.2.0
+        uses: astral-sh/setup-uv@v9.0.0
 
       - name: Set up Python 3.14
         run: uv python install 3.14

.github/workflows/release.yml

@@ -33,7 +33,7 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.2.0
+        uses: astral-sh/setup-uv@v9.0.0
 
       - name: Build vgi (sdist + wheel)
         run: uv build --sdist --wheel --out-dir dist-vgi .
@@ -108,17 +108,17 @@ jobs:
           fi
           echo "tags=$tags" >> "$GITHUB_OUTPUT"
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@v4
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build & push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: packages/vgi-fixtures/docker/Dockerfile

CLAUDE.md

@@ -437,7 +437,7 @@ class MyWorker(Worker):
         try:
             row = api_keys.lookup(token)          # your own store
         except ConnectionError as exc:
-            # "I could not find out" — 503 + Retry-After, not 401.
+            # "I could not find out" -- 503 + Retry-After, not 401.
             raise AuthUnavailableError(str(exc)) from exc
         if row is None:
             return None                           # "the credential is unknown"

docs/api/auth.md

@@ -12,6 +12,12 @@ require `pip install vgi-python[http]`; JWT authentication additionally requires
 
 ::: vgi.auth
 
+## Token introspection
+
+`TokenIdentity` is what [`Worker.resolve_token`][vgi.worker.Worker.resolve_token] returns: a
+`principal` plus an optional `token_name`. It lives in a private `vgi-rpc` module, so `vgi.auth`
+re-exports it — a worker that implements `resolve_token` never has to name a private import path.
+
 ## Secret protocol
 
 ::: vgi.secret_protocol

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "vgi-python"
-version = "0.25.0"
+version = "0.25.1"
 description = "Vector Gateway Interface - Connect DuckDB to external programs via Apache Arrow"
 readme = "README.md"
 keywords = [

uv.lock

@@ -1433,7 +1433,7 @@ def resolve_token(cls, token: str) -> TokenIdentity | None:
                 asker may itself have rejected.
 
         Returns:
-            A [`TokenIdentity`][] whose ``principal`` is in the exact form
+            A ``TokenIdentity`` whose ``principal`` is in the exact form
             this worker would derive itself, or ``None`` when the credential
             does not resolve. Never claims: a pass-through claims field would
             let a worker choose its caller's tenant routing and policy branch.