release: sense-memory 0.3.1 — require nostrkey>=0.3.5 (transitive cryptography CVE fix)

Author: vveerrgg

CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.3.1 — 2026-07-21
+
+### Security
+
+- **Transitive `cryptography` CVE fix.** `cryptography` reaches this package
+  only via `nostrkey`, which previously capped `cryptography<45.0` and shipped
+  the vulnerable 44.0.3 (four advisories: PYSEC-2026-35, PYSEC-2026-2141,
+  GHSA-537c-gmf6-5ccf, and a related OpenSSL fix). The `nostrkey` floor is
+  raised to `>=0.3.5`, whose lifted ceiling resolves `cryptography` 49.0.0.
+
+### Changed
+
+- Dependency floor raised from `nostrkey>=0.3.4` to `nostrkey>=0.3.5`.
+  Verified against the local nostrkey 0.3.5 build: full suite and `pip-audit`
+  green on `cryptography` 49.
+
 ## 0.3.0 — 2026-07-19
 
 ### Added

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sense-memory"
-version = "0.3.0"
+version = "0.3.1"
 description = "Sovereign persistence for OpenClaw AI agents — encrypted memories on Nostr relays"
 readme = "README.md"
 license = "MIT"
@@ -33,7 +33,7 @@ classifiers = [
     "Topic :: Software Development :: Libraries :: Python Modules",
 ]
 dependencies = [
-    "nostrkey>=0.3.4",
+    "nostrkey>=0.3.5",
 ]
 
 [project.optional-dependencies]

src/sense_memory/__init__.py

@@ -14,7 +14,7 @@
 )
 from .store import MemoryStore
 
-__version__ = "0.3.0"
+__version__ = "0.3.1"
 
 __all__ = [
     "Memory",