From a1ce63b188b3099d543772a1159646a937c79ab0 Mon Sep 17 00:00:00 2001
From: Scott Converse <scott@localhost>
Date: Sun, 10 May 2026 02:12:46 -0600
Subject: [PATCH 1/2] feat(deps): bump civiccore pin to v1.0.1

---
 .github/workflows/release.yml    | 2 +-
 .github/workflows/verify.yml     | 2 +-
 CHANGELOG.md                     | 6 ++++++
 pyproject.toml                   | 2 +-
 tests/test_runtime_foundation.py | 5 ++---
 5 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b61d913..e272d8a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,7 +21,7 @@ jobs:
           cache: pip
 
       - name: Install CivicCore release wheel
-        run: python -m pip install https://github.com/CivicSuite/civiccore/releases/download/v1.0/civiccore-1.0.0-py3-none-any.whl
+        run: python -m pip install https://github.com/CivicSuite/civiccore/releases/download/v1.0.1/civiccore-1.0.1-py3-none-any.whl
 
       - name: Install package and test dependencies
         run: python -m pip install -e ".[dev]"
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index ebab817..bb5b1d7 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -13,7 +13,7 @@ jobs:
         with:
           python-version: "3.11"
       - name: Install CivicCore release wheel
-        run: python -m pip install https://github.com/CivicSuite/civiccore/releases/download/v1.0/civiccore-1.0.0-py3-none-any.whl
+        run: python -m pip install https://github.com/CivicSuite/civiccore/releases/download/v1.0.1/civiccore-1.0.1-py3-none-any.whl
       - name: Install package
         run: python -m pip install -e ".[dev]"
       - name: Run release gate
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 05b4153..b7af12b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,12 @@ All notable changes to CivicZone will be documented in this file.
 
 The format follows Keep a Changelog, and this project follows Semantic Versioning.
 
+## [Unreleased]
+
+### Changed
+
+- feat(deps): bump civiccore pin to v1.0.1 (security hardening recovery patch)
+
 ## [1.0.0] - 2026-05-07
 
 ### Recovery note
diff --git a/pyproject.toml b/pyproject.toml
index 982524f..818117a 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -13,7 +13,7 @@ authors = [
   { name = "CivicSuite contributors" }
 ]
 dependencies = [
-  "civiccore @ https://github.com/CivicSuite/civiccore/releases/download/v1.0/civiccore-1.0.0-py3-none-any.whl#sha256=92d3d9984e3b3651586a342503f0789464b7618a2a030fce91d736e199d696e0",
+  "civiccore @ https://github.com/CivicSuite/civiccore/releases/download/v1.0.1/civiccore-1.0.1-py3-none-any.whl#sha256=561d7a8f73260d50de79351d330876d2cb3488c0e046a2888e82fe09d1e03969",
   "fastapi>=0.115.0,<1.0.0",
   "uvicorn[standard]>=0.30.0,<1.0.0",
 ]
diff --git a/tests/test_runtime_foundation.py b/tests/test_runtime_foundation.py
index b185f9c..acf8cb8 100644
--- a/tests/test_runtime_foundation.py
+++ b/tests/test_runtime_foundation.py
@@ -22,9 +22,9 @@ def test_pyproject_uses_published_civiccore_release_wheel() -> None:
     assert data["tool"]["hatch"]["metadata"]["allow-direct-references"] is True
     assert (
         "civiccore @ https://github.com/CivicSuite/civiccore/releases/download/"
-        "v1.0/civiccore-1.0.0-py3-none-any.whl#sha256=92d3d9984e3b3651586a342503f0789464b7618a2a030fce91d736e199d696e0"
+        "v1.0.1/civiccore-1.0.1-py3-none-any.whl#sha256=561d7a8f73260d50de79351d330876d2cb3488c0e046a2888e82fe09d1e03969"
     ) in dependencies
-    assert "civiccore==1.0.0" not in dependencies
+    assert "civiccore==1.0.1" not in dependencies
 
 
 def test_root_endpoint_states_runtime_boundary() -> None:
@@ -85,4 +85,3 @@ def test_current_docs_mark_v1_label_as_recovered_without_product_release_overcla
         assert "release-recovery" in lowered, path
         assert "provisional" not in lowered, path
         assert "product release" not in lowered, path
-

From 09301f328133eb212975b2f4fcbb80421c87f488 Mon Sep 17 00:00:00 2001
From: Scott Converse <scott@localhost>
Date: Sun, 10 May 2026 02:27:30 -0600
Subject: [PATCH 2/2] fix(test): update civiccore_version assertion to 1.0.1
 (pin bump contract)

---
 tests/test_runtime_foundation.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/test_runtime_foundation.py b/tests/test_runtime_foundation.py
index acf8cb8..4936ad3 100644
--- a/tests/test_runtime_foundation.py
+++ b/tests/test_runtime_foundation.py
@@ -50,7 +50,7 @@ def test_health_endpoint_reports_versions() -> None:
     assert payload["status"] == "ok"
     assert payload["service"] == "civiczone"
     assert payload["version"] == "0.2.0"
-    assert payload["civiccore_version"] == "1.0.0"
+    assert payload["civiccore_version"] == "1.0.1"
 
 
 def test_release_gate_prefers_native_unix_python_before_windows_launcher() -> None: