build(deps): bump bact/pitloom from 0.19.0 to 0.20.2

[dependabot]

Bumps bact/pitloom from 0.19.0 to 0.20.2.

Release notes

Sourced from bact/pitloom's releases.

v0.20.2

Pitloom 0.20.2 is a patch release for AI models. It reads CRFsuite models (labels, counts and a label-based description) and reads ONNX models' name, version and licence. Model annotations now carry collections as arrays, scalars as text with valueTypes, and embedded JSON follows RFC 8785. Over-long model names are cut with a digest and each cut gets a WARNING:, and invisible or bidi characters in model text are shown as \uXXXX. It requires licenseid 0.4.3.

[!NOTE] Known issue: a CRFsuite model's generated description (built from its labels) can replace a description from a fragment or catalogue, with a WARNING:. A fix is planned for 0.21.0.

Install for CLI/Python API:

pip install -U pitloom

Install for AI coding assistant:

See the website on how to install Pitloom AI skills and the Claude Code plugin. Try asking the AI agent to "generate SBOM for this project".

Report issues: https://github.com/bact/pitloom/issues

What's changed

• Name AI models by file; read ONNX licence, version by @​bact in bact/pitloom#292
• Speed up CI: worksteal, uv installs, separate pylint job by @​bact in bact/pitloom#295
• Windows tests: TEMP on D:, upload per-test timings by @​bact in bact/pitloom#297
• Add CRFsuite support; uniform, safer model metadata by @​bact in bact/pitloom#294

Full Changelog: bact/pitloom@v0.20.1...v0.20.2

v0.20.1

Pitloom 0.20.1 is a patch release. It reads setuptools projects the way setuptools does (a setup() keyword now overrides setup.cfg unless empty). It requires licenseid 0.4.2 for more accurate licence detection and Windows fixes, and -o - now writes only the SBOM to stdout.

[!NOTE] Limitation notes: While Pitloom can work with any Python project, it currently gathers more information from Flit, Hatchling, PDM, Poetry, setuptools, and uv_build projects. Support for build with compiled artefacts (maturin, scikit-build-core, meson-python) is in the plan. See limitation notes.

Install for CLI/Python API:

pip install -U pitloom

Install for AI coding assistant:

See the website on how to install Pitloom AI skills and the Claude Code plugin. Try asking the AI agent to "generate SBOM for this project".

Report issues: https://github.com/bact/pitloom/issues

What's changed

• Follow setuptools precedence for setup.py and setup.cfg by @​bact in bact/pitloom#287

... (truncated)

Changelog

Sourced from bact/pitloom's changelog.

---

Last-Modified: 2026-10-15 SPDX-FileCopyrightText: 2026-present Arthit Suriyawongkul SPDX-FileType: DOCUMENTATION SPDX-License-Identifier: CC0-1.0

Changelog

All notable changes to this project are documented in this file. Versions before 0.19.0 are in https://github.com/bact/pitloom/blob/main/CHANGELOG-archive.md.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

• Full release notes: https://github.com/bact/pitloom/releases
• Commit history: bact/pitloom@v0.20.2...HEAD

[Unreleased]

Added

• Every route but loom env lists extras as hasOptionalDependency (no scope, extras: a, b, an inner extra marker joined, warned), pinned by uv.lock, poetry.lock, pdm.lock (#300)
• A directory reads [tool.setuptools.dynamic] and setup.cfg file: requirements, other dynamic deps from setup.cfg/setup.py; bad lines warn; never a lock (#300)
• Every [project].authors entry is an originatedBy of the main package, one Agent per type, name and email; embed-wheel --project-dir uses them (#300)
• loom id generate --namespace IRI sets a new registry's document namespace instead of a random UUID4 one (#305)
• loom.Run/loom.run take pitloom_config= (id-registry, update-id-registry, max-dataset-hash-bytes) (#305)
• An AI model's producer is originatedBy (the Hub owner also suppliedBy); its parameter count an ai_hyperparameter parameters entry (#306)

Changed

• Required, locked and phantom edges are dependsOn with scope runtime (not in loom env) (#300)
• A dependency is named (PEP 503) and declared alike on every route, loom env too; doc_uuid changes for a project with extras or requirements files (#300)
• One Author/author is one author on every route (Jane, Bob too), cut

... (truncated)

Commits

• d95e9ed Update docs
• 0af99fb Merge pull request #298 from bact/bump-0.20.2
• 69454eb Bound the README alias regression test in time
• a667380 Walk only the README keys read for lone surrogates
• 3f05a42 Bump version to 0.20.2
• 3f4fca9 Merge pull request #294 from bact/crfsuite-support
• bd3e363 Silence pylint too-many-arguments on ONNX test helper
• 0ee1301 Merge branch 'main' into crfsuite-support
• fda940f Merge pull request #297 from bact/ci-measure
• 500cc33 Fix ONNX type_of_model; reword display-escape rule
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Coverage report

This PR does not seem to contain any modification to coverable code.