chore: prepare the 1.0.1 release

.github/workflows/publish.yml

@@ -73,13 +73,19 @@ jobs:
       # The audit and SBOM read a venv holding only the built wheel and its
       # runtime dependencies, so test and build tools aren't listed.
       - name: Audit runtime dependencies and write SBOM
+        env:
+          NAME: ${{ steps.check.outputs.name }}
+          VERSION: ${{ steps.check.outputs.version }}
         run: |
           pip install pip-audit==2.10.1 cyclonedx-bom==7.5.0
           RUNTIME="${RUNNER_TEMP}/runtime"
           python -m venv --without-pip "${RUNTIME}"
           pip --python "${RUNTIME}/bin/python" install dist/*.whl
           pip-audit --path "$("${RUNTIME}/bin/python" -c "import sysconfig; print(sysconfig.get_path('purelib'))")"
           cyclonedx-py environment --pyproject pyproject.toml --mc-type library --output-format JSON --output-file sbom.cdx.json "${RUNTIME}/bin/python"
+          # cyclonedx-py gives the root component no purl.
+          jq --arg purl "pkg:pypi/${NAME}@${VERSION}" '.metadata.component.purl = $purl' sbom.cdx.json > "${RUNNER_TEMP}/sbom.cdx.json"
+          mv "${RUNNER_TEMP}/sbom.cdx.json" sbom.cdx.json
 
       - name: Checksums
         working-directory: dist

CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 1.0.1 (2026-10-30)
+
+No changes to the SDK's code.
+
+### Changed
+- The README's Client SDK links point to `@spreedly/composer-sdk-client`.
+- The SBOM on the GitHub Release gives its root component the package's purl, `pkg:pypi/spreedly-composer-sdk-server@1.0.1`.
+
 ## 1.0.0 (2026-10-23)
 
 First release as `spreedly-composer-sdk-server`. If you're upgrading from `dodgeball-server-sdk`, read **Changed** and **Removed**.

README.md

@@ -30,7 +30,7 @@ The Composer Server SDK for Python makes integration with the Composer API easy
 
 ## Related
 
-Check out the [Client SDK](https://npmjs.com/package/@dodgeball/trust-sdk-client) for how to integrate Composer into your frontend applications.
+Check out the [Client SDK](https://www.npmjs.com/package/@spreedly/composer-sdk-client) for how to integrate Composer into your frontend applications.
 
 [Composer examples](https://github.com/spreedly/composer-examples) has a runnable example server for this SDK in `server/python`, and a web client that calls it.
 
@@ -227,7 +227,7 @@ At the default `INFO` level the SDK writes no request or response payloads: a su
 
 | Parameter | Required | Description |
 | --- | --- | --- |
-| `source_token` | Either this or `session_id` | A token representing the device making the request. Obtained from the [Client SDK](https://npmjs.com/package/@dodgeball/trust-sdk-client). |
+| `source_token` | Either this or `session_id` | A token representing the device making the request. Obtained from the [Client SDK](https://www.npmjs.com/package/@spreedly/composer-sdk-client). |
 | `session_id` | Either this or `source_token` | The current session ID of the request. |
 | `user_id` | No | The ID of the user in your database, once you know it (for example, after registration). |
 | `use_verification_id` | No | `checkpoint` only. The ID of a verification the user already completed. See [useVerification](#useverification). |

composer/constants.py

@@ -51,7 +51,7 @@ class RequestHeader:
 
 
 # Keep in sync with the version in pyproject.toml
-SDK_VERSION = "1.0.0"
+SDK_VERSION = "1.0.1"
 
 # API Configuration
 DEFAULT_API_URL = "https://api.dodgeballhq.com/"

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "spreedly-composer-sdk-server"
-version = "1.0.0"
+version = "1.0.1"
 description = "Composer Server SDK for Python"
 readme = "README.md"
 requires-python = ">=3.11"