build: move to uv and hatchling

.bumpversion.cfg

@@ -4,7 +4,7 @@ commit = true
 tag = true
 tag_name = {new_version}
 
-[bumpversion:file:setup.py]
+[bumpversion:file:pyproject.toml]
 
 [bumpversion:file:docs/conf.py]
 

.github/workflows/python-release.yml

@@ -4,21 +4,30 @@ on:
   release:
     types: [created]
 
+permissions:
+  contents: read
+
 jobs:
   release:
     runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/django-session-timeout
+    permissions:
+      contents: read
+      id-token: write
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - name: Set up Python 3.13
-      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-      with:
-        python-version: "3.13"
-    - name: Install build requirements
-      run: python -m pip install wheel
-    - name: Build package
-      run: python setup.py sdist bdist_wheel
-    - name: Publish package
-      uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
-      with:
-        user: __token__
-        password: ${{ secrets.pypi_password }}
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        with:
+          enable-cache: false
+
+      - name: Build package
+        run: uv build
+
+      - name: Publish package
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

.github/workflows/python-test.yml

@@ -1,60 +1,53 @@
 name: Python Tests
 
-on: [push]
+on:
+  push:
+    branches: [master]
+  pull_request:
 
-jobs:
+permissions:
+  contents: read
 
+jobs:
   format:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - name: Set up Python 3.13
-      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-      with:
-        python-version: "3.13"
-    - name: Install dependencies
-      run: pip install tox
-    - name: Validate formatting
-      run: tox -e format
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install uv
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - name: Validate formatting
+        run: |
+          uv run --frozen ruff format --check src tests
+          uv run --frozen ruff check src tests
 
   test:
     runs-on: ubuntu-latest
     strategy:
-      max-parallel: 4
+      fail-fast: false
       matrix:
-        tox_env:
-            - py311-django42
-            - py312-django42
-            - py313-django42
-            - py311-django52
-            - py312-django52
-            - py313-django52
-            - py314-django52
         include:
-          - python-version: "3.11"
-            tox_env: py311-django42
-          - python-version: "3.12"
-            tox_env: py312-django42
-          - python-version: "3.13"
-            tox_env: py313-django42
-          - python-version: "3.11"
-            tox_env: py311-django52
-          - python-version: "3.12"
-            tox_env: py312-django52
-          - python-version: "3.13"
-            tox_env: py313-django52
-          - python-version: "3.14"
-            tox_env: py314-django52
-
+          - { python: "3.11", django: django42 }
+          - { python: "3.12", django: django42 }
+          - { python: "3.13", django: django42 }
+          - { python: "3.11", django: django52 }
+          - { python: "3.12", django: django52 }
+          - { python: "3.13", django: django52 }
+          - { python: "3.14", django: django52 }
+          - { python: "3.12", django: django60 }
+          - { python: "3.13", django: django60 }
+          - { python: "3.14", django: django60 }
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-      with:
-        python-version: ${{ matrix.python-version }}
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        pip install tox tox-gh-actions
-    - name: Test with tox
-      run: tox -e ${{ matrix.tox_env }}
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install uv
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        with:
+          python-version: ${{ matrix.python }}
+      - name: Test with tox
+        run: uvx --with tox-uv tox -e "py${PYTHON//./}-${DJANGO}"
+        env:
+          PYTHON: ${{ matrix.python }}
+          DJANGO: ${{ matrix.django }}

Makefile

@@ -1,26 +1,29 @@
-.PHONY: install test upload docs
+.PHONY: install format lint test retest coverage docs release
 
 
 install:
-	pip install -e .[docs,test]
+	uv sync --all-groups
+
+format:
+	uv run ruff format src tests
+	uv run ruff check --fix src tests
+
+lint:
+	uv run ruff format --check src tests
+	uv run ruff check src tests
 
 test:
-	py.test
+	uv run pytest
 
 retest:
-	py.test -vvv --lf
+	uv run pytest -vvv --lf
 
 coverage:
-	py.test --cov=django_session_timeout --cov-report=term-missing --cov-report=html
-
-format:
-	ruff format src tests
-	ruff check --fix src tests
+	uv run pytest --cov=django_session_timeout --cov-report=term-missing --cov-report=html
 
 docs:
-	$(MAKE) -C docs html
+	uv run --group docs $(MAKE) -C docs html
 
 release:
 	rm -rf dist/*
-	python setup.py sdist bdist_wheel
-	twine upload dist/*
+	uv build

README.md

@@ -1,11 +1,9 @@
-<!-- start-no-pypi -->
-[![pypi](https://img.shields.io/pypi/v/django-session-timeout.svg)](https://pypi.python.org/pypi/django-session-timeout/)
-[![readthedocs](https://readthedocs.org/projects/django-session-timeout/badge/)](https://django-session-timeout.readthedocs.io/en/latest/)
-[![tests](https://github.com/labd/django-session-timeout/workflows/Python%20Tests/badge.svg)](https://github.com/labd/django-session-timeout/actions)
-<!-- end-no-pypi -->
-
 # django-session-timeout
 
+[![PyPI](https://img.shields.io/pypi/v/django-session-timeout)](https://pypi.org/project/django-session-timeout/)
+[![tests](https://github.com/labd/django-session-timeout/actions/workflows/python-test.yml/badge.svg)](https://github.com/labd/django-session-timeout/actions/workflows/python-test.yml)
+[![readthedocs](https://readthedocs.org/projects/django-session-timeout/badge/)](https://django-session-timeout.readthedocs.io/en/latest/)
+
 Add timestamp to sessions to expire them independently
 
 ## Installation

docs/requirements.txt

@@ -1 +1 @@
--e .[docs]
+sphinx>=1.8.4

pyproject.toml

@@ -1,14 +1,90 @@
+[project]
+name = "django-session-timeout"
+version = "0.1.0"
+description = "Middleware to expire sessions after specific amount of time"
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [{ name = "Lab Digital", email = "opensource@labdigital.nl" }]
+requires-python = ">=3.11"
+dependencies = [
+    "Django>=4.2",
+]
+classifiers = [
+    "Development Status :: 5 - Production/Stable",
+    "Environment :: Web Environment",
+    "Framework :: Django",
+    "Framework :: Django :: 4.2",
+    "Framework :: Django :: 5.2",
+    "Framework :: Django :: 6.0",
+    "Programming Language :: Python",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3 :: Only",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+]
+
+[project.urls]
+Homepage = "https://github.com/labd/django-session-timeout"
+Documentation = "https://django-session-timeout.readthedocs.io/"
+Changelog = "https://github.com/labd/django-session-timeout/blob/master/CHANGES"
+
+[dependency-groups]
+dev = [
+    "coverage[toml]>=7",
+    "freezegun>=1.5.5",
+    "pytest>=8",
+    "pytest-cov>=6",
+    "pytest-django>=4.11",
+    "ruff>=0.17",
+    "tox>=4.26",
+    "tox-uv>=1.28",
+]
+docs = [
+    "sphinx>=1.8.4",
+]
 
 [build-system]
-requires = ["setuptools>=40.6.0", "wheel"]
-build-backend = "setuptools.build_meta"
+requires = ["hatchling>=1.27"]
+build-backend = "hatchling.build"
+
+[tool.uv]
+# supply-chain: only resolve releases at least 14 days old; use
+# exclude-newer-package for urgent security fixes
+exclude-newer = "14 days"
+
+[tool.uv.exclude-newer-package]
+# Locked versions newer than the 14-day cutoff; remove after 2026-11-09
+certifi = "2026-10-27T00:00:00Z"  # 2026.10.23 fixes GHSA-6q48-6c7w-9gw2
+filelock = "2026-10-27T00:00:00Z"  # 4.2.4 fixes GHSA-2g95-wg33-c5x2 GHSA-567q-5qvw-pf92 GHSA-9vhv-jxww-xfm5 ...
+uv = "2026-10-27T00:00:00Z"  # 0.13.5 fixes GHSA-hq85-5cpj-mr62
+virtualenv = "2026-10-27T00:00:00Z"  # 21.14.13 fixes GHSA-394h-qwmc-48pf GHSA-43mp-35q3-x3fq GHSA-494p-63j8-28p3 ...
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/django_session_timeout"]
+
+[tool.hatch.build.targets.sdist]
+include = [
+    "src/django_session_timeout",
+    "tests",
+    "CHANGES",
+    "LICENSE",
+    "README.md",
+]
+
+[tool.pytest.ini_options]
+minversion = "8.0"
+strict = true
+testpaths = ["tests"]
 
 [tool.coverage.run]
 branch = true
 source = ["django_session_timeout"]
 
 [tool.coverage.paths]
-source = ["src", ".tox/*/site-packages"]
+source = ["src", "*/.tox/*/site-packages"]
 
 [tool.coverage.report]
 show_missing = true