[bensynapse]

Findings F7 (release pipeline) and F8 (packaging) in the review, and the version bump for 5.0.10.

Metadata. setup.py and MANIFEST.in are replaced by pyproject.toml with flit, the same setup as jsonrpcclient.

• requires-python = ">=3.8", which is the oldest version CI tests. Classifiers list 3.8 to 3.14, free-threading and Typing :: Typed. The license is the SPDX expression MIT.
• Project links point to this repo and https://bensynapse.github.io/jsonrpcserver/. Before, the only link was the old explodinglabs repo.
• Dependencies are unchanged (jsonschema<5, oslash<1), so upgrading never pulls in a different version of either.
• The test extra now has pytest-asyncio and hypothesis. Without pytest-asyncio, 40 tests failed. The examples extra is removed, since its examples live in the docs with their own requirements file.
• jsonrpcserver.__version__ = "5.0.10". Flit reads the version from there, and tests/test_version.py checks it against the installed metadata.
• The sdist includes the tests, docs and requirements, so it can be tested on its own.

Release workflow. .github/workflows/release.yml runs on v* tags. It checks the tag against __version__ and that CHANGELOG has an entry. It builds the sdist and wheel, runs twine check, check-wheel-contents and the metadata check, and attests provenance. Then it publishes with Trusted Publishing through the pypi environment and creates the GitHub release from the CHANGELOG section. Actions are pinned by SHA, as in CI. I created the pypi environment, limited to v* tags. RELEASING.md lists the exact publisher settings to add on PyPI.

Changelog. A short intro for 5.0.10 and a Packaging section. Old PR links point at bensynapse/jsonrpcserver.

Checked locally:

• Built both files. twine check --strict, check-wheel-contents and check_metadata.py pass, and the metadata above is what the wheel shows.
• Installed the sdist with [test] on 3.8 and on free-threaded 3.14, and ran its own tests: 226 passed with full coverage on each.
• ruff, mypy and pyright are clean.
• Tried the version and CHANGELOG steps of the release workflow by hand with v5.0.10.

No tag is pushed and nothing goes to PyPI from this PR.