Prep for 0.14.3

[spoorcc]

Summary by CodeRabbit

• New Features

  • Released version 0.14.3 with updated command output and refreshed recorded demos across the app’s workflows.

• Documentation

  • Clarified release and installation guidance for 0.14.3.
  • Updated WinGet publishing instructions to use a classic token instead of a fine-grained one.

• Tests

  • Aligned acceptance test expectations with the new version number and refreshed output snapshots.

[coderabbitai]

Walkthrough

The PR updates release metadata to 0.14.3, revises Winget token documentation, and regenerates feature expectations and asciicast recordings so captured outputs show the new version string and updated release-related text.

Changes

Release metadata

Layer / File(s)	Summary
Release metadata CHANGELOG.rst, dfetch/__init__.py, doc/howto/contributing.rst, doc/tutorials/installation.rst	0.14.3 is marked as released, the package version is bumped, and release/install examples reference the new version.
Winget PAT guidance .github/workflows/winget-publish.yml, doc/explanation/threat_model_supply_chain.rst, security/tm_supply_chain.py	WINGET_TOKEN guidance now names classic PATs and updates the Winget fork/PR wording.
Feature expectation updates features/*.feature	CLI scenario outputs and SBOM expectations now assert Dfetch (0.14.3) or the matching dfetch version fields.
Workflow recordings doc/asciicasts/add.cast, doc/asciicasts/basic.cast, doc/asciicasts/freeze.cast, doc/asciicasts/import.cast, doc/asciicasts/init.cast, doc/asciicasts/interactive-add.cast, doc/asciicasts/remove.cast, doc/asciicasts/update.cast, doc/asciicasts/format-patch.cast, doc/asciicasts/update-patch.cast	Interactive, update, and patch-generation recordings were regenerated with 0.14.3 output and refreshed capture metadata.
Reporting recordings doc/asciicasts/check.cast, doc/asciicasts/check-ci.cast, doc/asciicasts/diff.cast, doc/asciicasts/environment.cast, doc/asciicasts/report.cast, doc/asciicasts/sbom.cast, doc/asciicasts/validate.cast	Check, diff, report, environment, sbom, and validate recordings were regenerated with 0.14.3 output and updated capture metadata.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• dfetch-org/dfetch#1097: Release-prep version bump with regenerated asciicast recordings and feature expectations.
• dfetch-org/dfetch#1263: winget-publish workflow documentation around WINGET_TOKEN and PAT handling.
• dfetch-org/dfetch#1182: Supply-chain threat model entry for WINGET_TOKEN PAT wording.

Suggested labels

documentation, development

Suggested reviewers

• ben-edna

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: preparing the project for the 0.14.3 release.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/dfetch-ci-step-4-o3kr0o

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/winget-publish.yml:
- Around line 53-59: The PAT guidance in the workflow comments is inconsistent
with the required write-level access. Update the notes near the token setup
instructions so the example account requirement matches the actual push need,
and refer to the PAT guidance text in the workflow comment block to keep the
permission level consistent with the branch publish step.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 25f117e5-01d5-4c11-83e9-024d321d1a74

📥 Commits

Reviewing files that changed from the base of the PR and between fb6ac2a and 9efcca4.

📒 Files selected for processing (61)

• .github/workflows/winget-publish.yml
• CHANGELOG.rst
• dfetch/__init__.py
• doc/asciicasts/add.cast
• doc/asciicasts/basic.cast
• doc/asciicasts/check-ci.cast
• doc/asciicasts/check.cast
• doc/asciicasts/diff.cast
• doc/asciicasts/environment.cast
• doc/asciicasts/format-patch.cast
• doc/asciicasts/freeze.cast
• doc/asciicasts/import.cast
• doc/asciicasts/init.cast
• doc/asciicasts/interactive-add.cast
• doc/asciicasts/remove.cast
• doc/asciicasts/report.cast
• doc/asciicasts/sbom.cast
• doc/asciicasts/update-patch.cast
• doc/asciicasts/update.cast
• doc/asciicasts/validate.cast
• doc/explanation/threat_model_supply_chain.rst
• doc/howto/contributing.rst
• doc/tutorials/installation.rst
• features/check-archive.feature
• features/check-git-repo.feature
• features/check-specific-projects.feature
• features/check-svn-repo.feature
• features/checked-project-has-dependencies.feature
• features/diff-in-git.feature
• features/diff-in-svn.feature
• features/environment.feature
• features/fetch-archive.feature
• features/fetch-checks-destination.feature
• features/fetch-file-pattern-git.feature
• features/fetch-file-pattern-svn.feature
• features/fetch-git-repo-with-submodule.feature
• features/fetch-git-repo.feature
• features/fetch-single-file-git.feature
• features/fetch-single-file-svn.feature
• features/fetch-svn-repo-with-external.feature
• features/fetch-svn-repo-with-nonstd-external.feature
• features/fetch-with-ignore-git.feature
• features/fetch-with-ignore-svn.feature
• features/freeze-projects.feature
• features/guard-against-overwriting-git.feature
• features/guard-against-overwriting-svn.feature
• features/handle-invalid-metadata.feature
• features/journey-basic-patching.feature
• features/journey-basic-usage.feature
• features/list-projects.feature
• features/patch-after-fetch-git.feature
• features/patch-after-fetch-svn.feature
• features/patch-fuzzy-matching-git.feature
• features/remove-project.feature
• features/report-sbom.feature
• features/suggest-project-name.feature
• features/update-patch-in-git.feature
• features/update-patch-in-svn.feature
• features/updated-project-has-dependencies.feature
• features/validate-manifest.feature
• security/tm_supply_chain.py