docs(release): 0.13.1 release notes

planning/releases/0.13.1.md

@@ -0,0 +1,71 @@
+# faststream-outbox 0.13.1 — cap fastapi below 0.140
+
+**Patch release.** No package code changes. The only change that reaches an
+installed environment is a dependency constraint: the `fastapi` extra now caps
+fastapi below `0.140`, because the FastAPI integration is broken with it.
+
+## Why
+
+fastapi 0.140.0 made `Dependant` a **slotted** dataclass and dropped `model`
+from its fields. faststream's FastAPI integration assigns `dependant.model` in
+`faststream/_internal/fastapi/get_dependant.py`, so registering any FastStream
+subscriber inside a FastAPI app now raises:
+
+```
+AttributeError: 'Dependant' object has no attribute 'model' and no __dict__ for setting new attributes
+```
+
+The bug is upstream in faststream, tracked at
+[ag2ai/faststream#2959](https://github.com/ag2ai/faststream/issues/2959). No
+fixed faststream release exists yet.
+
+Before this release, a fresh `pip install faststream-outbox[fastapi]` resolved
+straight into the broken pairing:
+
+```
++ fastapi==0.140.1
++ faststream==0.7.2
++ faststream-outbox==0.13.0
+```
+
+faststream declares **no fastapi dependency of its own** — not even an optional
+extra — so it reaches FastAPI through an optional import and expects the caller
+to supply it. That makes this package's `fastapi` extra the only place in the
+dependency graph where the pairing can be constrained.
+
+## Who was affected
+
+- **Affected:** fresh installs or unpinned re-resolves of
+  `faststream-outbox[fastapi]` or `[all]` that use the FastAPI integration path
+  (an `OutboxRouter` mounted in a FastAPI app).
+- **Not affected:** the core outbox — producers, subscribers, the lease and
+  terminal-write paths, timers, asyncpg, Kafka, Prometheus, and OpenTelemetry
+  are untouched. Environments already pinned to fastapi `<0.140` are unaffected.
+
+## Compatibility
+
+No API change. If you do not install the `fastapi` extra, nothing changes for
+you. If you do, resolution now holds you at fastapi `0.139.x` instead of
+resolving a version that fails at route registration.
+
+## Lifting the cap
+
+The cap is a proxy for the real requirement — a faststream new enough to handle
+a slotted `Dependant`. Once #2959 ships, the follow-up release should **drop the
+fastapi cap** and **raise the faststream floor** in `[project.dependencies]`
+instead, so the constraint states the actual requirement and fastapi is free to
+move again.
+
+## Touched surface
+
+- `pyproject.toml` — `fastapi` extra capped to `>=0.95,<0.140`; the same cap in
+  the dev dependency group. **No package code changed.**
+- Lint config: `CPY001` ignored and two autofixes (`ISC004`, an unused
+  `RUF100` `noqa`) taken for ruff 0.16.0, which stabilized those rules out of
+  preview. Markdown code blocks reformatted, which ruff 0.16.0 now formats.
+  None of this affects the installed package.
+
+## See also
+
+- PR: [#153](https://github.com/modern-python/faststream-outbox/pull/153).
+- Upstream: [ag2ai/faststream#2959](https://github.com/ag2ai/faststream/issues/2959).