[SizzleUnrlsd]

Release 0.13.0 adds one change, #162.

• Request objects (Precision: the text attributes and URL parameters of a request object carry no NOSQL #162). A new RequestObject(symbol, text=()) model says which inputs are request objects, and which of their attributes are text. Django, REST framework, aiohttp and tornado declare theirs. The text attributes of a request (GET, POST, headers, query_params, query, match_info, arguments, …) no longer carry NOSQL, and neither do the URL parameters a view receives after it. The body, the files, data and json() keep every kind. On a Django app using the Enterprise pymongo models, the three false nosql-injection findings 0.12.0 reported are gone, and the two true ones remain. The other kinds are unchanged, and so is the regression corpus.

Users of the Enterprise mongodb table need this release to avoid those false positives in Django and aiohttp code (CoreTrace-Entreprise/coretrace-python-analyzer-plugins#3).

Changes in this PR

• Version: bumped in pyproject.toml, coretrace_python.__version__, the release test, and the three version examples of the usage guide: the JSON report, its tool.components, and the VEX tooling.
• CHANGELOG.md: the Unreleased section is dated as 0.13.0. No entry changed.

Verification

• pytest: 1196 passed (build installed, so the wheel tests run too).
• pytest -m regression under Python 3.12: 19 passed.
• ruff check on the tracked files and mypy: clean.

Tag v0.13.0 after merge to publish.