[SizzleUnrlsd]

Release 0.16.0: template filters as calls to the functions behind them (#146, PRs #173 and #174).

Advisories

• A filter of Django's own libraries that a project template applies is a call to the function behind it, at the template's line: {{ bio|striptags }} calls django.template.defaultfilters.striptags. A template the analyzer cannot read keeps the advisories that a template filter reaches under_investigation in the VEX document.
• Attacker input in a render context reaching a filter makes the entry point exploitable at the render call. This holds only where the analyzer is certain of the value: a dict literal with constant keys, followed through the template's scopes and the blocks that render.
• The request the request context processor adds counts too, when the settings prove the processor, the render passes the request, and the template reads a text attribute of it.

Changes

• CHANGELOG.md: Unreleased becomes 0.16.0 (2026-09-27).
• pyproject.toml, src/coretrace_python/__init__.py: 0.16.0.
• docs/usage.md: the three version examples.
• tests/test_release.py: 0.15.0 becomes 0.16.0 on line 33 only, as authorized.

Verification

Full suite under Python 3.12.10: 1410 passed. ruff check passes.