deps: bump waxcut from 0.1.0 to 0.3.1

[dependabot]

Bumps waxcut from 0.1.0 to 0.3.1.

Release notes

Sourced from waxcut's releases.

v0.3.1

Fixed

• write_id3v2_tag no longer silently corrupts output when called on data that already has a leading ID3v2 tag — it now raises ValueError instead of stacking a second tag (which scan_frames would misparse, since it only skips one leading tag). (#38)
• PyPI project page links to LICENSE, CONTRIBUTING.md, SECURITY.md, pyproject.toml, and .clusterfuzzlite/ were relative paths that resolved against pypi.org (not GitHub) on the rendered PyPI page and 404'd. Now absolute GitHub URLs.

Docs

• New "Streaming large files" section: the frame_index_at/slice_bytes write-and-discard loop pattern as a memory-efficient alternative to split_at's eager return type, for combining with use_mmap=True on very large files. (#39)
• parse_cue_sheet's security posture documented in SECURITY.md/the docs site: why it has no size cap by design, measured ~3.9x memory amplification, and adversarial-input testing results. (#40)
• New combined worked example (cue sheet → split → tag) modeling a guard against the empty-segment edge case. (#41)
• Simplified the README's shell usage one-liner.

No breaking changes.

v0.3.0

New

• write_id3v2_tag(data, *, title=None, artist=None, track=None) -> bytes — writes a minimal ID3v2.3 tag onto split output, so tracks come out player-ready. Cross-validated against mutagen. (#19)
• parse_cue_sheet(text: str) -> list[float] — parses a CUE sheet's TRACK/INDEX 01 entries directly into split_at's timestamps_ms argument, so splitting from a .cue file no longer means hand-computing cut points. New src/waxcut/cue.py module, CueSheetError exception. (#20)
• load_audio_stream(path, *, use_mmap=True) — opt-in mmap-backed loading for large files, scanning without materializing the whole file into memory. AudioStream gains close()/context-manager support for releasing the mapping. Governed by a separate, larger 2GB size cap distinct from the default 250MB one. (#28)

All three are backward-compatible additions — no changes to existing function signatures or behavior.

Docs

• API reference and getting-started guide updated for all three new functions.
• SECURITY.md/the docs site's security page updated with the two-tier size-limit model (memory-bound default cap vs. time-bound mmap cap).

Known follow-ups (not blocking this release)

A cross-feature review across all three new features (done in addition to each one's own review) surfaced a few real but non-blocking findings, filed for future work:

• #38 — write_id3v2_tag doesn't detect an already-present ID3v2 tag on its input.
• #39 — split_at's eager return type partially offsets use_mmap's memory benefit in a full split+tag pipeline.
• #40 — SECURITY.md doesn't yet cover parse_cue_sheet.
• #41 — sub-frame-resolution or over-long cue sheets can produce an empty split segment.

v0.2.1

No code changes. Republishes with an up-to-date README on PyPI -- the 0.2.0 publish captured the README before the Cloudflare Pages migration (waxcut.netlify.app -> waxcut.pages.dev, #24-26), so PyPI's project page still showed a stale/broken link.

v0.2.0

New

• `split_at(stream, timestamps_ms) -> list[bytes]` and `join_frames(segments) -> bytes` — convenience functions for splitting into more than two parts in one call, and reassembling them back.
• `llms.txt` published at https://waxcut.netlify.app/llms.txt for LLM-agent discoverability.

Hardening

• Full docstrings on every public name, enforced by a test.

... (truncated)

Changelog

Sourced from waxcut's changelog.

[0.3.1] - 2026-08-06

Fixed

• Fixed follow-up issues from the cross-feature review: double-tag corruption in write_id3v2_tag, broken PyPI README links, and docs gaps (#44).

[0.3.0] - 2026-08-05

Added

• parse_cue_sheet: parse CUE-sheet TRACK/INDEX 01 timestamps for use with split_at (#37).
• write_id3v2_tag: propagate ID3v2 tags to split output (#36).
• use_mmap opt-in on load_audio_stream for scanning large files without fully materializing them in memory (#42).

Changed

• scan_frames now skips non-frame bytes with bytes.find() instead of a per-byte scan (#34).
• Frame storage is now compact and array-backed: ~0.95x memory amplification over input size, down from ~6x (#32).
• CI now enforces uv.lock via uv sync --locked (#33).

Fixed

• Fixed the CRC-protected VBR tag offset; added py.typed and hardened misuse guards (#29).
• Added a 250 MB size limit against resource-amplification attacks and deduped header unpacking (#30).

[0.2.1] - 2026-08-04

Changed

• Migrated the docs site from Netlify to Cloudflare Pages (#24).
• Pinned the Node version for the docs site build, added baseline security headers, and wired up Cloudflare Web Analytics (#25).
• README: made the one-liner example human-editable and added a transition to the full usage example (#26); added a split_at/ join_frames usage example (#22).

[0.2.0] - 2026-08-04

Added

• split_at/join_frames convenience functions (#21).
• Docusaurus documentation site, initially deployed to GitHub Pages

... (truncated)

Commits

• b50c91a Bump to 0.3.1 (#45)
• 0227d7c Fix follow-up issues from the cross-feature review: double-tag corruption, Py...
• 8528819 Bump to 0.3.0 (#43)
• cfd1e6e Add use_mmap opt-in to load_audio_stream for scanning large files without ful...
• 4d6c2ce Add parse_cue_sheet: CUE-sheet TRACK/INDEX 01 timestamps for split_at (#37)
• c343482 Add write_id3v2_tag: propagate ID3v2 tags to split output (#36)
• ff743b9 Update README to improve project description (#35)
• 751a872 scan_frames: skip non-frame bytes with bytes.find() instead of a per-byte sca...
• 5f61b27 CI: enforce uv.lock with uv sync --locked (#33)
• 4895845 Compact array-backed Frame storage: ~0.95x memory amplification (was ~6x) (#32)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.