Record the 5.7.0 changes so far in the changelog and extend the README fork notice

CHANGELOG.md

@@ -1,9 +1,33 @@
 # Changelog
 
-diskcache-community forked from DiskCache at upstream commit ebfa37c (3 March 2024), two commits after the 5.6.3 release. Each entry names the pull request in this repository; imported upstream pull requests name their original author.
+diskcache-community forked from DiskCache at upstream commit ebfa37c (3 March 2024), two commits after the 5.6.3 release. Each entry names the pull request in this repository. Imported upstream pull requests are referenced by number, and their commits keep their original authors in the git history.
 
 ## Unreleased
 
-- Replace the upstream CI with one `ci.yml` workflow: lint checks, tests on Python 3.10 to 3.14 on Linux, macOS and Windows, Django 4.2 and 6.0 jobs, and an import check without Django (#1).
+### Security
+
+- Add `SafeDisk`, an opt-in `Disk` for CVE-2025-69872: it unpickles only an allowlist of standard-library types, raises `TypeError` at write time for anything the allowlist could not read back, and confines the paths read from the `filename` column to the cache directory. `Deque` and `Index` take a `disk` argument, `FanoutCache.cache()`, `deque()` and `index()` honour theirs, and the Django backend gains a `DISK` option. The default `Disk` is unchanged, so every 5.6.3 cache keeps opening (#11).
+- Create every directory the cache makes with mode `0700`, including missing parents and the value subdirectories, and leave existing directories alone; includes upstream pull request 359 (#7).
+- Warn at import time when the upstream `diskcache` distribution is installed next to `diskcache-community`, since both own the same package directory (#9).
+
+### Fixes
+
+- Support SQLite builds compiled with `SQLITE_DQS=0`, such as conda-forge's sqlite builds of early 2025: single-quoted literals in the `Settings` triggers and statistics counters (upstream pull request 311), and caches written by earlier versions get their triggers rewritten on first open when the stored text differs (#3).
+- `FanoutCache.__getattr__` raises `AttributeError`, so `hasattr()` works (upstream pull request 366), and `FanoutCache.get` and `pop` return the documented tuple when a shard times out (upstream pull request 367) (#3).
+- Write bytes values without the `io.BytesIO` copy (upstream pull request 333) and fix a README typo (upstream pull request 365) (#3).
+- Accept either path separator in stored filenames, so a cache written on Windows opens on other systems and `check()` stays clean across platforms (#6).
+- A parameter name in the `ignore` set of `memoize` matches the argument whether it is passed positionally or by keyword; keys of calls that do not pass an ignored parameter positionally are unchanged (#8).
+
+### Packaging
+
 - Move packaging from `setup.py` to `pyproject.toml` under the distribution name `diskcache-community`; the import name stays `diskcache`. Includes upstream pull request 326, which removes the `setup.py test` command (#2).
-- Add the fork notice and migration steps to the README, plus `NOTICE`, `SECURITY.md`, `CONTRIBUTING.md` and this changelog; point the documentation and repository links at this fork and remove the upstream analytics, logo and funding links from the docs (this PR).
+
+### Docs
+
+- Add the fork notice and migration steps to the README, plus `NOTICE`, `SECURITY.md`, `CONTRIBUTING.md` and this changelog; point the documentation and repository links at this fork and remove the upstream analytics, logo and funding links from the docs (#4).
+
+### Tests and CI
+
+- Replace the upstream CI with one `ci.yml` workflow: lint checks, tests on Python 3.10 to 3.14 on Linux, macOS and Windows, Django 4.2 and 6.0 jobs, and an import check without Django (#1).
+- Add golden compatibility fixtures written by diskcache 5.6.3 for every container, eviction policy, tag index, statistics, `JSONDisk`, memoized calls and file-backed values, with tests that read them with the current code and a reverse-direction test that reads a fork-written cache with 5.6.3 (#5).
+- Run the test suite in CI against a SQLite built from source with `SQLITE_DQS=0` (#10).

README.rst

@@ -59,7 +59,9 @@ who can write into the cache directory can run code in the process that reads
 from it. The package still installs and works, but dependency scanners flag it
 and no fixed upstream version exists. This fork publishes the same library as
 ``diskcache-community`` and carries the fix in two steps: 5.7.0 stays
-compatible with 5.6.3 caches and adds an opt-in ``SafeDisk``; 6.0.0 makes safe
+compatible with 5.6.3 caches and adds an opt-in ``SafeDisk``, selected with
+``Cache(directory, disk=SafeDisk)`` and likewise on ``FanoutCache``,
+``Deque``, ``Index`` and the Django ``DISK`` option; 6.0.0 makes safe
 reading the default. No release has been published yet; ``SECURITY.md`` in the
 repository describes the current state.
 
@@ -70,10 +72,14 @@ What stays the same:
   5.6.3 process opens a directory written by this fork and the reverse
 - the ``JSONDisk`` bytes, the memoize key format and the persisted settings
 
+What changes for everyone: directories the cache creates get mode ``0700``,
+so only the owner can read them; existing directories keep their permissions.
+
 Migrating from ``diskcache``: both distributions install into the same
 ``diskcache/`` package directory, so they cannot be installed side by side.
 Uninstall the upstream package first, and never keep both, because
-uninstalling either one deletes the shared package::
+uninstalling either one deletes the shared package. The fork warns at import
+time when both are installed::
 
   $ pip uninstall diskcache
   $ pip install diskcache-community