docs: add 5.0.0 changelog entry

Packages upgraded:
- filelock 3.20.0 -> 3.29.3 (TOCTOU symlink vulnerabilities)
- pip 25.3 -> 26.1.2 (path traversal, untrusted control sphere)
- pytest 9.0.2 -> 9.0.3 (vulnerable tmpdir handling)
- uv 0.11.6 -> 0.11.20 (arbitrary file write via entry points)
- virtualenv 20.35.4 -> 21.4.2 (TOCTOU in directory creation)
- wheel 0.45.1 -> 0.47.0 (arbitrary file permission modification)

ChangeLog.md

@@ -4,6 +4,61 @@ All notable changes to this project will be documented in this file. Dates are d
 
 Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
 
+#### [5.0.0](https://github.com/craigerl/aprsd/compare/4.3.0...5.0.0)
+
+> 11 June 2026
+
+##### Breaking Changes
+
+- Upgrade to Python 3.11+ minimum [`da3ef77`](https://github.com/craigerl/aprsd/commit/da3ef77)
+- Remove openweathermap plugin [`e3fda75`](https://github.com/craigerl/aprsd/commit/e3fda75)
+- Removed AVWX plugin [`cefe3e3`](https://github.com/craigerl/aprsd/commit/cefe3e3)
+- Replace insecure pickle serialization with JSON [`202c689`](https://github.com/craigerl/aprsd/commit/202c689)
+
+##### Features
+
+- Parallel processing of plugins [`6dcacb5`](https://github.com/craigerl/aprsd/commit/6dcacb5)
+- Added new TX Scheduler and pool [`2a8b700`](https://github.com/craigerl/aprsd/commit/2a8b700)
+- Refactor threads: add daemon, period, Event-based shutdown to APRSDThread [`b7a3732`](https://github.com/craigerl/aprsd/commit/b7a3732)
+- Add join_non_daemon() to APRSDThreadList [`43ba69e`](https://github.com/craigerl/aprsd/commit/43ba69e)
+- Migrate all threads to Event-based timing [`44b8bc5`](https://github.com/craigerl/aprsd/commit/44b8bc5)
+- Add configurable stale_timeout for APRS-IS connections [`930339d`](https://github.com/craigerl/aprsd/commit/930339d)
+- Add configurable stats_store_interval for stats file saves [`490ff41`](https://github.com/craigerl/aprsd/commit/490ff41)
+- Added new owner_callsign [`d2cb208`](https://github.com/craigerl/aprsd/commit/d2cb208)
+- Added new export-plugins command [`0b01881`](https://github.com/craigerl/aprsd/commit/0b01881)
+- Added export-config [`7f7d03e`](https://github.com/craigerl/aprsd/commit/7f7d03e)
+- Added --output-json for aprsd sample-config [`24bc864`](https://github.com/craigerl/aprsd/commit/24bc864)
+- Added new APRSDPushStatsThread [`c5ca4f1`](https://github.com/craigerl/aprsd/commit/c5ca4f1)
+- Add APRS Chat bulletin script [`b064ac9`](https://github.com/craigerl/aprsd/commit/b064ac9)
+
+##### Bug Fixes
+
+- Fix DupePacketFilter checking wrong packet's processed flag [`db3a042`](https://github.com/craigerl/aprsd/commit/db3a042)
+- Add socket lock to prevent TX/RX race causing stream corruption on retransmits [`5cc918e`](https://github.com/craigerl/aprsd/commit/5cc918e)
+- Remove stale .client attribute access in send_message command [`9146ff7`](https://github.com/craigerl/aprsd/commit/9146ff7)
+- Filter stale BeaconPackets from PacketTrack on load from disk [`0c515d4`](https://github.com/craigerl/aprsd/commit/0c515d4)
+- Prevent beacon and ack packet floods from PacketTrack retries [`d8134c4`](https://github.com/craigerl/aprsd/commit/d8134c4)
+- Fix CLI command inconsistencies [`fcfb349`](https://github.com/craigerl/aprsd/commit/fcfb349)
+- Fix JSON serialization of UnknownPacket in stats [`698d218`](https://github.com/craigerl/aprsd/commit/698d218)
+- Fix client / driver inconsistencies from protocol [`3bcd03a`](https://github.com/craigerl/aprsd/commit/3bcd03a)
+- Fixed inconsistent driver send() declaration [`c99a9c9`](https://github.com/craigerl/aprsd/commit/c99a9c9)
+- Fix issue with getting the right plugin version [`6f9e6b2`](https://github.com/craigerl/aprsd/commit/6f9e6b2)
+- Fixed an issue with dev command [`008fe3c`](https://github.com/craigerl/aprsd/commit/008fe3c)
+
+##### Refactoring
+
+- Moved optional deps into pyproject.toml [`d783a01`](https://github.com/craigerl/aprsd/commit/d783a01)
+- Updates for plugins to make them more consistent [`ee61bf5`](https://github.com/craigerl/aprsd/commit/ee61bf5)
+- Make consumer call signature consistent [`6ea9889`](https://github.com/craigerl/aprsd/commit/6ea9889)
+- Added ruff to tox [`8b500ac`](https://github.com/craigerl/aprsd/commit/8b500ac)
+- Reverse the threaded plugin processing [`3128f24`](https://github.com/craigerl/aprsd/commit/3128f24)
+
+##### Security
+
+- Upgrade uv.lock to resolve 9 Dependabot security alerts [`77201f1`](https://github.com/craigerl/aprsd/commit/77201f1)
+- Bump urllib3 from 2.6.2 to 2.6.3 [`3a12ccb`](https://github.com/craigerl/aprsd/commit/3a12ccb)
+- Upgrade all pinned dependencies to latest [`#229`](https://github.com/craigerl/aprsd/pull/229)
+
 #### [4.3.0](https://github.com/craigerl/aprsd/compare/4.2.4...4.3.0)
 
 > 11 December 2025

requirements.txt

@@ -1,45 +1,45 @@
 # This file was autogenerated by uv via the following command:
 #    uv pip compile --resolver backtracking --annotation-style=line requirements.in -o requirements.txt
 aprslib @ git+https://github.com/hemna/aprs-python.git@09cd7a2829a2e9d28ee1566881c843cc4769e590  # via -r requirements.in
-attrs==25.4.0             # via ax253, kiss3, rush
+attrs==26.1.0             # via ax253, kiss3, rush
 ax253==0.1.5.post1        # via kiss3
-bitarray==3.8.0           # via ax253, kiss3
-certifi==2025.11.12       # via requests
-charset-normalizer==3.4.4  # via requests
-click==8.3.1              # via -r requirements.in
+bitarray==3.8.1           # via ax253, kiss3
+certifi==2026.5.20        # via requests
+charset-normalizer==3.4.7  # via requests
+click==8.4.1              # via -r requirements.in
 dataclasses-json==0.6.7   # via -r requirements.in
 haversine==2.9.0          # via -r requirements.in
-idna==3.11                # via requests
-importlib-metadata==8.7.0  # via ax253, kiss3
+idna==3.18                # via requests
+importlib-metadata==9.0.0  # via ax253, kiss3
 kiss3==8.0.0              # via -r requirements.in
 loguru==0.7.3             # via -r requirements.in
-markdown-it-py==4.0.0     # via rich
+markdown-it-py==4.2.0     # via rich
 marshmallow==3.26.2       # via dataclasses-json
 mdurl==0.1.2              # via markdown-it-py
 mypy-extensions==1.1.0    # via typing-inspect
 netaddr==1.3.0            # via oslo-config
-oslo-config==10.1.0       # via -r requirements.in
-oslo-i18n==6.7.1          # via oslo-config
-packaging==25.0           # via marshmallow
+oslo-config==10.4.0       # via -r requirements.in
+oslo-i18n==6.8.0          # via oslo-config
+packaging==26.2           # via marshmallow
 pbr==7.0.3                # via oslo-i18n
 pluggy==1.6.0             # via -r requirements.in
-pygments==2.19.2          # via rich
+pygments==2.20.0          # via rich
 pyserial==3.5             # via pyserial-asyncio
 pyserial-asyncio==0.6     # via kiss3
-pytz==2025.2              # via -r requirements.in
+pytz==2026.2              # via -r requirements.in
 pyyaml==6.0.3             # via oslo-config
-requests==2.32.5          # via oslo-config, update-checker, -r requirements.in
+requests==2.34.2          # via oslo-config, -r requirements.in
 rfc3986==2.0.0            # via oslo-config
-rich==14.2.0              # via -r requirements.in
+rich==15.0.0              # via -r requirements.in
 rush==2021.4.0            # via -r requirements.in
 setuptools==82.0.1        # via pbr
-stevedore==5.6.0          # via oslo-config
+stevedore==5.8.0          # via oslo-config
 thesmuggler==1.0.1        # via -r requirements.in
 timeago==1.0.16           # via -r requirements.in
 typing-extensions==4.15.0  # via typing-inspect
 typing-inspect==0.9.0     # via dataclasses-json
 tzlocal==5.3.1            # via -r requirements.in
-update-checker==0.18.0    # via -r requirements.in
-urllib3==2.6.3            # via requests
-wrapt==2.0.1              # via -r requirements.in
-zipp==3.23.0              # via importlib-metadata
+update-checker==1.0.0     # via -r requirements.in
+urllib3==2.7.0            # via requests
+wrapt==2.2.1              # via -r requirements.in
+zipp==4.1.0               # via importlib-metadata