Fix 1930 (#1931)

* start new dev branch; add audit file

* Prepare the 26.7.1 stable release (#1930)

Finalise the version for the 26.7.1 stable release via `just prep-release`,
which strips the .devN suffix from both version files (pyproject.toml and
src/autobahn/_version.py). autobahn does not track uv.lock, so there is no lock
to refresh.

26.7.1 carries the completed WebSocket/RawSocket payload size-limit security
epic (#1907, advisory GHSA-hxp9-w8x3-p566): #1908 (deflate max_message_size cap
truncating instead of rejecting), #1909 (maxMessagePayloadSize enforced against
the compressed wire length instead of the uncompressed reassembled size - the
advisory itself), #1910 (backend-agnostic bounded decompression) and #1911
(asyncio RawSocket receive limit made configurable, at parity with Twisted).
It also ships the musllinux (Alpine / musl libc) CPython wheels from #1877,
which have been merged but unpublished until now.

Also fix a pre-existing docs nit while here: the "Replace actions/*-artifact@v4"
changelog entry left a bare `*`, which docutils parsed as an emphasis
start-string ("Inline emphasis start-string without end-string"). Quote it as
literal text, matching how the rest of the changelog marks up code. This was the
only such warning in the file; the docs build is now clean of it.

Verified locally: full Twisted suite 357 tests / 325 successes, ruff clean,
sphinx build free of the emphasis warning, and autobahn.__version__ == "26.7.1"
consistent across both version files.

Note: This work was completed with AI assistance (Claude Code).

Author: oberstet

.audit/oberstet_fix_1930.md

@@ -0,0 +1,8 @@
+- [ ] I did **not** use any AI-assistance tools to help create this pull request.
+- [x] I **did** use AI-assistance tools to *help* create this pull request.
+- [x] I have read, understood and followed the projects' [AI Policy](https://github.com/crossbario/autobahn-python/blob/main/AI_POLICY.md) when creating code, documentation etc. for this pull request.
+
+Submitted by: @oberstet
+Date: 2026-07-15
+Related issue(s): #1930
+Branch: oberstet:fix_1930

docs/changelog.rst

@@ -150,7 +150,7 @@ Changelog
 * Use sudo chown to fix wstest directory permissions
 * Fix permissions on wstest directories before artifact upload
 * Fix multi-path artifact upload for verified action
-* Replace actions/*-artifact@v4 with verified actions
+* Replace ``actions/*-artifact@v4`` with verified actions
 * Fix GitHub Discussions category for CI-CD notifications
 * Add automatic GitHub Discussions post for stable releases
 * Add check-release-fileset action to release workflows

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "autobahn"
-version = "26.7.1.dev1"
+version = "26.7.1"
 description = "WebSocket client & server library, WAMP real-time framework"
 readme = "README.md"
 requires-python = ">=3.11"

src/autobahn/_version.py

@@ -24,6 +24,6 @@
 #
 ###############################################################################
 
-__version__ = "26.7.1.dev1"
+__version__ = "26.7.1"
 
 __build__ = "00000000-0000000"