chore(release): 0.60.3

[client-software-ci]

0.60.3 (2026-07-27)

Bug Fixes

• DeadlineLoginDialog.login() now correctly returns True on successful login. Previously it always returned False due to comparing against the wrong dialog result code, breaking the documented if ...login(): usage pattern. (fix: DeadlineLoginDialog.login() returns True on successful login #1289)
• Fixed a crash (UnboundLocalError) when saving a debug snapshot for a job bundle that has no job attachments. (fix: avoid crashes in job bundle submission edge cases #1290)
• Fixed data loss in the config dialog where editing a known-asset path to a duplicate value would silently drop the original row. Also fixed boolean settings being incorrectly persisted. (fix: prevent config dialog known-path/boolean data loss #1291)
• The job trace-schedule command no longer crashes with ZeroDivisionError when run against in-flight or partial jobs that have no completed session durations or zero session actions. (fix: make job trace-schedule robust to in-flight/partial jobs #1293)
• Fixed a security issue where the known-path containment check during job bundle submission used an unanchored prefix match, causing sibling directories sharing a common prefix (e.g. /trusted/project-secret/) to be wrongly treated as contained within a known root (/trusted/project). Path matching is now properly anchored. (fix: anchor known-path containment in job bundle submit #1294)
• Fixed a privacy issue where the telemetry stack-trace sanitizer could leak customer directory paths if they happened to share a name with framework packages (e.g. a project directory named deadline). The sanitizer now uses stricter matching to avoid misclassifying customer paths as framework paths. (fix: best-effort avoid logging non-deadline directories in telemetry stack traces #1295)
• Bumped the minimum click dependency to >= 8.3.3 on Python 3.10+ to address CVE-2026-7246. While deadline-cloud itself was not exploitable, this resolves security scanner flags. (fix: raise click floor to >= 8.3.3 (CVE-2026-7246) #1283)

[github-actions]

This adds a second ## 0.60.3 section (dated 2026-07-27) while an identical version heading ## 0.60.3 (dated 2026-07-24) already exists immediately below it (line 11). Two sections sharing the same version number will break changelog parsers and release tooling that key off the version heading, and is confusing to readers — a changelog should have one section per released version. If these are genuinely new changes released after the 07-24 build, they should go under a new bumped version (e.g. 0.60.4); if this is a correction/re-cut of 0.60.3, the two sections should be merged rather than duplicated.

Note also that CHANGELOG.md is documented as auto-generated from conventional commit messages (see AGENTS.md / CHANGELOG_GUIDELINES.md) and normally should not be hand-edited — worth confirming this edit is intentional release tooling output rather than a manual change.

[github-actions]

These two entries — the telemetry sanitizer fix (#1295) and the click >= 8.3.3 CVE bump (#1283) — are duplicates of entries already present in the pre-existing ## 0.60.3 (2026-07-24) section (lines 14–15). The same fix is now listed twice in the changelog under the same version number, with slightly reworded text. Each fix should appear once. If the new section is intended to supersede the old one, drop the duplicated entries from whichever section is being removed/merged.

[andychoquette]

Closing to regenerate: the CHANGELOG on mainline still contains the stale 0.60.3 (2026-07-24) section from the aborted first release attempt, so this PR contains duplicate 0.60.3 headers. Re-bumping after a mainline changelog cleanup.