@@ -8,6 +8,15 @@
 
 [//]: # (towncrier release notes start)
 
+## 3.13.8 (2026-10-08) {: #3.13.8 }
+
+#### Bugfixes {: #3.13.8-bugfix }
+
+- Fixed quoting mistake in simple html detail pages that can lead to a possible XSS attack.
+- Fixed quoting mistake in simple html index pages that can lead to a possible XSS attack given a carefully crafted package name. CVE-2026-103871
+
+---
+
 ## 3.13.7 (2026-06-30) {: #3.13.7 }
 
 #### Bugfixes {: #3.13.7-bugfix }
 
@@ -12,7 +12,7 @@ class PulpPythonPluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_python.app"
     label = "python"
-    version = "3.13.8.dev"
+    version = "3.13.8"
     python_package_name = "pulp-python"
     domain_compatible = True
 
 
@@ -7,7 +7,7 @@ build-backend = 'setuptools.build_meta'
 
 [project]
 name = "pulp-python"
-version = "3.13.8.dev"
+version = "3.13.8"
 description = "pulp-python plugin for the Pulp Project"
 readme = "README.md"
 authors = [
@@ -79,7 +79,7 @@ ignore = [
 [tool.bumpversion]
 # This section is managed by the plugin template. Do not edit manually.
 
-current_version = "3.13.8.dev"
+current_version = "3.13.8"
 commit = false
 tag = false
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<alpha>0a)?(?P<patch>\\d+)(\\.(?P<release>[a-z]+))?"