release: 4.1.0 - #91
Closed
stainless-app[bot] wants to merge 140 commits into
Closed
Conversation
fix(client): mark some request bodies as optional
Note that we still want to run tests, as these depend on the metadata.
Pin all GitHub Actions referenced in generated workflows (both first-party `actions/*` and third-party) to immutable commit SHAs. Updating pinned actions is now a deliberate codegen-side bump rather than implicit on every workflow run.
…t in workflow templates
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| @@ -0,0 +1,27 @@ | |||
| #!/usr/bin/env bash | |||
| set -exuo pipefail | |||
There was a problem hiding this comment.
The script enables xtrace while expanding the OIDC bearer token and returned signed upload URL in curl commands, exposing these credentials in retained CI output. Disable tracing for the credential-bearing commands and explicitly mask dynamically returned sensitive values.
How this was verified: The workflow passes the OIDC token as AUTH, and the script expands both AUTH and SIGNED_URL while set -x is active.
Suggested change
| set -exuo pipefail | |
| set -euo pipefail |
Knowledge Base Used: Development, validation, and release automation
Prompt To Fix With AI
This is a comment left during a code review.
Path: scripts/utils/upload-artifact.sh
Line: 2
Comment:
**Credential-bearing shell tracing**
The script enables `xtrace` while expanding the OIDC bearer token and returned signed upload URL in `curl` commands, exposing these credentials in retained CI output. Disable tracing for the credential-bearing commands and explicitly mask dynamically returned sensitive values.
**How this was verified:** The workflow passes the OIDC token as `AUTH`, and the script expands both `AUTH` and `SIGNED_URL` while `set -x` is active.
```suggestion
set -euo pipefail
```
**Knowledge Base Used:** [Development, validation, and release automation](https://app.greptile.com/brainbaselabs/-/custom-context/knowledge-base/brainbasehq/brainbase-python-sdk/-/docs/sdk-development-and-release.md)
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.
Member
|
Auto-closed by PR Janitor after 7 days of inactivity. Reopen anytime if this is still relevant. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated Release PR
4.1.0 (2026-08-24)
Full Changelog: v4.0.0...v4.1.0
Features
NotGivenfor body (#67) (3ad7f25)X-Stainless-Read-Timeoutheader (#63) (a594c75)Bug Fixes
model_dumpandmodel_dump_jsonfor Pydantic v1 (898ca7b)by_aliasunless set (887a8ec)Performance Improvements
Chores
httpx-aiohttpversion to 0.1.9 (7aeb4c8)actions/github-script(bdad5ed)api.mdfiles (034e708)--fixargument to lint script (0b1e68e)test_proxy_environment_variablesmore resilient (f79d30c)test_proxy_environment_variablesmore resilient to env (08e33e4)pyproject.tomlfile (f87b268)actions/checkoutversion (54d6bd9)get_platformtest (ef07d85)Documentation
This pull request is managed by Stainless's GitHub App.
The semver version number is based on included commit messages. Alternatively, you can manually set the version number in the title of this pull request.
For a better experience, it is recommended to use either rebase-merge or squash-merge when merging this pull request.
🔗 Stainless website
📚 Read the docs
🙋 Reach out for help or questions
Greptile Summary
This release updates the SDK to 4.1.0 with substantial client, transport, serialization, upload, compatibility, generated Workers API, test, dependency, and CI changes.
Confidence Score: 4/5
The PR appears safe to merge after addressing the non-blocking exposure of upload credentials in traced CI commands.
The functional SDK changes have no established blocking failure, but the new artifact helper should avoid logging its OIDC bearer token and signed upload URL.
Files Needing Attention: scripts/utils/upload-artifact.sh
Security Review
The new artifact-upload script traces commands that interpolate an OIDC bearer token and signed upload URL. Disable xtrace around credential-bearing commands and explicitly mask dynamically returned sensitive values.
Important Files Changed
Flowchart
%%{init: {'theme': 'neutral'}}%% flowchart LR CI[CI build job] --> Build[Build wheel] Build --> OIDC[Request GitHub OIDC token] OIDC --> Script[Artifact upload helper] Script --> Sign[Request signed upload URL] Sign --> Storage[Upload wheel to Stainless storage]Prompt To Fix All With AI
Reviews (1): Last reviewed commit: "release: 4.1.0" | Re-trigger Greptile
Context used (5)