release: 0.6.0

[stainless-app]

Automated Release PR

0.6.0 (2026-07-24)

Full Changelog: v0.5.2...v0.6.0

Features

• add OpenSSF Gold quality gates (ea3f5ef)

Bug Fixes

• audit locked Python dependencies (#22) (b3427e6)

Chores

• add per-file license evidence (9c46658)

Documentation

• clarify repository discovery (32c6e61)

---

This pull request is managed by Stainless's GitHub App.

The semver version number is based on included commit messages. Alternatively, you can manually set the version number in the title of this pull request.

For a better experience, it is recommended to use either rebase-merge or squash-merge when merging this pull request.

🔗 Stainless website
📚 Read the docs
🙋 Reach out for help or questions

Note

Release version 0.6.0

Bumps the package version from 0.5.2 to 0.6.0 across pyproject.toml, _version.py, and the release-please manifest. Updates the lockfile and adds a new CHANGELOG section dated 2026-07-24.

^{Macroscope summarized d7fc20e.}

[kriptoburak]

Fixed the release lock and dependency-audit path at 8f1931e. The audit now checks fully hashed, locked third-party dependencies without treating the unreleased package as published. Local lint, type checks, lock validation, vulnerability audit, reproducible builds, package builds, Twine checks, multi-version tests, and coverage pass. @furkanerday please review the updated head.

[kriptoburak]

Recreated the automated release change as accountable, human-authored DCO commit(s) at 8361c30. The validated release tree is byte-identical. Public release metadata is provider-neutral. Hosted checks are rerunning. @furkanerday please review the current head.

[furkanerday]

This release pull request is not metadata-only. scripts/audit:11-29 changes dependency-audit behavior from auditing the installed locked environment to exporting and auditing a hash-checked requirements file. That may be a useful hardening change, but it is outside the stated release scope and is not represented in the release notes. Please move the audit-script change to a separate signed-off pull request, then regenerate or rebase this release PR so it contains only the intended version, changelog, lockfile, and release metadata changes.

[kriptoburak]

Confirmed. PR #22 now isolates the audit hardening.

PR #23 must merge first. It restores every protected pull request fuzz result. PR #22 can then merge with complete required checks.

After both merges, I will rebase this release onto protected main. Its diff will retain only release metadata and the lockfile version.

The metadata-only tree passes lint and type checks. Its audit fails until PR #22 becomes part of the base. I will request a fresh exact-head review afterward.

[kriptoburak]

Rebuilt the metadata-only release from protected main at signed-off head d7fc20ec61183b7f39da477ea90cafebdc029005. The diff now contains only the version manifest, changelog, package version, generated version module, and refreshed lock metadata. Lint, Pyright, mypy, REUSE 389/389, locked dependency audit, reproducible builds, Twine package checks, 8,957 multi-version tests, 94.19% statement coverage, and 80.89% branch coverage pass. @furkanerday please review this exact head.