[kernel-internal]

Automated Release PR

0.145.0 (2026-11-10)

Features

• Discard browser sessions on immediate API key revocation (#5272) (ff3251e)
• Expose Link card credential_type and explain pay token fill rejections (a556758)

---

This pull request is managed by Stainless's GitHub App.

The semver version number is based on included commit messages. Alternatively, you can manually set the version number in the title of this pull request.

For a better experience, it is recommended to use either rebase-merge or squash-merge when merging this pull request.

🔗 Stainless website
📚 Read the docs
🙋 Reach out for help or questions

---

Note

Low Risk
Release bump plus generated docs/types; behavior lives in the API—the SDK only documents it and exposes credential_type.

Overview
Releases 0.145.0 (version manifest, changelog, pyproject.toml, _version.py) with generated SDK updates for two API-facing changes.

API keys: Docstrings for delete and rotate now describe that immediate revocation (delete, or rotate with expire_in_days=0) asynchronously ends browser sessions tied to the key and discards unsaved profile data, and that the operation is not committed if session cleanup cannot be registered.

Link vault cards: Adds optional credential_type ("card" | "link_pay_token") on Link card state models and updates Link card docs to say callers can read how the credential was delivered via state.credential_type after authorize.

CI: Grants id-token: write on Semgrep and vulnerability-remediation workflows so jobs can exchange OIDC tokens for short-lived credentials.

^{Reviewed by Cursor Bugbot for commit 7c02ffe. Bugbot is set up for automated code reviews on this repo. Configure here.}