[jeremy]

Version bump across every SDK for the v0.3.0 release: version constants, manifests, lockfiles and the Swift version assertion, by scripts/bump-version.sh 0.3.0. No code changes.

Minor, not patch: #215 changes public API in Go, Swift and Rust (below), and pre-1.0 a breaking change takes the minor.

Release notes (v0.2.4 → v0.3.0)

New

• Rust SDK's first tagged release from this repo (Rust release, CI, security and versioning plumbing #159, Rust SDK docs, examples and rubric refresh #161–Rust conformance runner #164, Describe the crate as the official client for Fizzy #173). crates.io already has fizzy-sdk 0.2.4 from the bootstrap, so 0.3.0 goes through trusted publishing (release-crates, required reviewers).

Breaking

• Sign-in follows Fizzy's real magic-link contract (Sign in through Fizzy's real magic-link contract in every SDK #215).
  • Go: CreateSession returns *generated.PendingAuthentication; RedeemMagicLink(ctx, code) returns *generated.SessionAuthorization; Login returns (*SessionAuthorization, error). New PendingToken() and ResumeMagicLinkFlow(...). Removed CreateSessionRequest/Response, RedeemMagicLinkRequest/Response and UserID.
  • Swift: start(email:) → start(emailAddress:) -> PendingAuthentication; redeem(token:) → redeem(code:) -> SessionAuthorization; completeSignup(fullName:sessionToken:) returns nothing; PendingSession, RedeemResult, SignupResult removed.
  • Rust: RedeemMagicLinkRequestContent.token renamed code.
• Model corrected where Fizzy's controllers disagree with it (Correct the model where Fizzy's controllers disagree with it #211): list_notifications drops the ignored read query; CreateCard requires board_id and drops column_id, assignee_ids and tag_names, which Fizzy never permitted; postpone_card, triage_card, un_triage_card and unpin_card are no longer idempotent and retry once at most.

Fixes and hardening

• Webhook signature read from the X-Webhook-Signature header Fizzy sends (Read the webhook signature from the X-Webhook-Signature header Fizzy actually sends #168).
• Request URLs redacted from transport errors in every SDK (Strip the request URL from a reqwest error before it becomes the SDK's #174, Redact the request URL from a transport error before it becomes the hint #175, Project the Swift transport error before it becomes the network cause #177, Project the Kotlin transport error before it becomes the network message #178).
• Retry caps: Go floors at one attempt (Floor the Go retry cap at one attempt so WithMaxRetries(0) still sends the request #180); Kotlin's is a ceiling on the operation budget (Make the Kotlin retry cap a ceiling on the operation budget and expose it in the builder #182); the conformance suite pins both (Let the conformance suite state a retry cap and pin the one-attempt floor #183); Ruby classifies a read timeout as a network error (Classify a Ruby read timeout as a network error, not a status error #181).
• Swift conformance runner (Add a Swift conformance runner so the suite pins Swift behaviour #185); rubric audit refreshed (Refresh the rubric audit against the SDK as it is now #214).

Toolchain and security

• Go 1.26.9 and the modules Trivy flags (Move to Go 1.26.9 and bump the modules Trivy flags #212); rustls 0.23.46 for RUSTSEC-2026-0346 to -0349 (Move rustls to 0.23.46 for RUSTSEC-2026-0346 through -0349 #213); dependency bumps.

Before tagging

• Wait up to 5.5 hours for reviewer-approved publishes before the GitHub Release #201 (wait up to 5.5 h for reviewer-approved publishes) is open. Without it release-github gives up after 30 minutes, so either land Wait up to 5.5 hours for reviewer-approved publishes before the GitHub Release #201 first or approve every publish environment within 30 minutes of make release VERSION=0.3.0.
• Go: WithResilience gates are never consulted #216 (Go WithResilience gates never consulted) is open and not fixed here; it was already true in 0.2.4.

After the release

fizzy-mcp-server resyncs its model with scripts/sync-model.sh at v0.3.0 (it is at v0.2.4, c721fc36); #211's corrections reach its flat catalog through that resync.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T18:50:29.938562Z	c883035	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟢 Approved

The changes consistently update release metadata and the Swift assertion to 0.3.0, with no blocking issues identified.

No open issues 🎉

2 files not reviewed

• conformance/runner/typescript/package-lock.json: Generated file
• typescript/package-lock.json: Generated file

What changed in this PR

Prepares all six SDKs for v0.3.0, reflecting the release’s public API changes without introducing new behavior here.

Changes:

• Updates SDK version constants and package manifests to 0.3.0.
• Synchronizes SDK and conformance-runner lockfiles.
• Updates the Swift version assertion.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File	Description
typescript/​src/​client.ts	Updates SDK version constant.
typescript/​package.json	Updates npm package version.
typescript/​package-lock.json	Synchronizes package version metadata.
swift/​Tests/​FizzyTests/​FizzyTests.swift	Updates expected SDK version.
swift/​Sources/​Fizzy/​FizzyConfig.swift	Updates SDK version constant.
rust/​fizzy-sdk/​Cargo.toml	Updates crate version.
rust/​Cargo.lock	Synchronizes crate version.
ruby/​lib/​fizzy/​version.rb	Updates gem version constant.
ruby/​Gemfile.lock	Synchronizes gem version entries.
package.json	Updates root package version.
kotlin/​sdk/​src/​commonMain/​kotlin/​com/​basecamp/​fizzy/​FizzyConfig.kt	Updates SDK version constant.
kotlin/​sdk/​build.gradle.kts	Updates publication version.
go/​pkg/​fizzy/​version.go	Updates SDK version constant.
conformance/​runner/​typescript/​package-lock.json	Synchronizes local SDK version.
conformance/​runner/​rust/​Cargo.lock	Synchronizes local SDK version.
conformance/​runner/​ruby/​Gemfile.lock	Synchronizes local SDK version entries.

_{Review effort: Balanced}