[robzolkos]

Summary

Prepare a patch release of the changes already on main since v0.33.0. Synchronize versions, lockfiles and install examples across all five SDKs with make bump VERSION=0.33.1. No additional dependency or API changes in this PR.

Key release contents:

• Prevent replaying redirected non-idempotent writes after a hop returns 401: Refresh a redirected write's hop 401 without making the write again #269.
• Refuse redirects on Go OAuth token exchanges and refresh requests: Follow no redirect on a Go token request #271.
• Kotlin DPoP proof/nonce handling and safe token revocation: Resend a 401 that refuses only the DPoP proof, with no refresh #268 and Revoke a token from Kotlin, unsigned, following no redirect #270.
• Rust certificate-trust advisory fixes: Bump rustls-webpki and webpki-root-certs past the emSign advisories #273; dependency and release-tooling maintenance already merged.

Patch version: no breaking public surface changes. HEY CLI will consume this version via basecamp/hey-cli#592 after publication.

Verification

• Ran make check through mise: Smithy/model/drift checks, Go, Rust (including cargo deny and package dry-run), TypeScript (545/545 tests), Kotlin and Kotlin generation checks pass.
• Full local make check stops at Swift because swift is not installed on this host; Swift CI must pass before release.
• Separately ran conformance for all locally available languages: Go 220/220, Rust 220/220, Kotlin 220/220; TypeScript 215/215 applicable, 5 explicitly not applicable (220 total).
• Reviewed all 16 changed files: version substitutions only, no third-party lockfile drift; git diff --check passes.

Publication is explicitly authorized by the operator, but no tags have been pushed yet. Release follows only after checks and reviews settle.

---

Summary by cubic

Prepares the v0.33.1 patch release by bumping version numbers and lockfiles across all five SDKs (Go, Kotlin, Rust, Swift, TypeScript), with no API or behavior changes.

The release bundles fixes already on main: redirect handling for non-idempotent writes after 401s, refusal of redirects on Go OAuth token exchanges, Kotlin DPoP nonce handling and safe token revocation, and Rust certificate-trust dependency fixes.

Verification

• Ran make check for all languages except Swift (not installed); Swift CI must pass before release.
• Conformance suites pass: Go, Rust, Kotlin 220/220; TypeScript 215/215 applicable, 5 intentionally not applicable.

^{Written for commit 8c29bb0. Summary will update on new commits.}

[Copilot]

🟢 Approved

All changes consistently apply the version-only bump with no identified defects; Swift CI must pass before release.

No open issues 🎉

2 files not reviewed

• conformance/runner/typescript/package-lock.json: Generated file
• typescript/package-lock.json: Generated file

What changed in this PR

Prepares SDK v0.33.1 to ship previously merged redirect, authentication, and certificate-trust fixes. This PR adds no API, behavior, or third-party dependency changes.

Changes:

• Synchronizes release versions across all five SDKs.
• Updates package and conformance lockfile versions.
• Refreshes installation examples.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File	Description
typescript/​src/​version.ts	Updates runtime version.
typescript/​package.json	Updates package version.
typescript/​package-lock.json	Synchronizes package version.
swift/​Sources/​Hey/​HeyConfig.swift	Updates runtime version.
swift/​README.md	Updates installation examples.
rust/​hey-sdk/​README.md	Updates release tag example.
rust/​hey-sdk/​Cargo.toml	Updates crate version.
rust/​Cargo.lock	Synchronizes SDK version.
README.md	Updates installation examples.
kotlin/​sdk/​src/​commonMain/​kotlin/​com/​basecamp/​hey/​HeyConfig.kt	Updates runtime version.
kotlin/​sdk/​build.gradle.kts	Updates publication version.
kotlin/​README.md	Updates installation examples.
go/​pkg/​hey/​version.go	Updates runtime version.
conformance/​runner/​typescript/​package.json	Updates runner version.
conformance/​runner/​typescript/​package-lock.json	Synchronizes runner version.
conformance/​runner/​rust/​Cargo.lock	Synchronizes SDK version.

_{Review effort: Balanced}

[robzolkos]

Local full-gate follow-up: make check now passes end to end, including Swift tests, generation checks and all five conformance suites. Swift 6.0 ran through a temporary Docker-backed swift executable (official swift:6.0-noble image pinned to digest sha256:f19aea3f9a889df5884e1186e60be74869613477d99656b598c115a4b91af8a1); no gate targets were skipped or overridden. Go, Rust, Kotlin and Swift conformance: 220/220 each; TypeScript: 215/215 applicable, 5 explicitly not applicable out of 220. The earlier missing-local-Swift limitation is resolved. Still waiting for all GitHub checks before merge/tag.

[robzolkos]

Converged at 8c29bb0: all 35 checks settled (34 success, 1 neutral), zero failures or pending jobs, including Swift CodeQL and Swift tests on Linux/macOS. Copilot approved this exact head; 0 total / 0 unresolved review threads and no unanswered review-body findings. Cubic reported its monthly review quota exhausted, so its independent review is unavailable, not an approval. Reviewed all 16 changed files, including both package-lock files Copilot excluded: only the expected version substitutions. Full local make check passes with Swift via the pinned Docker image described above. Merging under the operator’s explicit authorization to release SDK 0.33.1, then using the normal make release gate to push only v0.33.1; Go module tagging and crate publication remain behind independent environment approval.