getstream 7.0.0__tar.gz → 7.2.0__tar.gz

{getstream-7.0.0 → getstream-7.2.0}/.release-please-manifest.json

@@ -1,4 +1,4 @@
 {
-  ".": "7.0.0",
+  ".": "7.2.0",
   "getstream-rtc": "0.1.0"
 }

{getstream-7.0.0 → getstream-7.2.0}/CHANGELOG.md

@@ -7,6 +7,26 @@ Entries from 6.1.1 on are generated by release-please from commit messages; earl
 ones were written by hand in the [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 format.
 
+## [7.2.0](https://github.com/GetStream/stream-py/compare/v7.1.0...v7.2.0) (2026-11-12)
+
+
+### Features
+
+* **moderation:** add `expected_value` to `UserCustomPropertyParameters`, `CallCustomPropertyParameters`, `ContentCustomPropertyParameters` and `ContentCustomPropertyCountParameters`, so value-operator custom-property rules can be set ([138e50a](https://github.com/GetStream/stream-py/commit/138e50ad2a713a85eef61508d6cf854d64692460))
+
+
+### Bug Fixes
+
+* cap decompressed gzip webhook bodies at 10 MiB (`getstream.webhook.MAX_WEBHOOK_PAYLOAD_BYTES`) and reject data after the gzip stream, because decompression runs before the signature check ([138e50a](https://github.com/GetStream/stream-py/commit/138e50ad2a713a85eef61508d6cf854d64692460))
+* stop double-encoding list query parameters ([#306](https://github.com/GetStream/stream-py/issues/306)) ([a584118](https://github.com/GetStream/stream-py/commit/a584118a15db9bd60b7daf571fa13d52e459b6d2)), closes [#305](https://github.com/GetStream/stream-py/issues/305)
+
+## [7.1.0](https://github.com/GetStream/stream-py/compare/v7.0.0...v7.1.0) (2026-11-04)
+
+
+### Features
+
+* add NULL to send an explicit null in request bodies ([#314](https://github.com/GetStream/stream-py/issues/314)) ([955535e](https://github.com/GetStream/stream-py/commit/955535ed73d2016ccffc7924ed7c0ce60c641284))
+
 ## [7.0.0](https://github.com/GetStream/stream-py/compare/v6.1.1...v7.0.0) (2026-10-22)
 
 

{getstream-7.0.0 → getstream-7.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: getstream
-Version: 7.0.0
+Version: 7.2.0
 Summary: GetStream Python SDK - Build scalable activity feeds, chat, and video calling applications
 Author-email: sachaarbonel <sacha.arbonel@hotmail.fr>, tbarbugli <tbarbugli@gmail.com>
 License-File: LICENSE.md
@@ -186,6 +186,18 @@ client = Stream(api_key=..., api_secret=..., retry=RetryConfig(enabled=True, max
 
 Only idempotent `GET`/`HEAD` requests are retried, and only on HTTP 429 (unless the backend marked it unrecoverable) or a transport-level failure (timeout, connection reset, DNS, TLS). A 429's `Retry-After` header is honored (clamped to `max_backoff`); otherwise the delay uses full jitter over an exponential backoff. A retried failure logs `http.request.failed` at DEBUG; a final, non-retried failure logs it at ERROR (or not at all for a final 429, since that's already covered by `http.response.received`).
 
+### Sending null
+
+Request bodies drop `None` values inside objects, so an unset optional field never overwrites stored data. `None` items in a list are kept and sent as `null`. To store an explicit `null`, for example inside custom data, pass `NULL`:
+
+```python
+from getstream import NULL
+
+channel.update_channel_partial(set={"expires_at": NULL})
+```
+
+To remove a field instead, use `unset`, for example `unset=["expires_at"]`.
+
 ### App configuration
 
 ```python

{getstream-7.0.0 → getstream-7.2.0}/README.md

@@ -143,6 +143,18 @@ client = Stream(api_key=..., api_secret=..., retry=RetryConfig(enabled=True, max
 
 Only idempotent `GET`/`HEAD` requests are retried, and only on HTTP 429 (unless the backend marked it unrecoverable) or a transport-level failure (timeout, connection reset, DNS, TLS). A 429's `Retry-After` header is honored (clamped to `max_backoff`); otherwise the delay uses full jitter over an exponential backoff. A retried failure logs `http.request.failed` at DEBUG; a final, non-retried failure logs it at ERROR (or not at all for a final 429, since that's already covered by `http.response.received`).
 
+### Sending null
+
+Request bodies drop `None` values inside objects, so an unset optional field never overwrites stored data. `None` items in a list are kept and sent as `null`. To store an explicit `null`, for example inside custom data, pass `NULL`:
+
+```python
+from getstream import NULL
+
+channel.update_channel_partial(set={"expires_at": NULL})
+```
+
+To remove a field instead, use `unset`, for example `unset=["expires_at"]`.
+
 ### App configuration
 
 ```python

{getstream-7.0.0 → getstream-7.2.0}/docs/migration-from-stream-chat-python/README.md

@@ -20,6 +20,7 @@
 | Custom fields | Top-level dict keys | Nested in `custom` dict |
 | Response access | Dict keys (`response["users"]`) | Typed properties (`response.data.users`) |
 | Env vars | `STREAM_CHAT_TIMEOUT` | `STREAM_API_KEY`, `STREAM_API_SECRET`, `STREAM_TIMEOUT` |
+| `None` in request data | Sent as `null` | Dropped from objects, kept in lists; pass `getstream.NULL` to send `null` |
 
 ## Quick Example
 

{getstream-7.0.0 → getstream-7.2.0}/getstream/__init__.py

@@ -1,5 +1,6 @@
 import logging
 
+from getstream.utils import NULL  # noqa: F401
 from getstream.config import RetryConfig  # noqa: F401
 from getstream.exceptions import (  # noqa: F401
     StreamApiException,

{getstream-7.0.0 → getstream-7.2.0}/getstream/base.py

@@ -22,6 +22,7 @@ from getstream.generic import T
 import httpx
 from getstream.config import BaseConfig
 from getstream.version import VERSION
+from getstream.utils import NULL
 from urllib.parse import quote
 from abc import ABC
 from getstream.common.telemetry import (
@@ -144,7 +145,10 @@ def _read_file_bytes(file_path: str) -> bytes:
 
 def _strip_none(obj):
     """Recursively remove None values from dicts so unset optional fields
-    are omitted from the JSON body instead of being sent as null."""
+    are omitted from the JSON body instead of being sent as null. ``NULL``
+    becomes null."""
+    if obj is NULL:
+        return None
     if isinstance(obj, dict):
         return {k: _strip_none(v) for k, v in obj.items() if v is not None}
     if isinstance(obj, list):

{getstream-7.0.0 → getstream-7.2.0}/getstream/models/__init__.py

@@ -3927,6 +3927,9 @@ class CallCreatedEvent(DataClassJsonMixin):
 
 @dataclass
 class CallCustomPropertyParameters(DataClassJsonMixin):
+    expected_value: object | None = dc_field(
+        default=None, metadata=dc_config(field_name="expected_value")
+    )
     operator: str | None = dc_field(
         default=None, metadata=dc_config(field_name="operator")
     )
@@ -9268,6 +9271,9 @@ class ContentCountRuleParameters(DataClassJsonMixin):
 
 @dataclass
 class ContentCustomPropertyCountParameters(DataClassJsonMixin):
+    expected_value: object | None = dc_field(
+        default=None, metadata=dc_config(field_name="expected_value")
+    )
     operator: str | None = dc_field(
         default=None, metadata=dc_config(field_name="operator")
     )
@@ -9284,6 +9290,9 @@ class ContentCustomPropertyCountParameters(DataClassJsonMixin):
 
 @dataclass
 class ContentCustomPropertyParameters(DataClassJsonMixin):
+    expected_value: object | None = dc_field(
+        default=None, metadata=dc_config(field_name="expected_value")
+    )
     operator: str | None = dc_field(
         default=None, metadata=dc_config(field_name="operator")
     )
@@ -30303,6 +30312,9 @@ class UserCustomEventRequest(DataClassJsonMixin):
 
 @dataclass
 class UserCustomPropertyParameters(DataClassJsonMixin):
+    expected_value: object | None = dc_field(
+        default=None, metadata=dc_config(field_name="expected_value")
+    )
     operator: str | None = dc_field(
         default=None, metadata=dc_config(field_name="operator")
     )

{getstream-7.0.0 → getstream-7.2.0}/getstream/tests/test_webhook.py

@@ -1,6 +1,7 @@
 # Code generated by GetStream internal OpenAPI code generator. DO NOT EDIT.
 
 import hashlib
+import gzip
 import hmac
 import warnings
 from pathlib import Path
@@ -11,6 +12,7 @@ from getstream.webhook import (
     InvalidWebhookError,
     UnknownEvent,
     get_event_type,
+    gunzip_payload,
     parse_event,
     parse_sns,
     parse_sqs,
@@ -1261,6 +1263,16 @@ class TestWebhookConformanceNegative:
         with pytest.raises(InvalidWebhookError, match=InvalidWebhookError.GZIP_FAILED):
             verify_and_parse_webhook(body, sig, CANONICAL_TEST_SECRET)
 
+    def test_oversized_compression(self):
+        body = _read_bytes(self._neg("oversized_compression") / "body.gz")
+        sig = _read_str(self._neg("oversized_compression") / "signature.txt")
+        with pytest.raises(InvalidWebhookError, match="payload exceeds"):
+            verify_and_parse_webhook(body, sig, CANONICAL_TEST_SECRET)
+
+    def test_trailing_data_after_gzip(self):
+        with pytest.raises(InvalidWebhookError, match="trailing data"):
+            gunzip_payload(gzip.compress(b"{}") + b"XYZ")
+
     def test_bad_base64(self):
         # Per CHA-3071 wire format: decode_sqs_payload falls back to raw bytes when
         # base64 decoding fails (uncompressed wire format). For input that is

{getstream-7.0.0 → getstream-7.2.0}/getstream/utils/__init__.py

@@ -1,7 +1,7 @@
+import enum
 import json
 import asyncio
 from typing import Dict, List, Optional, Union, cast
-from urllib.parse import quote
 from datetime import datetime
 from datetime import timezone
 from urllib.parse import urlparse, urlunparse
@@ -36,18 +36,27 @@ def validate_and_clean_url(url):
     return cleaned_url
 
 
-def encode_datetime(date: Optional[datetime]) -> Optional[str]:
+# An Enum member because dataclasses-json deep-copies dict values, and a deep copy of an Enum member is the member itself. Its value None makes JSON encoders write null.
+class _Null(enum.Enum):
+    NULL = None
+
+
+NULL = _Null.NULL
+"""Sends an explicit JSON ``null``. Request bodies drop ``None`` values inside objects, so use ``NULL`` where ``null`` must reach the API, for example inside custom data."""
+
+
+def encode_datetime(date: Union[datetime, _Null, None]) -> Union[str, _Null, None]:
     """
     Encodes a datetime object into an ISO 8601 formatted string.
 
     Args:
-    date (Optional[datetime]): The datetime object to encode.
+    date (Union[datetime, _Null, None]): The datetime object to encode.
 
     Returns:
-    Optional[str]: The ISO 8601 string representation of the datetime, or None if input is None.
+    Union[str, _Null, None]: The ISO 8601 string representation of the datetime, or the input unchanged if it is None or NULL.
     """
-    if date is None:
-        return None
+    if not isinstance(date, datetime):
+        return date
     return date.isoformat()
 
 
@@ -110,7 +119,7 @@ def build_query_param(**kwargs):
     - JSON-serializable objects with a `to_json` method will be serialized using that method.
     - datetime objects are converted to ISO 8601 strings.
     - Booleans are converted to lowercase strings.
-    - Lists are converted to comma-separated strings with URL-encoded values.
+    - Lists are converted to comma-separated strings.
     - Other types (strings, integers, dictionaries) are handled appropriately.
 
     Args:
@@ -132,7 +141,7 @@ def build_query_param(**kwargs):
         elif isinstance(value, (str, int)):
             params[key] = str(value)
         elif isinstance(value, list):
-            params[key] = ",".join(quote(_serialize_query_value(v)) for v in value)
+            params[key] = ",".join(_serialize_query_value(v) for v in value)
         else:
             # For dictionaries or any other types of objects
             params[key] = json.dumps(value)
@@ -148,7 +157,7 @@ async def build_query_param_async(**kwargs):
     This function handles various data types:
     - JSON-serializable objects with a `to_json` method will be serialized using that method.
     - Booleans are converted to lowercase strings.
-    - Lists are converted to comma-separated strings with URL-encoded values.
+    - Lists are converted to comma-separated strings.
     - Other types (strings, integers, dictionaries) are handled appropriately.
 
     Args:

{getstream-7.0.0 → getstream-7.2.0}/getstream/webhook.py

@@ -1,7 +1,6 @@
 # Code generated by GetStream internal OpenAPI code generator. DO NOT EDIT.
 
 import base64
-import gzip
 import hashlib
 import hmac
 import json
@@ -650,6 +649,11 @@ def verify_webhook_signature(body: bytes | str, signature: str, secret: str) ->
 
 _GZIP_MAGIC = b"\x1f\x8b"
 
+# Caps the decompressed size of a gzip webhook body. gunzip_payload runs before
+# the signature check, so without a cap an unsigned gzip bomb could exhaust
+# memory. Raise it if your events are larger.
+MAX_WEBHOOK_PAYLOAD_BYTES = 10 * 1024 * 1024
+
 
 def gunzip_payload(body: bytes) -> bytes:
     """Decompress body if gzip-prefixed, else pass through.
@@ -658,13 +662,8 @@ def gunzip_payload(body: bytes) -> bytes:
     Stream webhook bodies are always JSON, and JSON cannot start with 0x1F.
 
     Raises InvalidWebhookError if body has the gzip magic prefix but isn't a
-    valid gzip stream. gzip.decompress can fail with at least three different
-    exception types depending on where decoding breaks:
-      * gzip.BadGzipFile (subclass of OSError) - malformed header.
-      * zlib.error                              - corrupt compressed stream.
-      * EOFError                                - stream truncated mid-block.
-    The first is OSError-derived; the latter two are not. Catch all three so
-    every "looks like gzip but isn't" failure mode surfaces as InvalidWebhookError.
+    valid gzip stream (corrupt or truncated), or decompresses to more than
+    MAX_WEBHOOK_PAYLOAD_BYTES.
     """
     if not isinstance(body, (bytes, bytearray)):
         raise InvalidWebhookError(
@@ -672,10 +671,25 @@ def gunzip_payload(body: bytes) -> bytes:
         )
     if len(body) < 2 or bytes(body[:2]) != _GZIP_MAGIC:
         return bytes(body)
+    limit = MAX_WEBHOOK_PAYLOAD_BYTES
+    decompressor = zlib.decompressobj(wbits=31)
     try:
-        return gzip.decompress(bytes(body))
-    except (OSError, zlib.error, EOFError) as e:
+        out = decompressor.decompress(bytes(body), limit + 1)
+    except zlib.error as e:
         raise InvalidWebhookError(f"{InvalidWebhookError.GZIP_FAILED}: {e}") from e
+    if len(out) > limit:
+        raise InvalidWebhookError(
+            f"{InvalidWebhookError.GZIP_FAILED}: payload exceeds {limit} bytes"
+        )
+    if not decompressor.eof:
+        raise InvalidWebhookError(
+            f"{InvalidWebhookError.GZIP_FAILED}: truncated gzip stream"
+        )
+    if decompressor.unused_data:
+        raise InvalidWebhookError(
+            f"{InvalidWebhookError.GZIP_FAILED}: trailing data after gzip stream"
+        )
+    return out
 
 
 def decode_sqs_payload(message_body: str) -> bytes:

{getstream-7.0.0 → getstream-7.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "getstream"
-version = "7.0.0"
+version = "7.2.0"
 description = "GetStream Python SDK - Build scalable activity feeds, chat, and video calling applications"
 authors = [
     { name = "sachaarbonel", email = "sacha.arbonel@hotmail.fr" },

{getstream-7.0.0 → getstream-7.2.0}/uv.lock

@@ -863,7 +863,7 @@ wheels = [
 
 [[package]]
 name = "getstream"
-version = "7.0.0"
+version = "7.2.0"
 source = { editable = "." }
 dependencies = [
     { name = "dataclasses-json" },