ordercloud-python 2026.6.1__tar.gz → 2026.10.2__tar.gz

{ordercloud_python-2026.6.1 → ordercloud_python-2026.10.2}/.github/dependabot.yml

@@ -24,3 +24,9 @@ updates:
     labels:
       - "ci"
     open-pull-requests-limit: 5
+    groups:
+      # The init / autobuild / analyze / upload-sarif steps must share one
+      # version, so they are bumped together in a single PR.
+      codeql-action:
+        patterns:
+          - "github/codeql-action*"

{ordercloud_python-2026.6.1 → ordercloud_python-2026.10.2}/.github/workflows/ci.yml

@@ -14,8 +14,8 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.13"
       - name: Install ruff
@@ -29,8 +29,8 @@ jobs:
     name: Type check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.13"
       - name: Install dependencies
@@ -46,8 +46,8 @@ jobs:
       matrix:
         python-version: ["3.10", "3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies
@@ -56,7 +56,7 @@ jobs:
         run: pytest --cov=ordercloud --cov-report=xml --cov-report=term-missing --cov-fail-under=90
       - name: Upload coverage to Codecov
         if: matrix.python-version == '3.13'
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           files: ./coverage.xml
           fail_ci_if_error: false

{ordercloud_python-2026.6.1 → ordercloud_python-2026.10.2}/.github/workflows/codeql.yml

@@ -18,18 +18,18 @@ jobs:
     name: Analyze (Python)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           languages: python
           queries: security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/autobuild@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           category: "/language:python"

{ordercloud_python-2026.6.1 → ordercloud_python-2026.10.2}/.github/workflows/dependency-review.yml

@@ -12,7 +12,7 @@ jobs:
     name: Review dependencies
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Dependency Review
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
         with:

{ordercloud_python-2026.6.1 → ordercloud_python-2026.10.2}/.github/workflows/release.yml

@@ -14,8 +14,8 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.13"
       - name: Install build
@@ -38,7 +38,8 @@ jobs:
 
   publish:
     name: Publish to PyPI
-    needs: build
+    # The PyPI upload cannot be undone, so it runs only after attestation.
+    needs: attestation
     runs-on: ubuntu-latest
     permissions:
       id-token: write
@@ -52,7 +53,7 @@ jobs:
           name: dist
           path: dist/
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
 
   attestation:
     name: Attest build provenance
@@ -69,9 +70,26 @@ jobs:
           name: dist
           path: dist/
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
+        id: attest
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: dist/*
+      - name: Name provenance file
+        env:
+          BUNDLE_PATH: ${{ steps.attest.outputs.bundle-path }}
+        run: |
+          if [ ! -s "$BUNDLE_PATH" ]; then
+            echo "::error::Attestation bundle is missing or empty: $BUNDLE_PATH"
+            exit 1
+          fi
+          mkdir provenance
+          cp "$BUNDLE_PATH" "provenance/ordercloud_python-${GITHUB_REF_NAME#v}.intoto.jsonl"
+      - name: Upload provenance
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: provenance
+          path: provenance/
+          if-no-files-found: error
 
   github-release:
     name: Create GitHub Release
@@ -80,16 +98,26 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Download distributions
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: dist
           path: dist/
+      - name: Download provenance
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: provenance
+          path: provenance/
       - name: Create GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          gh release create "$GITHUB_REF_NAME" dist/* \
+          PROVENANCE="provenance/ordercloud_python-${GITHUB_REF_NAME#v}.intoto.jsonl"
+          if [ ! -s "$PROVENANCE" ]; then
+            echo "::error::Provenance file is missing or empty: $PROVENANCE"
+            exit 1
+          fi
+          gh release create "$GITHUB_REF_NAME" dist/* "$PROVENANCE" \
             --title "$GITHUB_REF_NAME" \
             --generate-notes

{ordercloud_python-2026.6.1 → ordercloud_python-2026.10.2}/.github/workflows/sbom.yml

@@ -16,10 +16,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Generate SBOM
-        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
         with:
           format: spdx-json
           output-file: sbom.spdx.json

{ordercloud_python-2026.6.1 → ordercloud_python-2026.10.2}/.github/workflows/scorecard.yml

@@ -19,18 +19,18 @@ jobs:
       contents: read
       actions: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Run Scorecard
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif
           publish_results: true
 
       - name: Upload SARIF results
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           sarif_file: results.sarif

ordercloud_python-2026.10.2/CHANGELOG.md

@@ -0,0 +1,106 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+This project uses [Calendar Versioning](https://calver.org/) — `YYYY.MM.N` where `N` is the release number within that month.
+
+## 2026.10.2 — 2026-10-05
+
+### Security
+
+- **Credential-bearing path values are no longer written to the SDK's log lines.** The SDK logs requests on the `ordercloud` logger: a `Request:` and a `Response:` line at `DEBUG` for every request, and a `Retry` line at `WARNING` before each retry (retries are off unless `max_retries` is set). In 2026.4.1, 2026.6.1 and 2026.10.1 each of these lines contained the full request path. Two path parameters in the OrderCloud spec carry values that work as credentials, so those values reached the log:
+  - `verificationCode`, in `forgotten_credentials.reset_password_by_verification_code` (`PUT /password/reset/{verificationCode}`).
+  - `invitationID`, in `group_orders.get_token` (`POST /grouporders/{invitationID}/token`, which returns an `AccessToken`). The spec says of group-order invitations: "Contributors may request an access token with the invitation ID".
+
+  The SDK classifies path parameters by name, so every operation that takes an `invitationID` is covered: `group_orders.get_token`, and on `me` the three group-order invitation operations (`get_` / `delete_` / `patch_group_order_invitation`) and the five product-collection invitation operations (`get_` / `delete_` / `patch_` / `accept_` / `decline_product_collection_invitation`). On these ten operations the SDK's log lines now show `***` in place of the value, for example `Request: PUT /password/reset/***` and `Request: POST /me/productcollections/col-1/invitations/accept/***`. Other path values, and the log lines of every other operation, are unchanged.
+- **What this release does not change:**
+  - `httpx` writes its own `HTTP Request: <METHOD> <URL> ...` line at `INFO` on the `httpx` logger, with the full URL including the query string. The SDK does not control that logger. If your application logs at `INFO` or below, set `logging.getLogger("httpx").setLevel(logging.WARNING)`. See [SECURITY.md](SECURITY.md#logging).
+  - Middleware hooks receive the concrete values: `RequestContext.path`, `url` and `params` are what is sent to the API.
+  - Exceptions that `httpx` raises for transport failures (timeouts, connection errors) carry the request, and with it the full URL, as their `request` attribute.
+- The code generator now refuses to generate while any path-parameter name in the spec is unclassified. Every name is listed in `tools/codegen/sensitivity.py` as sensitive or not sensitive, and a name missing from the not-sensitive list is redacted. See [CONTRIBUTING.md](CONTRIBUTING.md#path-parameter-classification).
+
+### Changed
+
+- Bumped package version to `2026.10.2` (CalVer).
+- `HttpClient.request()` and its `get` / `post` / `put` / `patch` / `delete` helpers accept a `SensitivePath` (new, in `ordercloud.http`) as well as a plain string path. Generated resource method signatures are unchanged.
+- Removed an unused module-level `TypeVar` from `ordercloud.sync_client`.
+
+## 2026.10.1 — 2026-10-05
+
+Regenerated from the OrderCloud OpenAPI v3 spec, **version 1.0.454 → 1.0.470**. This release contains **one breaking change** — `ApiClient.client_secret` is removed — which the CalVer version number does not signal. Coverage is unchanged: **639 operations** across 60 resources, with 173 models and 17 enums.
+
+### Breaking
+
+- **`ApiClient.client_secret` (`ClientSecret`) removed**, following its removal from the `ApiClient` schema in the spec. `ApiClient` keeps the models' `extra="allow"` configuration, so code that still uses the field now behaves as follows:
+  - Reading `.client_secret` on an `ApiClient` that was not given one raises `AttributeError` (it previously returned `None`).
+  - mypy reports any `.client_secret` access as an `attr-defined` error.
+  - A `ClientSecret` value in an API response is no longer available as `.client_secret`; it is kept as an undeclared extra under its API name, in `model_extra["ClientSecret"]`.
+  - `ApiClient(ClientSecret="...")` is accepted, and the value is still sent to the API under the key `ClientSecret`.
+  - `ApiClient(client_secret="...")` is accepted, but the value is now sent to the API under the snake_case key `client_secret` instead of `ClientSecret`.
+  - Request bodies passed as plain dicts are sent unchanged.
+
+  The five API-client secret operations (`ApiClients.ListSecrets` / `CreateSecret` / `GetSecret` / `PatchSecret` / `DeleteSecret`) and the `ApiClientSecret` / `ApiClientSecretCreateResponse` models are unchanged in this release.
+
+### Added
+
+- **`Discount.priority`** (`Priority`, integer). The spec describes it as: "Controls precedence when multiple discounts apply to the same user and product. Lower number = higher precedence (1 beats 2). Null is applied last."
+- **`OrderEditAfterSubmit`** added to the `ApiRole` enum. Role lists that contain it (for example `SecurityProfile.roles` or `ApiClient.maximum_granted_roles`) now validate; on 2026.6.1 they raise a pydantic `ValidationError`.
+
+### Spec changes with no SDK code change
+
+- The `x-lifecycle: Beta` marker is removed from the Discounts tag and its nine operations. The code generator does not read this marker.
+- `GET /discounts` now lists `Priority` and `!Priority` as `sortBy` values. `Discounts.list` takes `sort_by` as a plain string and passes it through unvalidated, so no SDK change was needed.
+- `OrderEditAfterSubmit` is also added to the spec's OAuth2 scopes. The SDK's `scopes` setting takes plain strings.
+
+### Release artefacts
+
+- GitHub releases now also attach the build provenance attestation for the sdist and wheel, as `ordercloud_python-<version>.intoto.jsonl`, alongside the distributions themselves.
+
+### Changed
+
+- Bumped package version to `2026.10.1` (CalVer).
+
+## 2026.6.1 — 2026-06-14
+
+Regenerated from the OrderCloud OpenAPI v3 spec, **version 1.0.445 → 1.0.454**. All changes are additive — no breaking changes to existing models or operations. Coverage now spans **639 operations** (was 632) across the same 60 resources, with **173 models** and 17 enums.
+
+### Added
+
+- **Generated promotion codes** — `Promotions.ListCodes` (`GET /promotions/{promotionID}/codes`), the `PromotionCode` model, and `GeneratedCodeCount` / `GeneratedCodeLength` / `GeneratedCodePrefix` fields on the `Promotion` model family (`Promotion`, `OrderPromotion`, `AddedPromo`, `RemovedPromo`, `EligiblePromotion`).
+- **Repeat order** — `Orders.Repeat` (`POST /orders/{direction}/{orderID}/repeat`) with the `OrderRepeatResponse` and `UnavailableLineItem` models.
+- **Catalog entity sync** — five `EntitySyncs` catalog operations (get / save / patch / delete on `/integrations/entitysync/catalogs`, plus `/catalogs/sync`) and the `SyncCatalog` model.
+- **New models** — `BuyerDiscount` (on `BuyerPriceSchedule`) and `ApiError` (the typed error returned within `UnavailableLineItem`).
+- **New fields / values** — `Percent` on `DiscountedPrices`; `BulkReader` added to the `ApiRole` enum.
+
+### Changed
+
+- Bumped package version to `2026.6.1` (CalVer).
+
+## 2026.4.1 — 2026-04-13
+
+Initial release. Full SDK for the Sitecore OrderCloud API, generated from the OpenAPI v3 spec (version 1.0.445).
+
+### Features
+
+- **Full API coverage** — 632 operations across 60 resources, generated from the official OpenAPI spec
+- **Async and sync clients** — `OrderCloudClient` (async, default) and `SyncOrderCloudClient` with identical API shapes
+- **Pydantic v2 typed models** — 167 models and 17 enums with full type annotations
+- **Typed extended properties (xp)** — `Product[MyXp]` pattern for type-safe custom fields, backward compatible with untyped `dict[str, Any]`
+- **Auto-pagination** — `paginate()` and `paginate_sync()` async/sync generators for any list method
+- **Retry with exponential backoff** — configurable `max_retries` and `retry_backoff`; retries 429/5xx, respects `Retry-After` headers
+- **Structured logging** — `logging.getLogger("ordercloud")` with DEBUG request/response and WARNING retry logging
+- **Middleware hooks** — `add_before_request()` / `add_after_response()` for request/response interception
+- **OAuth2 client credentials** — automatic token acquisition, caching, and refresh
+- **PEP 561 typed** — `py.typed` marker for downstream type checking
+
+### Code Generation
+
+Three-stage pipeline in `tools/codegen/`: OpenAPI JSON -> parser -> IR dataclasses -> transformer -> Jinja2 templates -> Python source -> ruff format. 10 source files, 5 templates. Generates 100 files (37 model modules, 60 resource modules, 2 init barrels, 1 client).
+
+### Quality
+
+- 759 unit tests, 97% overall coverage (100% on all hand-written infrastructure and all 37 model modules)
+- CI: lint, format, type check (mypy strict), test matrix (Python 3.10-3.13), coverage upload
+- CodeQL security scanning, OpenSSF Scorecard, SBOM generation, dependency review
+- Dependabot for pip and GitHub Actions version management
+- Branch protection with required status checks

{ordercloud_python-2026.6.1 → ordercloud_python-2026.10.2}/CONTRIBUTING.md

@@ -99,8 +99,32 @@ If you need to change how models or resources are structured, the relevant files
 - `tools/codegen/ir.py` — intermediate representation dataclasses
 - `tools/codegen/parser.py` — OpenAPI spec to IR
 - `tools/codegen/transformer.py` — IR enrichment (imports, grouping)
+- `tools/codegen/sensitivity.py` — path-parameter sensitivity registry (see below)
 - `tools/codegen/templates/*.j2` — Jinja2 templates for output files
 
+### Path-parameter classification
+
+The SDK logs the path of every request, and some path parameters carry values that work as credentials. Every path-parameter name in the spec is therefore classified in `tools/codegen/sensitivity.py`, in exactly one of two sets:
+
+- `SENSITIVE_PATH_PARAMS` — anyone who reads the value from a log could use it to authenticate, obtain a token, or perform an account action without the account owner's own credentials.
+- `NOT_SENSITIVE_PATH_PARAMS` — record identifiers that grant nothing without the caller's own authorisation.
+
+When uncertain, choose sensitive. `NOT_SENSITIVE_PATH_PARAMS` is an allowlist: a parameter whose name is not on it is generated as a `SensitivePath`, and the SDK logs `***` in its place.
+
+Generation stops with exit code 1, before any file is written, if a path-parameter name in the spec is unclassified, is in both sets, or is classified but no longer in the spec. A new, unclassified name fails like this (`shareToken` is an example, not a real parameter):
+
+```
+Error: Path parameter 'shareToken' is not classified (used by Products.GetShareLink); add it to SENSITIVE_PATH_PARAMS or NOT_SENSITIVE_PATH_PARAMS in tools/codegen/sensitivity.py
+```
+
+To resolve it:
+
+1. Read what the value is in the spec: the operations named in the error, their descriptions, and what they return.
+2. Apply the rule above and add the name to one of the two sets, with a comment giving the reason.
+3. Regenerate and run the tests. `tests/test_log_redaction.py` scans every generated request path and fails if one could log an unclassified or sensitive value.
+
+The classification is by name, so the gate cannot tell when a new spec reuses an already-cleared name for a credential-bearing value. Review the spec diff at each spec bump for that.
+
 ## Conventions
 
 - **snake_case** for all Python identifiers. Model fields use snake_case with PascalCase aliases matching the API.

{ordercloud_python-2026.6.1 → ordercloud_python-2026.10.2}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: ordercloud-python
-Version: 2026.6.1
+Version: 2026.10.2
 Summary: Idiomatic Python SDK for Sitecore OrderCloud
 Project-URL: Homepage, https://github.com/markcassidyconsulting/ordercloud-python
 Project-URL: Repository, https://github.com/markcassidyconsulting/ordercloud-python
@@ -60,7 +60,7 @@ A fully typed, async-first Python SDK for [Sitecore OrderCloud](https://orderclo
 - **Middleware hooks** — intercept requests and responses for logging, metrics, or header injection.
 - **Structured logging** — standard Python `logging` module, DEBUG/WARNING levels.
 - **Full type annotations** — `py.typed` marker for downstream type checking with mypy, pyright, etc.
-- **791 tests, 97% coverage** — 766 unit tests (mocked HTTP) + 25 integration tests (live sandbox).
+- **803 tests, 97% coverage** — 778 unit tests (mocked HTTP) + 25 integration tests (live sandbox).
 
 ## Installation
 
@@ -212,9 +212,8 @@ The SDK logs via Python's standard `logging` module under the `ordercloud` logge
 
 ```python
 import logging
-logging.basicConfig(level=logging.DEBUG)
 
-# Or configure just the SDK logger
+logging.basicConfig()  # adds a handler; the root logger stays at WARNING
 logging.getLogger("ordercloud").setLevel(logging.DEBUG)
 ```
 
@@ -223,6 +222,10 @@ logging.getLogger("ordercloud").setLevel(logging.DEBUG)
 | `DEBUG` | Every request (`Request: GET /products`) and response (`Response: GET /products 200`) |
 | `WARNING` | Retry attempts with status code and backoff delay |
 
+Path values that work as credentials, a password-reset verification code and an invitation ID, are logged as `***`, for example `Request: PUT /password/reset/***`. Query parameters and request bodies are not logged.
+
+Setting the root logger to `INFO` or `DEBUG` (for example `logging.basicConfig(level=logging.DEBUG)`) also turns on `httpx`'s own `HTTP Request:` line, which contains the full URL, unredacted, including the query string. The SDK does not control that logger. To keep it quiet, add `logging.getLogger("httpx").setLevel(logging.WARNING)`. See [SECURITY.md](SECURITY.md#logging).
+
 ## Middleware Hooks
 
 Register hooks to intercept requests and responses:
@@ -242,9 +245,11 @@ client.add_after_response(log_timing)
 
 Before-request hooks receive a mutable `RequestContext` — modify `headers`, `params`, or `json` before the request is sent. After-response hooks receive a `ResponseContext` with the request details and response. Hooks are called on every attempt, including retries.
 
+Hooks see the concrete values sent to the API, including credential-bearing path values and the `Authorization` header; the redaction above applies only to the SDK's own log lines.
+
 ## API Coverage
 
-The SDK covers **all 60 resources** and **639 operations** in the OrderCloud API. Models and resource clients are generated from the official OpenAPI v3 spec (version 1.0.454).
+The SDK covers **all 60 resources** and **639 operations** in the OrderCloud API. Models and resource clients are generated from the official OpenAPI v3 spec (version 1.0.470).
 
 ### Core Commerce
 
@@ -504,18 +509,18 @@ The test suite is self-bootstrapping — it uses the SDK itself to create all te
 
 ### Test Suite
 
-791 tests across 12 modules.
+803 tests across 12 modules.
 
-**Unit tests (766)** — mocked HTTP via [respx](https://lundberg.github.io/respx/), no network calls:
+**Unit tests (778)** — mocked HTTP via [respx](https://lundberg.github.io/respx/), no network calls:
 
 | Module | Tests | Purpose |
 |--------|-------|---------|
 | `test_auth.py` | 13 | OAuth2 token management |
-| `test_http.py` | 16 | HTTP client, error parsing, retries |
-| `test_models.py` | 28 | Model round-trips, enums, xp, ListPage |
-| `test_resources.py` | 22 | Representative resource operations |
+| `test_http.py` | 37 | HTTP client, error parsing, retries |
+| `test_models.py` | 44 | Model round-trips, enums, xp, ListPage |
+| `test_resources.py` | 33 | Representative resource operations |
 | `test_resource_coverage.py` | 639 | All 60 resources, all 639 operations |
-| `test_sync_client.py` | 48 | Sync wrapper, pagination |
+| `test_sync_client.py` | 12 | Sync wrapper, pagination |
 
 **Integration tests (25)** — live sandbox, skipped when credentials are absent:
 
@@ -532,11 +537,11 @@ The test suite is self-bootstrapping — it uses the SDK itself to create all te
 
 | Module | Coverage |
 |--------|----------|
-| `auth.py` | 100% |
+| `auth.py` | 93% |
 | `client.py` | 100% |
-| `config.py` | 100% |
+| `config.py` | 94% |
 | `errors.py` | 100% |
-| `http.py` | 97% |
+| `http.py` | 98% |
 | `middleware.py` | 100% |
 | `sync_client.py` | 100% |
 | `resources/base.py` | 100% |

{ordercloud_python-2026.6.1 → ordercloud_python-2026.10.2}/README.md

@@ -20,7 +20,7 @@ A fully typed, async-first Python SDK for [Sitecore OrderCloud](https://orderclo
 - **Middleware hooks** — intercept requests and responses for logging, metrics, or header injection.
 - **Structured logging** — standard Python `logging` module, DEBUG/WARNING levels.
 - **Full type annotations** — `py.typed` marker for downstream type checking with mypy, pyright, etc.
-- **791 tests, 97% coverage** — 766 unit tests (mocked HTTP) + 25 integration tests (live sandbox).
+- **803 tests, 97% coverage** — 778 unit tests (mocked HTTP) + 25 integration tests (live sandbox).
 
 ## Installation
 
@@ -172,9 +172,8 @@ The SDK logs via Python's standard `logging` module under the `ordercloud` logge
 
 ```python
 import logging
-logging.basicConfig(level=logging.DEBUG)
 
-# Or configure just the SDK logger
+logging.basicConfig()  # adds a handler; the root logger stays at WARNING
 logging.getLogger("ordercloud").setLevel(logging.DEBUG)
 ```
 
@@ -183,6 +182,10 @@ logging.getLogger("ordercloud").setLevel(logging.DEBUG)
 | `DEBUG` | Every request (`Request: GET /products`) and response (`Response: GET /products 200`) |
 | `WARNING` | Retry attempts with status code and backoff delay |
 
+Path values that work as credentials, a password-reset verification code and an invitation ID, are logged as `***`, for example `Request: PUT /password/reset/***`. Query parameters and request bodies are not logged.
+
+Setting the root logger to `INFO` or `DEBUG` (for example `logging.basicConfig(level=logging.DEBUG)`) also turns on `httpx`'s own `HTTP Request:` line, which contains the full URL, unredacted, including the query string. The SDK does not control that logger. To keep it quiet, add `logging.getLogger("httpx").setLevel(logging.WARNING)`. See [SECURITY.md](SECURITY.md#logging).
+
 ## Middleware Hooks
 
 Register hooks to intercept requests and responses:
@@ -202,9 +205,11 @@ client.add_after_response(log_timing)
 
 Before-request hooks receive a mutable `RequestContext` — modify `headers`, `params`, or `json` before the request is sent. After-response hooks receive a `ResponseContext` with the request details and response. Hooks are called on every attempt, including retries.
 
+Hooks see the concrete values sent to the API, including credential-bearing path values and the `Authorization` header; the redaction above applies only to the SDK's own log lines.
+
 ## API Coverage
 
-The SDK covers **all 60 resources** and **639 operations** in the OrderCloud API. Models and resource clients are generated from the official OpenAPI v3 spec (version 1.0.454).
+The SDK covers **all 60 resources** and **639 operations** in the OrderCloud API. Models and resource clients are generated from the official OpenAPI v3 spec (version 1.0.470).
 
 ### Core Commerce
 
@@ -464,18 +469,18 @@ The test suite is self-bootstrapping — it uses the SDK itself to create all te
 
 ### Test Suite
 
-791 tests across 12 modules.
+803 tests across 12 modules.
 
-**Unit tests (766)** — mocked HTTP via [respx](https://lundberg.github.io/respx/), no network calls:
+**Unit tests (778)** — mocked HTTP via [respx](https://lundberg.github.io/respx/), no network calls:
 
 | Module | Tests | Purpose |
 |--------|-------|---------|
 | `test_auth.py` | 13 | OAuth2 token management |
-| `test_http.py` | 16 | HTTP client, error parsing, retries |
-| `test_models.py` | 28 | Model round-trips, enums, xp, ListPage |
-| `test_resources.py` | 22 | Representative resource operations |
+| `test_http.py` | 37 | HTTP client, error parsing, retries |
+| `test_models.py` | 44 | Model round-trips, enums, xp, ListPage |
+| `test_resources.py` | 33 | Representative resource operations |
 | `test_resource_coverage.py` | 639 | All 60 resources, all 639 operations |
-| `test_sync_client.py` | 48 | Sync wrapper, pagination |
+| `test_sync_client.py` | 12 | Sync wrapper, pagination |
 
 **Integration tests (25)** — live sandbox, skipped when credentials are absent:
 
@@ -492,11 +497,11 @@ The test suite is self-bootstrapping — it uses the SDK itself to create all te
 
 | Module | Coverage |
 |--------|----------|
-| `auth.py` | 100% |
+| `auth.py` | 93% |
 | `client.py` | 100% |
-| `config.py` | 100% |
+| `config.py` | 94% |
 | `errors.py` | 100% |
-| `http.py` | 97% |
+| `http.py` | 98% |
 | `middleware.py` | 100% |
 | `sync_client.py` | 100% |
 | `resources/base.py` | 100% |

ordercloud_python-2026.10.2/SECURITY.md

@@ -0,0 +1,70 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+|---------|--------------------|
+| Latest  | :white_check_mark: |
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in this project, please report it responsibly.
+
+**Do not open a public GitHub issue for security vulnerabilities.**
+
+Instead, email **mark.cassidy@markcassidyconsulting.com** with:
+
+- A description of the vulnerability
+- Steps to reproduce or a proof of concept
+- The potential impact
+
+You will receive an acknowledgement within 48 hours and a detailed response within 5 business days, including next steps and any planned fixes.
+
+If the vulnerability is confirmed, a fix will be developed and released as a patch version. A security advisory will be published via [GitHub Security Advisories](https://github.com/markcassidyconsulting/ordercloud-python/security/advisories) once a fix is available.
+
+## Scope
+
+This SDK is an HTTP client library. It does not run a server, store credentials persistently, or process untrusted input beyond what the OrderCloud API returns. Security concerns most likely relate to:
+
+- Credential handling (OAuth tokens in memory)
+- Dependency vulnerabilities (tracked via Dependabot and `dependency-review`)
+- Injection via API response data (mitigated by Pydantic model validation)
+
+## Logging
+
+The SDK writes request log lines to the `ordercloud` logger (see [Structured Logging](README.md#structured-logging)). Path values that work as credentials, a password-reset `verificationCode` and an `invitationID`, appear in those lines as `***`. Every path-parameter name in the OrderCloud spec is classified as sensitive or not sensitive when the SDK is generated, and an unclassified name stops generation. Query parameters and request bodies are not written to these lines.
+
+The SDK does not control what other code logs:
+
+- **`httpx` logs the full URL.** For every request, `httpx` writes `HTTP Request: <METHOD> <URL> "<HTTP version> <status> <reason>"` at `INFO` on the `httpx` logger, with the full URL including the path and the query string (checked against the httpx 0.28.1 source). The line appears whenever that logger is enabled for `INFO`, for example after `logging.basicConfig(level=logging.INFO)` or `level=logging.DEBUG`. To keep it out of your logs:
+
+  ```python
+  import logging
+
+  logging.getLogger("httpx").setLevel(logging.WARNING)
+  ```
+
+- **`httpx` exceptions carry the request.** Exceptions that `httpx` raises for transport failures (timeouts, connection errors) carry the request as their `request` attribute, and `exc.request.url` is the full URL.
+- **Middleware hooks receive the concrete values.** `RequestContext.path`, `url` and `params` are the values sent to the API, and `headers` holds the `Authorization` bearer token. A hook that logs them must redact them itself.
+
+## Security Measures
+
+This project employs the following security practices:
+
+- **Static analysis:** [CodeQL](https://github.com/markcassidyconsulting/ordercloud-python/actions/workflows/codeql.yml) runs on every push and weekly
+- **Dependency scanning:** [Dependabot](https://github.com/markcassidyconsulting/ordercloud-python/security/dependabot) monitors for known vulnerabilities in dependencies
+- **Dependency review:** Pull requests are checked for newly introduced vulnerable dependencies
+- **Supply chain security:** All GitHub Actions are pinned to commit SHAs
+- **Build provenance:** Every [GitHub release](https://github.com/markcassidyconsulting/ordercloud-python/releases) carries the build provenance attestation for its sdist and wheel as `ordercloud_python-<version>.intoto.jsonl`
+- **Branch protection:** The `main` branch requires status checks to pass before merge
+
+### Verifying a release
+
+With the [GitHub CLI](https://cli.github.com/), download a release's files and check a distribution against its provenance file:
+
+```bash
+gh release download v<version> --repo markcassidyconsulting/ordercloud-python
+gh attestation verify ordercloud_python-<version>-py3-none-any.whl --bundle ordercloud_python-<version>.intoto.jsonl --repo markcassidyconsulting/ordercloud-python
+```
+
+The provenance file covers both the wheel and the sdist (`ordercloud_python-<version>.tar.gz`), and the same command checks a wheel fetched from PyPI with `pip download ordercloud-python==<version> --no-deps`. Exit code 0 means the file matches build provenance signed by a GitHub Actions workflow in this repository; a modified file fails verification.

{ordercloud_python-2026.6.1 → ordercloud_python-2026.10.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ordercloud-python"
-version = "2026.6.1"
+version = "2026.10.2"
 description = "Idiomatic Python SDK for Sitecore OrderCloud"
 readme = "README.md"
 license = "MIT"
@@ -70,6 +70,11 @@ packages = ["src/ordercloud"]
 target-version = "py310"
 line-length = 100
 
+[tool.ruff.lint]
+# Explicit rule selection: the set this codebase is linted against. Stated
+# here so the gate does not change when Ruff changes its default rules.
+select = ["E4", "E7", "E9", "F"]
+
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 asyncio_mode = "auto"