[eli-r-ph]

💡 Motivation and Context

main shipped 7.69.0–7.75.6 after #1051 synced through 7.68.0. This brings those releases into v1 so 8.0 does not drop them.

Changes

• Cherry-picks every main commit from feat(metrics): attach trace exemplars to flushed metric series #1057 through chore(deps): bump uv to 0.13.4 and certifi to 2026.10.19 #1104 with -x, in main order, including the release commits and generated references (as in chore: sync main into v1 (7.65.0–7.67.0) #1044 and chore: sync main into v1 (7.67.1–7.68.0) #1051).
• Skipped: fix(integrations): align tracing-header capture across frameworks #1061, already ported as fix: read tracing headers by default in v1 integrations (port of #1061) #1107. Empty because v1 already had them: test(mcp): remove outdated FastMCP middleware discovery assumptions #1066, test(mcp): drop get_tool checks that fastmcp 4.0.11 invalidated #1049.
• Behavior change against v1: fix: serialize non-finite floats as null in JSON payloads #1081 sends a NaN or infinite float value as null and keeps the event, as 7.75 does. Before this, v1 dropped that event (fix!: drop only the invalid event, not its whole batch #1052). The migration guide now says so. A capture v1 request-body test pins the null on the wire, and the before_send test no longer treats a NaN event as malformed.

Adapted picks (every other pick changes exactly the lines upstream changed):

Pick	Adaptation
#1062, #1065, #1074, #1094, #1096, #1098, #1100	New AI tests assert on capture_ai, because v1 sends AI events through the AI lane
#1067	Keeps v1's options == {} assertion next to upstream's "no $identify" check
#1075	uv.lock regenerated from v1's lock (v1 has no backoff); the added packages match upstream
#1106	Applies the int → float timeout typing to v1's own signatures; public API snapshot regenerated
#1055, #1083	Keep v1's own sdk-compliance.yml

💚 How did you test it?

• The full suite passes on the rebased branch (5288 passed).
• ruff, mypy with its baseline, the public API check and uv lock --check pass.
• The new null test fails with fix: serialize non-finite floats as null in JSON payloads #1081's encoder change reverted.

📝 Checklist

• I reviewed the submitted code.
• I added tests to verify the changes.
• I updated the docs if needed.
• No breaking change or entry added to the changelog.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Written with Claude Code (Claude Opus 5.5, claude-opus-5-5) under the direction of the assignee, who chose to follow #1081 on v1 because the SDK team approved it on main.

🤖 Generated with Claude Code

[veria-ai]

Medium: Redis TLS skips hostname verification on older clients

rediss now reaches the existing URL reconstruction, which strips all query options, including an explicit ssl_check_hostname=True. With redis-py 5.2.1, this leaves hostname verification disabled, allowing a network attacker with a CA-trusted certificate for another hostname to impersonate Redis and capture its AUTH credentials. citeturn3view0

Preserve the TLS query options, removing only SDK-specific parameters such as ttl, and explicitly require hostname verification for rediss connections.

[veria-ai]

PR overview

The PR syncs main into v1 for versions 7.69.0–7.75.6, including changes to Redis URL handling in the Python client.

One security issue remains open in Redis TLS connection handling. On redis-py 5.2.1, URL reconstruction drops an explicit hostname-verification option, allowing a network attacker with a CA-trusted certificate for another hostname to impersonate Redis and capture AUTH credentials. No issues have been fixed or addressed yet.

Open issues (1)

• Medium: Redis TLS skips hostname verification on older clients — posthog/client.py:5051

Fixed/addressed: 0 · PR risk: 6/10

[turnipdabeets]

[suggestion] With the non_finite_value case gone, nothing here checks that a value JSON can't write drops only that event and not the batch, which the migration guide still promises. Could we add a circular-reference case in its place (e.g. a module-level _circular = {}; _circular["self"] = _circular)?