[rjrodger]

The version bump for a release, landed through review first, as the release section of AGENTS.md asks. Each port below carries fixes merged since its last tag. The releases follow once this merges, and the next sdk checkpoint is cut from that main for sdkgen to vendor.

Versions

Written by tools/bump.py --ports typescript,javascript,rust,go,php,c,cpp,swift,zig,lean; --check reports every copy agreeing. 16 files change, each by its version string alone.

port	from	to	carries since its tag
typescript	0.3.6	0.3.7	#160's merge fix, the validate $ONE fix
javascript	0.1.6	0.1.7	#160, $ONE
rust	0.1.6	0.1.7	#160
go	0.1.5	0.1.6	#160 and its depth-limit and null-element fixes, #164's setprop and SetPath fixes, $ONE
php	0.1.2	0.1.3	#160, the escurl fix (#155), $ONE
c	0.1.2	0.1.3	#157's strict JSON parser, #160, $ONE
cpp	0.1.3	0.1.4	#157, #160, escurl, $ONE
swift	0.1.2	0.1.3	#160, escurl, $ONE
zig	0.0.2	0.0.3	the named validate result type
lean	0.1.0	0.1.1	#160, $ONE

typescript and go also carry #151, which strips source comments and is not a fix.

How each is released after the merge

• typescript, javascript, rust: one publish.yml dispatch each on main, over OIDC, which tests, publishes and writes <lang>/v<version>.
• go, php, c, cpp, swift, zig, lean: make publish-<lang> from a clean main at the merge, after git fetch --tags, which runs the port's tests and pushes <lang>/v<version>; the tag is the release. Those targets do not themselves check the branch or the tree, so the run has to start from that state.

Not bumped

The thirteen registry ports (python, ruby, csharp, perl, java, kotlin, scala, lua, clojure, dart, elixir, haskell, ocaml) upload under their own registry's credentials, which this environment does not hold. All thirteen carry #160, java and kotlin #164 too, and eleven of them already sit one bump ahead of their tag, so they are left for a release with those credentials.

Verification

• make test in typescript (112 pass), javascript (95 pass), rust and go on this branch, all passing, with the tree unchanged afterwards.
• CI on 2f609df: 131 check runs, 130 passing and test-boru skipped, as it is held.

Review

A second Claude reviewer reproduced the bump byte for byte from main with the same command, confirmed every new <lang>/v<version> tag is free on origin and every release path reads the new version (publish.yml's own expressions for the three OIDC ports, each Makefile's TAG for the seven), and ran all ten ports' make test: typescript 112, javascript 95, go 106, php 98, c, cpp, swift (6.3.3), zig (72, on 0.16.0) and lean (77 groups) all pass; npm pack --dry-run and cargo publish --dry-run package 0.3.7, 0.1.7 and 0.1.7. Its one correction is the Not bumped paragraph above, which said only ruby and dart carried #160. Codex reviewed 2f609df and raised nothing.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BoEed9CaF6sTNMcXxQaH6w

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-08T13:05:22.995240Z	2f609df	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.