You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
revert: "build: bump speakeasy-core to capture the registry license token (#2117)"
This reverts commit 5c2f293.
speakeasy-client-sdk-go v3.27.0 was the first regeneration of that SDK since
2025-05-06. It picked up a registry spec defect live since 2026-03-12:
openapi_artifacts.yaml and openapi_subscriptions.yaml declare no top-level
`security`, so once `speakeasy merge` began pushing global security down onto
individual operations (registry#4559), their 13 operations composed as
`security: []`.
The generated SDK consequently stopped calling utils.PopulateSecurity on every
Artifacts and Subscriptions operation. Verified against a test server: v3.26.7
sends X-Api-Key on Artifacts.PostTags; v3.27.0 sends no auth header at all,
from identical calling code.
That breaks `speakeasy tag promote` (registry/tagging.go -> Artifacts.PostTags)
with `err_unauthorized: bearer token missing` for anyone on v1.795.2, including
every customer tracking `speakeasyVersion: latest`.
Reverting restores SDK v3.26.7 and known-good auth. Nothing consumes the
license_jwt capture yet -- openapi-generation#55 is still open -- so this gives
up no live functionality. Re-land on a fixed v3.27.1 once the registry
fragments declare their security requirement.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
0 commit comments