release: 0.75.0

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.74.0"
+  ".": "0.75.0"
 }

.stats.yml

@@ -1,4 +1,4 @@
 configured_endpoints: 125
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-ebbe079bb2542625826422afd876a3e8b499c579cf45efc5fd50e7982d34df7d.yml
-openapi_spec_hash: db850b61a0d71fe9f4b642df8782d7ae
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-f0486d0b8e34ddf8ba34e36ff97856cf973e0797e021ff621e04e4840970966e.yml
+openapi_spec_hash: 12a71ce5ac80fc65f6a8779f0ca29223
 config_hash: 06186eb40e0058a2a87ac251fc07415d

CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.75.0 (2026-07-08)
+
+Full Changelog: [v0.74.0...v0.75.0](https://github.com/kernel/kernel-python-sdk/compare/v0.74.0...v0.75.0)
+
+### Features
+
+* Auto-flush pools when a managed auth profile re-authenticates ([430c07f](https://github.com/kernel/kernel-python-sdk/commit/430c07fc2bfd5ab80fe25cc4677b34729bf4b4ee))
+* Document env var redaction on deployment and app reads ([51d713b](https://github.com/kernel/kernel-python-sdk/commit/51d713b92b4c0ed0c2420ea2e128568530a81a14))
+* Expose resolved profile_id and extension_ids on browser pool reads ([56876e9](https://github.com/kernel/kernel-python-sdk/commit/56876e9a49fca34ec34b58ea8f5f85130c0c0315))
+* Reject API key self-deletion ([482f920](https://github.com/kernel/kernel-python-sdk/commit/482f9209f956e5615bdbaa6ec9c58081df56587b))
+* Revert "Store and return a sha256 checksum for uploaded extensions (#… ([74dbc54](https://github.com/kernel/kernel-python-sdk/commit/74dbc54d4d8d5b330f74985227fa09f7569457a7))
+* Store and return a sha256 checksum for uploaded extensions ([b266775](https://github.com/kernel/kernel-python-sdk/commit/b266775497fec10224e965c787c146494eecdae8))
+* Store and return a sha256 checksum for uploaded extensions (reland) ([98cfb28](https://github.com/kernel/kernel-python-sdk/commit/98cfb2835be3d321799bbfd0400e1bb59b39b218))
+
+
+### Documentation
+
+* **api:** clarify reuse/discard_all_idle pool config staleness ([e8641eb](https://github.com/kernel/kernel-python-sdk/commit/e8641ebe96926b22f8874a8ff79498a4cbe7e4ed))
+
 ## 0.74.0 (2026-07-06)
 
 Full Changelog: [v0.73.0...v0.74.0](https://github.com/kernel/kernel-python-sdk/compare/v0.73.0...v0.74.0)

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kernel"
-version = "0.74.0"
+version = "0.75.0"
 description = "The official Python library for the kernel API"
 dynamic = ["readme"]
 license = "Apache-2.0"

src/kernel/_version.py

@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "kernel"
-__version__ = "0.74.0"  # x-release-please-version
+__version__ = "0.75.0"  # x-release-please-version

src/kernel/resources/api_keys.py

@@ -266,8 +266,10 @@ def delete(
         extra_body: Body | None = None,
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
     ) -> None:
-        """
-        Delete an API key.
+        """Delete an API key.
+
+        A key cannot delete itself; use a different key to delete
+        this one.
 
         Args:
           extra_headers: Send extra headers
@@ -575,8 +577,10 @@ async def delete(
         extra_body: Body | None = None,
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
     ) -> None:
-        """
-        Delete an API key.
+        """Delete an API key.
+
+        A key cannot delete itself; use a different key to delete
+        this one.
 
         Args:
           extra_headers: Send extra headers

src/kernel/resources/browser_pools.py

@@ -69,6 +69,7 @@ def create(
         name: str | Omit = omit,
         profile: browser_pool_create_params.Profile | Omit = omit,
         proxy_id: str | Omit = omit,
+        refresh_on_profile_update: bool | Omit = omit,
         start_url: str | Omit = omit,
         stealth: bool | Omit = omit,
         timeout_seconds: int | Omit = omit,
@@ -110,16 +111,19 @@ def create(
 
           name: Optional name for the browser pool. Must be unique within the project.
 
-          profile: Profile selection for browsers in a pool. Provide either id or name. The
-              matching profile is loaded into every browser in the pool. Profiles must be
-              created beforehand. Unlike single browser sessions, pools load the profile
-              read-only and never persist changes back to it, so save_changes is omitted here.
-              Any save_changes value sent on a pool profile is silently ignored rather than
-              rejected, so callers reusing a single-session profile object will not error.
+          profile: Profile configuration for browsers in a pool. Provide either id or name.
+              Profiles must be created beforehand. Unlike single browser sessions, pools load
+              the profile read-only and never persist changes back to it, so save_changes is
+              omitted here. Any save_changes value sent on a pool profile is silently ignored
+              rather than rejected.
 
           proxy_id: Optional proxy to associate to the browser session. Must reference a proxy in
               the same project as the browser session.
 
+          refresh_on_profile_update: When true, flush idle browsers when the profile the pool uses is updated, so
+              pool browsers pick up the latest profile data. Requires a profile to be set on
+              the pool.
+
           start_url: Optional URL to navigate to when a new browser is warmed into the pool.
               Best-effort: failures to navigate do not fail pool fill. Only applied to
               newly-warmed browsers; browsers reused via release/acquire keep whatever URL the
@@ -166,6 +170,7 @@ def create(
                     "name": name,
                     "profile": profile,
                     "proxy_id": proxy_id,
+                    "refresh_on_profile_update": refresh_on_profile_update,
                     "start_url": start_url,
                     "stealth": stealth,
                     "timeout_seconds": timeout_seconds,
@@ -225,6 +230,7 @@ def update(
         name: str | Omit = omit,
         profile: browser_pool_update_params.Profile | Omit = omit,
         proxy_id: str | Omit = omit,
+        refresh_on_profile_update: bool | Omit = omit,
         size: int | Omit = omit,
         start_url: str | Omit = omit,
         stealth: bool | Omit = omit,
@@ -241,16 +247,22 @@ def update(
 
         As with creation,
         save_changes on the pool profile is ignored (not rejected); pooled browsers
-        never persist changes back to the profile.
+        never persist changes back to the profile. To clear the profile reference, send
+        `profile: { "id": "" }`. Clearing the profile also disables
+        `refresh_on_profile_update`.
 
         Args:
           chrome_policy: Custom Chrome enterprise policy overrides applied to all browsers in this pool.
               Keys are Chrome enterprise policy names; values must match their expected types.
               Blocked: kernel-managed policies (extensions, proxy, CDP/automation). See
               https://chromeenterprise.google/policies/
 
-          discard_all_idle: Whether to discard all idle browsers and rebuild the pool immediately. Defaults
-              to false.
+          discard_all_idle: Whether to discard all idle browsers and rebuild them immediately with the new
+              configuration. Defaults to false. Only browsers that are idle when the update
+              runs are rebuilt. A browser that is in use during the update keeps its original
+              configuration, and if it is later released with `reuse: true` it returns to the
+              pool with that stale configuration until it is discarded (by this flag on a
+              later update, or by flushing the pool).
 
           extensions: List of browser extensions to load into the session. Provide each by id or name.
 
@@ -265,16 +277,19 @@ def update(
 
           name: Optional name for the browser pool. Must be unique within the project.
 
-          profile: Profile selection for browsers in a pool. Provide either id or name. The
-              matching profile is loaded into every browser in the pool. Profiles must be
-              created beforehand. Unlike single browser sessions, pools load the profile
-              read-only and never persist changes back to it, so save_changes is omitted here.
-              Any save_changes value sent on a pool profile is silently ignored rather than
-              rejected, so callers reusing a single-session profile object will not error.
+          profile: Profile configuration for browsers in a pool. Provide either id or name.
+              Profiles must be created beforehand. Unlike single browser sessions, pools load
+              the profile read-only and never persist changes back to it, so save_changes is
+              omitted here. Any save_changes value sent on a pool profile is silently ignored
+              rather than rejected.
 
           proxy_id: Optional proxy to associate to the browser session. Must reference a proxy in
               the same project as the browser session.
 
+          refresh_on_profile_update: When true, flush idle browsers when the profile the pool uses is updated, so
+              pool browsers pick up the latest profile data. Requires a profile to be set on
+              the pool.
+
           size: Number of browsers to maintain in the pool. The maximum size is determined by
               your organization's pooled sessions limit (the sum of all pool sizes cannot
               exceed your limit).
@@ -327,6 +342,7 @@ def update(
                     "name": name,
                     "profile": profile,
                     "proxy_id": proxy_id,
+                    "refresh_on_profile_update": refresh_on_profile_update,
                     "size": size,
                     "start_url": start_url,
                     "stealth": stealth,
@@ -554,7 +570,10 @@ def release(
           session_id: Browser session ID to release back to the pool
 
           reuse: Whether to reuse the browser instance or destroy it and create a new one.
-              Defaults to true.
+              Defaults to true. A reused browser keeps the configuration it was created with,
+              so it does not pick up pool configuration changes made while it was in use.
+              Release with `reuse: false`, or flush the pool afterward, to rebuild it with the
+              current configuration.
 
           extra_headers: Send extra headers
 
@@ -617,6 +636,7 @@ async def create(
         name: str | Omit = omit,
         profile: browser_pool_create_params.Profile | Omit = omit,
         proxy_id: str | Omit = omit,
+        refresh_on_profile_update: bool | Omit = omit,
         start_url: str | Omit = omit,
         stealth: bool | Omit = omit,
         timeout_seconds: int | Omit = omit,
@@ -658,16 +678,19 @@ async def create(
 
           name: Optional name for the browser pool. Must be unique within the project.
 
-          profile: Profile selection for browsers in a pool. Provide either id or name. The
-              matching profile is loaded into every browser in the pool. Profiles must be
-              created beforehand. Unlike single browser sessions, pools load the profile
-              read-only and never persist changes back to it, so save_changes is omitted here.
-              Any save_changes value sent on a pool profile is silently ignored rather than
-              rejected, so callers reusing a single-session profile object will not error.
+          profile: Profile configuration for browsers in a pool. Provide either id or name.
+              Profiles must be created beforehand. Unlike single browser sessions, pools load
+              the profile read-only and never persist changes back to it, so save_changes is
+              omitted here. Any save_changes value sent on a pool profile is silently ignored
+              rather than rejected.
 
           proxy_id: Optional proxy to associate to the browser session. Must reference a proxy in
               the same project as the browser session.
 
+          refresh_on_profile_update: When true, flush idle browsers when the profile the pool uses is updated, so
+              pool browsers pick up the latest profile data. Requires a profile to be set on
+              the pool.
+
           start_url: Optional URL to navigate to when a new browser is warmed into the pool.
               Best-effort: failures to navigate do not fail pool fill. Only applied to
               newly-warmed browsers; browsers reused via release/acquire keep whatever URL the
@@ -714,6 +737,7 @@ async def create(
                     "name": name,
                     "profile": profile,
                     "proxy_id": proxy_id,
+                    "refresh_on_profile_update": refresh_on_profile_update,
                     "start_url": start_url,
                     "stealth": stealth,
                     "timeout_seconds": timeout_seconds,
@@ -773,6 +797,7 @@ async def update(
         name: str | Omit = omit,
         profile: browser_pool_update_params.Profile | Omit = omit,
         proxy_id: str | Omit = omit,
+        refresh_on_profile_update: bool | Omit = omit,
         size: int | Omit = omit,
         start_url: str | Omit = omit,
         stealth: bool | Omit = omit,
@@ -789,16 +814,22 @@ async def update(
 
         As with creation,
         save_changes on the pool profile is ignored (not rejected); pooled browsers
-        never persist changes back to the profile.
+        never persist changes back to the profile. To clear the profile reference, send
+        `profile: { "id": "" }`. Clearing the profile also disables
+        `refresh_on_profile_update`.
 
         Args:
           chrome_policy: Custom Chrome enterprise policy overrides applied to all browsers in this pool.
               Keys are Chrome enterprise policy names; values must match their expected types.
               Blocked: kernel-managed policies (extensions, proxy, CDP/automation). See
               https://chromeenterprise.google/policies/
 
-          discard_all_idle: Whether to discard all idle browsers and rebuild the pool immediately. Defaults
-              to false.
+          discard_all_idle: Whether to discard all idle browsers and rebuild them immediately with the new
+              configuration. Defaults to false. Only browsers that are idle when the update
+              runs are rebuilt. A browser that is in use during the update keeps its original
+              configuration, and if it is later released with `reuse: true` it returns to the
+              pool with that stale configuration until it is discarded (by this flag on a
+              later update, or by flushing the pool).
 
           extensions: List of browser extensions to load into the session. Provide each by id or name.
 
@@ -813,16 +844,19 @@ async def update(
 
           name: Optional name for the browser pool. Must be unique within the project.
 
-          profile: Profile selection for browsers in a pool. Provide either id or name. The
-              matching profile is loaded into every browser in the pool. Profiles must be
-              created beforehand. Unlike single browser sessions, pools load the profile
-              read-only and never persist changes back to it, so save_changes is omitted here.
-              Any save_changes value sent on a pool profile is silently ignored rather than
-              rejected, so callers reusing a single-session profile object will not error.
+          profile: Profile configuration for browsers in a pool. Provide either id or name.
+              Profiles must be created beforehand. Unlike single browser sessions, pools load
+              the profile read-only and never persist changes back to it, so save_changes is
+              omitted here. Any save_changes value sent on a pool profile is silently ignored
+              rather than rejected.
 
           proxy_id: Optional proxy to associate to the browser session. Must reference a proxy in
               the same project as the browser session.
 
+          refresh_on_profile_update: When true, flush idle browsers when the profile the pool uses is updated, so
+              pool browsers pick up the latest profile data. Requires a profile to be set on
+              the pool.
+
           size: Number of browsers to maintain in the pool. The maximum size is determined by
               your organization's pooled sessions limit (the sum of all pool sizes cannot
               exceed your limit).
@@ -875,6 +909,7 @@ async def update(
                     "name": name,
                     "profile": profile,
                     "proxy_id": proxy_id,
+                    "refresh_on_profile_update": refresh_on_profile_update,
                     "size": size,
                     "start_url": start_url,
                     "stealth": stealth,
@@ -1102,7 +1137,10 @@ async def release(
           session_id: Browser session ID to release back to the pool
 
           reuse: Whether to reuse the browser instance or destroy it and create a new one.
-              Defaults to true.
+              Defaults to true. A reused browser keeps the configuration it was created with,
+              so it does not pick up pool configuration changes made while it was in use.
+              Release with `reuse: false`, or flush the pool afterward, to rebuild it with the
+              current configuration.
 
           extra_headers: Send extra headers
 

src/kernel/types/app_list_response.py

@@ -25,7 +25,12 @@ class AppListResponse(BaseModel):
     """Deployment ID"""
 
     env_vars: Dict[str, str]
-    """Environment variables configured for this app version"""
+    """Environment variables configured for this app version.
+
+    Values are redacted for API key, OAuth, and managed-auth callers, which receive
+    every key with an empty string value. Only dashboard sessions receive the actual
+    values.
+    """
 
     region: Literal["aws.us-east-1a"]
     """Deployment region code"""