bump-sdk-version — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited bump-sdk-version (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
We use semantic versioning (MAJOR.MINOR.PATCH) while at major version 0:
| Bump | When | Examples |
|---|---|---|
| Patch (0.8.0 -> 0.8.1) | Bug fixes, docs changes, small tweaks, dependency updates | Fix a typo in output, update a dependency |
| Minor (0.8.1 -> 0.9.0) | New features, new operation types, API additions | Add a new operation, new SDK method, new MCP tool |
| Patch for breaking changes that are trivial to adapt | Rename a parameter, change a default | Rename max_rows to row_limit |
| Minor for breaking changes that require migration | Remove or restructure API surface | Remove an operation type, change return format |
If unsure, ask the user which component to bump.
All paths are relative to futuresearch-python/. Update the version string in each:
project.version (the source of truth)versionplugins[0].versionversionproject.version AND dependencies (futuresearch>=X.Y.Z)version AND packages[0].versionversionversion AND date-released (set to today's date)version field in the citation blockproject.version AND dependencies (futuresearch>=X.Y.Z)project.version AND dependencies (futuresearch-mcp>=X.Y.Z)After editing, regenerate the lock files. Run uv lock in futuresearch-python/ first:
cd futuresearch-python && uv lockThen sync transitive lockfiles across the entire monorepo. The CI check check-uv-sync runs ./uv-all.sh sync --all-extras --dev --all-groups and will fail if any other workspace's uv.lock still references the old SDK version. Run it from the repo root:
cd <repo-root> && ./uv-all.sh sync --all-extras --dev --all-groupsStage any additional lockfiles it touches alongside the bump.
cd futuresearch-python && uv run pytest tests/test_version.py -vSearch for the OLD version number to catch any files that were missed. Use --hidden (or equivalent) to include .claude-plugin/ and other dotfiles:
cd futuresearch-python && rg --hidden "OLD_VERSION" --glob '!.venv' --glob '!uv.lock' --glob '!*.pyc' --glob '!__pycache__'Be sure to escape the . characters in the version number: "1\.2\.3".
Review any hits — some may be false positives: e.g., changelogs, migration notes, 3rd party packages.
Create a branch and commit with message: Bump SDK version to X.Y.Z
Version bumps should be in their own PR — do not bundle them with feature or fix changes. The commit message and PR title should be: Bump SDK version to X.Y.Z
Merging the bump PR does NOT publish. The publish pipeline lives in the public futuresearch/futuresearch-python repo's .github/workflows/publish.yaml and triggers on release: published only. After the bump PR merges:
sync-futuresearch-python to mirror the bump commit to the publicrepo (verify with gh api repos/futuresearch/futuresearch-python/commits/main --jq '.commit.message').
vX.Y.Z (note the v prefix) and theauto-generated changelog:
gh release create vX.Y.Z \
--repo futuresearch/futuresearch-python \
--generate-notes \
--latestpublish.yaml, which:futuresearch, futuresearch-mcp,everyrow, everyrow-mcp)
.mcpb bundle to the release gh run list --repo futuresearch/futuresearch-python --workflow=publish.yaml --limit 1CITATION.cff date-released set to todayfuturesearch>=X.Y.Z, futuresearch-mcp>=X.Y.Z)uv lock regenerated./uv-all.sh sync --all-extras --dev --all-groups run from repo root; any updated transitive lockfiles stageduv run pytest tests/test_version.py passesrg --hidden "OLD_VERSION" shows no unexpected hitsgh release create vX.Y.Z in the public repo to trigger PyPI/MCP-Registry publish~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.