Bump version to 0.14.0

[jeremy]

Release prep for v0.14.0 — the version whose headline is the upload-versions
absorption (#683), now canary-verified against production.
v0.14.0 rather than v0.13.1 because #683 is breaking in five SDKs (see
MIGRATING's section, renamed here from Unreleased).

What's in it

• make bump VERSION=0.14.0 — 10 version files + all six SDK-version
  lockfiles, the first run of the script as fixed by Sync all six SDK-version lockfiles on bump; record the upload-versions canary #698/bump-version.sh syncs 4 lockfiles but 6 record the SDK version, so make check fails after every bump #671
• MIGRATING.md: # Unreleased → # v0.14.0 (must exist before the tag, per
  CONTRIBUTING)
• Seven README upgrade banners (root + six per-SDK) rewritten for this
  release's break profile: the ListUploadVersions retype (compiler-caught in
  the four typed SDKs, silent key changes in Ruby/Python) and the 507 →
  limit_exceeded reroute (silent wherever a default arm exists). Each keeps a
  pointer at v0.13.0's section for anyone jumping more than one version.

Verification

• make check green locally and cold on thelio (build dirs cleared) at this
  SHA — results to be posted before merge
• After merge: six release-*.yml dry-run rehearsals on main, then
  make release VERSION=0.14.0

Dependabot #692 stays held until after the tag (release-freeze precedent from
v0.13.0 / #610).

---

Summary by cubic

Release prep for v0.14.0 across all SDKs. Bumps versions, updates MIGRATING and upgrade banners with real method/enum names, and fixes the TypeScript lockfile to keep libc selectors; this release includes breaking changes.

• Migration

  • Upload versions retype: listVersions/list_versions now return version events (file nested under "upload"). Typed SDKs catch this; Ruby/Python must update keys.
  • Error code change: all 507s now report limit_exceeded instead of retryable api_error. Update any branching on the old code; defaults/else arms may hide this.

• Dependencies

  • TypeScript lockfile for @37signals/basecamp restored to keep @oxlint glibc/musl selectors; only version fields advanced.

^{Written for commit e3bdb52. Summary will update on new commits.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[Copilot]

Pull request overview

Prepares the repository and all six SDKs for the v0.14.0 release.

Changes:

• Bumps SDK version declarations and lockfiles to 0.14.0.
• Finalizes the v0.14.0 migration section.
• Updates upgrade notices for breaking upload-version and HTTP 507 behavior.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Reviewed changes

Copilot reviewed 18 out of 22 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
README.md	Updates the repository upgrade banner.
MIGRATING.md	Names the v0.14.0 migration section.
package.json	Bumps the root package version.
go/README.md	Updates Go migration guidance.
go/pkg/basecamp/version.go	Bumps the Go SDK version.
typescript/README.md	Updates TypeScript migration guidance.
typescript/package.json	Bumps the TypeScript package version.
typescript/package-lock.json	Updates the version and native-package metadata.
typescript/src/client.ts	Bumps the TypeScript runtime version.
conformance/runner/typescript/package-lock.json	Syncs the local TypeScript dependency version.
ruby/README.md	Updates Ruby migration guidance.
ruby/Gemfile.lock	Syncs the Ruby SDK version.
ruby/lib/basecamp/version.rb	Bumps the Ruby SDK version.
swift/README.md	Updates Swift migration guidance.
swift/Sources/Basecamp/BasecampConfig.swift	Bumps the Swift SDK version.
kotlin/README.md	Updates Kotlin migration guidance.
kotlin/sdk/build.gradle.kts	Bumps the Kotlin artifact version.
kotlin/sdk/src/commonMain/kotlin/com/basecamp/sdk/BasecampConfig.kt	Bumps the Kotlin runtime version.
python/README.md	Updates Python migration guidance.
python/pyproject.toml	Bumps the Python package version.
python/src/basecamp/_version.py	Bumps the Python runtime version.
python/uv.lock	Syncs the Python SDK version.

Files not reviewed (2)

• conformance/runner/typescript/package-lock.json: Generated file
• typescript/package-lock.json: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 18 out of 22 changed files in this pull request and generated no new comments.

Files not reviewed (2)

• conformance/runner/typescript/package-lock.json: Generated file
• typescript/package-lock.json: Generated file

Suppressed comments (3)

README.md:7

• Ruby and Python do not “start seeing different keys” in v0.14: both list_versions implementations return the raw JSON collection, and #683 left those read methods unchanged while correcting the schema the endpoint had always contradicted. Present this as a corrected contract with no dynamic-language signal; otherwise the release banner attributes a runtime response change to the upgrade that does not occur.

**Upgrading?** Read [MIGRATING.md](MIGRATING.md) *before* you bump the version. v0.14.0 breaks all six SDKs: `ListUploadVersions` now returns version events instead of uploads — the four typed SDKs catch that at compile time, Ruby and Python just start seeing different keys — and every 507 now reports the new `limit_exceeded` code instead of a retryable `api_error`, which silently reroutes any error handling that branches on the old code. Coming from v0.12.0 or earlier? v0.13.0's section still applies, and 61 of its breaks survive a clean build.

ruby/README.md:5

• The response keys do not change when Ruby users install v0.14. list_versions still yields raw response hashes, #683 did not alter that method, and MIGRATING notes that the endpoint has always emitted event objects. Describe this as the corrected contract and migration away from the old assumed keys rather than saying entries “now carry” them.

**Upgrading to v0.14.0?** Read [MIGRATING.md](../MIGRATING.md) before you bump the version — nothing catches either break at load time. `list_upload_versions` entries now carry the version event's keys, with the file nested under `"upload"` — code reading `version["filename"]` was getting nil and now has a real place to look — and every 507 reports `limit_exceeded` instead of a retryable `api_error`, so a `when` falling through to an else arm reroutes storage, project and webhook limits silently. Coming from v0.12.0 or earlier, read v0.13.0's section too.

python/README.md:9

• Installing v0.14 does not change the dictionaries returned here: list_versions still returns raw response.json() items, and #683 only added create_version to this generated service. Recast this as a corrected contract (the endpoint always returned event keys) rather than a newly changed runtime shape.

**Upgrading to v0.14.0?** Read [MIGRATING.md](../MIGRATING.md) before you bump the version. `list_upload_versions` entries now carry the version event's keys with the file nested under `"upload"`, and every 507 reports the new `LIMIT_EXCEEDED` code instead of a retryable `API_ERROR` — the interpreter surfaces neither change; only a `match` ending in `typing.assert_never` fails, and only under mypy. Coming from v0.12.0 or earlier, read v0.13.0's section too.

[jeremy]

Verification at this head (a26b87a0e):

• Local make check: green, real exit 0 (macOS/arm64).
• Cold make check on the x86 build server: green, real exit 0 — Kotlin
  build dirs, Gradle caches, typescript/dist and node_modules cleared
  first; run under LC_ALL=C.UTF-8, the locale class CI's runners use.

The cold leg earned its keep twice before going green:

1. First run died in rb-check-drift under the ssh shell's C locale —
   ruby/scripts/ generators read the spec without an encoding pin. Fixed and
   merged as Read the OpenAPI spec as UTF-8 regardless of process locale #701 (this branch is rebased onto it).
2. It then demonstrated bump-version.sh syncs 4 lockfiles but 6 record the SDK version, so make check fails after every bump #671's known residual exactly as that issue predicted:
   a machine holding gitignored conformance lockfiles at 0.13.0 has its first
   post-bump make check rewrite them (the bump-machine sync from Sync all six SDK-version lockfiles on bump; record the upload-versions canary #698 can't
   reach other machines). Re-syncing the two lockfiles there — the fresh-clone
   equivalent — cleared it. The stale-lockfile UX remains make check writes conformance/runner/ruby/Gemfile.lock — the bundler half of #612/#631 was never fixed #670's territory.
3. The full Ruby test suite under a bare C locale also fails on unpinned
   fixture reads — deliberately not fixed mid-release; filed as Ruby test suite reads fixtures without pinned encoding, so make check fails under a C locale #702 with the
   scoping question it actually raises.

[Copilot]

Pull request overview

Copilot reviewed 18 out of 22 changed files in this pull request and generated no new comments.

Files not reviewed (2)

• conformance/runner/typescript/package-lock.json: Generated file
• typescript/package-lock.json: Generated file

[jeremy]

Verification at the final head (e3bdb5239): local make check green, real exit 0; CI fully green; Copilot re-reviewed with no new comments and all six of its findings from the previous round are fixed and resolved (each confirmed against the code first — including one it missed, Swift's case api). The cold build-server leg was run at a26b87a0e; the delta since is README prose and restoring lockfile metadata that every prior release shipped with, neither of which the cold leg exercises differently — not rerun, by that reasoning. Codex remains quota-blocked, as on #698/#701.