chore: bump API version to v2025-11-15

[azrosen92]

Summary

• Adds versioned SDK directory and workflow entries for API version v2025-11-15
• Existing entries are frozen at their current version for backwards compatibility

Notes

Dependency: merge cleanup PR first (chore: untrack .speakeasy/workflow.local.yaml). This PR has been rebased to assume the file is already gone.

Merge order:

1. Gusto-Partner-API: fix: harden codegen --new-version scaffold (script hardening)
2. gusto-python-client cleanup PR
3. This PR

🤖 Generated with Claude Code

[boostsecurity-io-ai]

🚀 2 New Security Fixes

You just committed 2 security fixes. 😎 Keep up the great work!

🎯 Take a look at what findings you fixed.

Findings
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Original Rule ID: python_random_rule-random The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong. The application uses the random module to generate random values. The random module implements a Mersenne Twister PRNG which is not cryptographically secure and produces predictable values that can be exploited when used for tokens, session...
📘 Learn More gusto-python-client/gusto_app_int_v_2025_06_15/src/gusto_app_integration/utils/retries.py Line 186 in 0bccae8 sleep = (initial_interval / 1000) * exponent**retries + random.uniform(0, 1)
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Original Rule ID: python_random_rule-random The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong. The application uses the random module to generate random values. The random module implements a Mersenne Twister PRNG which is not cryptographically secure and produces predictable values that can be exploited when used for tokens, session...
📘 Learn More gusto-python-client/gusto_embedded_v_2025_06_15/src/gusto_embedded/utils/retries.py Line 186 in 0bccae8 sleep = (initial_interval / 1000) * exponent**retries + random.uniform(0, 1)

Scanner: boostsecurity - Semgrep

[gusto-fresh-eyes]

Fresh Eyes Review

Found 4 issues in this PR.

PR Description Issues

• Minor | description-check: Missing 'Testing' section: No mention of how the new workflow entries and gen configs were validated (e.g., running speakeasy generate, verifying registry resolution, or checking that the new versioned packages build).
• Minor | description-check: Undocumented formatting change: The description states 'Existing entries are frozen at their current version for backwards compatibility', but the diff shows the entire workflow.yaml was reformatted (2-space indent, added YAML document separator '---', added quotes around variable references). While semantically equivalent, this is not mentioned and may cause noisy diffs or merge conflicts for in-flight branches.

Download findings.json — drag the file into Claude or use /add to propose fixes

---

^{Please 👍🏽 👎🏽 if you found this useful. Generated by Fresh Eyes Reviewer. Get help in #ai-code-reviews}

[gusto-fresh-eyes]

🔴 Blocker | [fresh_eyes]: code-moves

Dropped overlay action: the original gusto_app_int/.speakeasy/speakeasy-modifications-overlay.yaml has TWO actions — $.paths..schema..zip AND $.components.schemas..properties.zip — but the new versioned copy only includes the first one. The original comments explain both are needed because address schemas referenced via $ref live under components.schemas and won't be caught by the $.paths.. rule alone. Without the second rule, the generated v2025-11-15 SDK will shadow Python's built-in zip() for those schemas (causing pylint W0622 failures).

---

^{Please 👍🏽 👎🏽 if you found this useful. Generated by Fresh Eyes Reviewer. Get help in #ai-code-reviews}

[gusto-fresh-eyes]

🔴 Blocker | [fresh_eyes]: code-moves

Dropped overlay action: the original gusto_embedded/.speakeasy/speakeasy-modifications-overlay.yaml has TWO actions — $.paths..schema..zip AND $.components.schemas..properties.zip — but the new versioned copy only includes the first one. Same issue as the app-int overlay: without the $.components.schemas..properties.zip target, zip properties on ref'd schemas won't be renamed to zip_code, shadowing Python's zip() builtin.

---

^{Please 👍🏽 👎🏽 if you found this useful. Generated by Fresh Eyes Reviewer. Get help in #ai-code-reviews}