From 885cdaa8d8b335b0768d955b5ee69f951ebe00e3 Mon Sep 17 00:00:00 2001 From: Zachary Chua Date: Tue, 1 Sep 2026 11:41:18 -0700 Subject: [PATCH 1/2] Bump version to 15.6.1 --- CHANGELOG.md | 5 +++++ VERSION | 2 +- pyproject.toml | 2 +- stripe/_version.py | 2 +- 4 files changed, 8 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 53d5ab774..9f3327d0f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,8 @@ +## 15.6.1 - 2026-09-01 +* [#1896](https://github.com/stripe/stripe-python/pull/1896) Harden API requestor code against malicious URLs +* [#1898](https://github.com/stripe/stripe-python/pull/1898) Use cryptographically secure boundaries for multipart file uploads +* [#1860](https://github.com/stripe/stripe-python/pull/1860) Dispatch discriminated union fields to their variant class + ## 15.6.0 - 2026-08-26 This release changes the pinned API version to 2026-08-26.dahlia. diff --git a/VERSION b/VERSION index 9f6d8f2fd..0ab55a66f 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -15.6.0 +15.6.1 diff --git a/pyproject.toml b/pyproject.toml index 0a20a5240..5ba581723 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "stripe" -version = "15.6.0" +version = "15.6.1" readme = "README.md" description = "Python bindings for the Stripe API" authors = [{ name = "Stripe", email = "support@stripe.com" }] diff --git a/stripe/_version.py b/stripe/_version.py index 8fd39a3e3..22177fc0d 100644 --- a/stripe/_version.py +++ b/stripe/_version.py @@ -1 +1 @@ -VERSION = "15.6.0" +VERSION = "15.6.1" From 4b718afb9b248f5f8858c4d1848cd9532de25e4f Mon Sep 17 00:00:00 2001 From: David Brownman <1231935+xavdid@users.noreply.github.com> Date: Wed, 9 Sep 2026 11:33:46 -0700 Subject: [PATCH 2/2] update webhook examples (#1902) --- examples/async_event_notification_handler_endpoint.py | 2 +- examples/event_notification_handler_endpoint.py | 2 +- examples/event_notification_webhook_handler.py | 2 +- examples/webhooks.py | 2 +- tests/test_webhook.py | 10 ++++++++++ 5 files changed, 14 insertions(+), 4 deletions(-) diff --git a/examples/async_event_notification_handler_endpoint.py b/examples/async_event_notification_handler_endpoint.py index 2cad998ed..3a7f6a9ec 100644 --- a/examples/async_event_notification_handler_endpoint.py +++ b/examples/async_event_notification_handler_endpoint.py @@ -22,7 +22,7 @@ app = FastAPI() api_key = os.environ.get("STRIPE_API_KEY", "") -webhook_secret = os.environ.get("WEBHOOK_SECRET", "") +webhook_secret = os.environ["WEBHOOK_SECRET"] # Webhooks can be delivered more than once, so we track ids we've already # processed. In production, back this with something durable and shared diff --git a/examples/event_notification_handler_endpoint.py b/examples/event_notification_handler_endpoint.py index c1db46f13..b33b845b2 100644 --- a/examples/event_notification_handler_endpoint.py +++ b/examples/event_notification_handler_endpoint.py @@ -19,7 +19,7 @@ app = Flask(__name__) api_key = os.environ.get("STRIPE_API_KEY", "") -webhook_secret = os.environ.get("WEBHOOK_SECRET", "") +webhook_secret = os.environ["WEBHOOK_SECRET"] # Webhooks can be delivered more than once, so we track ids we've already # processed. In production, back this with something durable and shared diff --git a/examples/event_notification_webhook_handler.py b/examples/event_notification_webhook_handler.py index d05117c8c..6bfdb8cb2 100644 --- a/examples/event_notification_webhook_handler.py +++ b/examples/event_notification_webhook_handler.py @@ -25,7 +25,7 @@ app = Flask(__name__) api_key = os.environ.get("STRIPE_API_KEY", "") -webhook_secret = os.environ.get("WEBHOOK_SECRET", "") +webhook_secret = os.environ["WEBHOOK_SECRET"] client = StripeClient(api_key) diff --git a/examples/webhooks.py b/examples/webhooks.py index 79352b1a6..5f393bf00 100644 --- a/examples/webhooks.py +++ b/examples/webhooks.py @@ -6,7 +6,7 @@ # this is for handling v1-style Snapshot Events. # To handle v2-style Events, see `event_notification_webhook_handler.py` -webhook_secret = os.environ.get("WEBHOOK_SECRET") +webhook_secret = os.environ["WEBHOOK_SECRET"] app = Flask(__name__) diff --git a/tests/test_webhook.py b/tests/test_webhook.py index 9b1420a8d..08c9e20b7 100644 --- a/tests/test_webhook.py +++ b/tests/test_webhook.py @@ -274,6 +274,16 @@ def test_raise_on_v2_payload(self, stripe_mock_stripe_client): ) assert "parse_event_notification" in str(e.value) + @pytest.mark.parametrize("secret", [None, ""]) + def test_raise_on_missing_secret(self, stripe_mock_stripe_client, secret): + with pytest.raises( + SignatureVerificationError, + match="No webhook secret value was provided", + ): + stripe_mock_stripe_client.construct_event( + DUMMY_WEBHOOK_PAYLOAD, generate_header(), secret + ) + def test_construct_event_inherits_requestor(self, http_client_mock): http_client_mock.stub_request("delete", "/v1/terminal/readers/rdr_123")