Release SDK updates

[stlc-workflow-app]

6d40fa4 docs: expose fine-tune artifact ids
aec0fa9 Build SDK
52b750d Build SDK
283190b chore: export finetune model limits type name preoperly
d501da9 feat(openapi): sync RL Muon optimizer API
320f83c MOSH-3022. feat(openapi): expose fine-tuning model limits as an SDK method
15e61cf Build SDK
fd9d365 fix(openapi): remove duplicate supports_full_training key
5091250 feat(openapi): expose remediation linked alerts
5e64e33 feat(openapi): sync passive health check alerts
67160d1 feat(openapi): add force stop parameter
104f1eb feart: Add queue clear method
498331c feat(openapi): sync RL model resources stop API
bb6d6be Sync fine-tune public OpenAPI schema
52d33d0 feat: expose GPU cluster reserved counts
c42616a chore: fix yaml
41b0875 Sync RL attach-only training session OpenAPI
d40c1b2 Build SDK
ba2b558 docs(adapters): align endpoint adapter code samples with the SDK
21d4c0a feat: add /v1/whoami endpoint to OpenAPI spec

[broly-code-security-scanner]

Broly Security Scan

Note

Summary

9 actionable finding(s) in this PR
12 total in scan · 3 dismissed false positives

• 🟡 9 medium

5 highest-priority actionable rows in the table below (critical/high first, then top medium).

Severity	Scanner	Issue	Location	Dismiss	Verdict
🟡 MEDIUM	SCA	flatted@3.3.2 — 2 vulnerabilities (worst: GHSA-25h7-pfq9-p65f) → >= 3.4.2	yarn.lock:1	d4	🔺 TRUE_POSITIVE · Confidence: HIGH
🟡 MEDIUM	SCA	GHSA-2g4f-4pwh-qvx6: ajv@6.12.6 → >= 8.18.0	yarn.lock:1	d2	🔺 TRUE_POSITIVE · Confidence: HIGH
🟡 MEDIUM	SCA	picomatch@2.3.1 — 2 vulnerabilities (worst: GHSA-3v7f-55p6-f55p) → >= 4.0.4	yarn.lock:1	d7	🔺 TRUE_POSITIVE · Confidence: HIGH
🟡 MEDIUM	SCA	GHSA-4x5r-pxfx-6jf8: @babel/core@7.28.6 → >= 8.0.0-rc.6	yarn.lock:1	d1	🔺 TRUE_POSITIVE · Confidence: HIGH
🟡 MEDIUM	SCA	thrift@0.11.0 — 2 vulnerabilities (worst: GHSA-526f-jxpj-jmg2) → >= 0.23.0	yarn.lock:1	d8	🔺 TRUE_POSITIVE · Confidence: HIGH

🟢 Dismissed false positives (3) — not shown above

• 🔵 LOW · Hardcoded API key in source code · tests/api-resources/beta/endpoints/rollouts.test.ts:6 — The value 'My API Key' is an obvious placeholder string in a test file (rollouts.test.ts) used to construct a client for unit testing, not a real credential.
• 🔵 LOW · Hardcoded API key in source code · tests/api-resources/beta/endpoints/shadow-experiments/shadow-experiments.test.ts:6 — The literal 'My API Key' is an obvious placeholder in a test file (*.test.ts) and clearly indicates a mock value rather than a real credential.
• 🔵 LOW · Hardcoded API key in source code. · tests/api-resources/top-level.test.ts:6 — The string 'My API Key' is an obvious placeholder literal in a test file, not a real credential.

Dismiss false positives

Each dismissable row has a Dismiss key (d1, d2, …) in the table above. Reply to this comment (or post on the PR) with /broly dismiss d2: your reason to mark a false positive, or /broly undismiss d2 to reverse it. Broly records every dismissal in the section below this comment (updated in place) and suppresses the finding on the next scan.

Key	Finding
d1	🟡 MEDIUM · GHSA-4x5r-pxfx-6jf8: @babel/core@7.28.6 · yarn.lock:1
d2	🟡 MEDIUM · GHSA-2g4f-4pwh-qvx6: ajv@6.12.6 · yarn.lock:1
d3	🟡 MEDIUM · GHSA-73rr-hh4g-fpgx: diff@4.0.2 · yarn.lock:1
d4	🟡 MEDIUM · flatted@3.3.2 — 2 vulnerabilities (worst: GHSA-25h7-pfq9-p65f) · yarn.lock:1
d5	🟡 MEDIUM · GHSA-h67p-54hq-rp68: js-yaml@3.14.2 · yarn.lock:1
d6	🟡 MEDIUM · GHSA-h67p-54hq-rp68: js-yaml@4.1.1 · yarn.lock:1
d7	🟡 MEDIUM · picomatch@2.3.1 — 2 vulnerabilities (worst: GHSA-3v7f-55p6-f55p) · yarn.lock:1
d8	🟡 MEDIUM · thrift@0.11.0 — 2 vulnerabilities (worst: GHSA-526f-jxpj-jmg2) · yarn.lock:1
d9	🟡 MEDIUM · ws@8.19.0 — 2 vulnerabilities (worst: GHSA-58qx-3vcg-4xpx) · yarn.lock:1

Note

Re-scan this PR anytime with /broly scan — useful after /broly undismiss, or to refresh findings without a new push.

Broly — SAST (zai-org/GLM-5.2) · Secrets · SCA · GH Actions (zizmor) · Containers · SBOM · Powered by Together AI