[KarthikSKumar98]

pycentral 2.0a27

A security release. Streaming now verifies TLS certificates by default, token exchange no longer logs tokens, and oauthlib 4 is required. Calling code changes only if you stream through a TLS-intercepting proxy or private CA (pass verify=), or pin oauthlib<4.

At a glance

Version	2.0a27 (bump: in this PR)
Breaking changes	⚠️ yes, see Release notes
Security fixes	⚠️ yes, see Release notes
Python	3.10+
Files changed	38 (10 are sample-script moves; 16 classic modules change only copyright headers)
Risk	Low to medium: streaming TLS now enforced; dependency floor moves to oauthlib 4

Release notes

Breaking changes

• Streaming now verifies TLS certificates by default. Previously Streaming never verified the server certificate. If you connect through a TLS-intercepting proxy or a private CA, pass verify=<path to CA bundle>, or verify=False to disable verification (insecure, not recommended). The explicit cert_reqs setting also guards against changes in the websocket library's defaults.
• oauthlib>=4.0.0,<5.0 is now required (security fix for CVE-2026-49265 and CVE-2026-118669, patched only in 4.0.0). Projects that pin oauthlib<4 will conflict and must upgrade.

Security

• Token exchange no longer logs tokens. With DEBUG logging on, MSP tenant token exchange used to log the full token response, including the access token; it now logs only the workspace ID and expires_in. If you ran with DEBUG logging, rotate those tokens.
• Updated mkdocs-material to 9.7.7 and pymdown-extensions to >=11.0.1 for the docs build (CVE-2026-73295, CVE-2026-61632, CVE-2026-67422); no runtime impact. mkdocs build --strict succeeds with pymdown-extensions 12.1 and mkdocstrings 0.30.1.
• Fixed secrets handling: stopped tracking test credential/token files and widened .gitignore.

Changed

• Classic sample scripts moved from sample_scripts/ to pycentral/classic/sample_scripts/.
• Copyright headers in the classic modules and sample scripts now read "Hewlett Packard Enterprise Development LP".
• The release workflow uses actions/download-artifact v6, and a new pip-audit workflow checks dependencies for known vulnerabilities.

Docs

• Added SECURITY.md: supported versions and how to report a vulnerability.
• CONTRIBUTIONS.md: updated branding, the team contact address (networking-automation@hpe.com) and the sample scripts path.

Full Changelog: v2.0a26...v2.0a27

Review guide

Look here first

1. pycentral/streaming/streaming.py: new keyword-only verify=True (bool or CA-bundle path); the websocket connects with cert_reqs=CERT_REQUIRED unless verify=False.
2. pycentral/msp/msp_base.py: tenant token exchange logs only the workspace ID and expires_in.
3. pyproject.toml: oauthlib>=4.0.0,<5.0; the moved classic sample scripts stay out of the wheel.

Safe to skim

• pycentral/classic/*.py: copyright header updates only.
• pycentral/classic/sample_scripts/: moved from the repo root, contents unchanged apart from import paths and copyright headers.
• .github/workflows/: new pip-audit workflow; download-artifact bumped to v6 in the release workflow.
• docs/requirements.txt, .gitignore, SECURITY.md, CONTRIBUTIONS.md.

Checks

Check	Result	Details
Package build	✅	python -m build and twine check: wheel and sdist pass
Clean install	✅	wheel in a fresh venv: version 2.0a27, all subpackages import, oauthlib 4.0.1 resolves
Offline tests	✅	streaming TLS tests on the installed wheel: 7 passed
Live read-only tests	✅	token, device inventory GET (200), streaming connect with verification on; a wrong CA bundle is rejected
pip-audit	✅	no known vulnerabilities in the package or docs/requirements.txt
Docs build	✅	mkdocs build --strict with docs/requirements.txt

Follow-ups

• Remove the redundant sample_scripts excludes in pyproject.toml.

Submitter checklist

• Release notes match RELEASE-NOTES.md word for word
• Version is bumped
• No credentials, tokens or private paths in the diff
• Merge with "Create a merge commit"

Files by area

Area	Files	Notes
Streaming	pycentral/streaming/streaming.py	TLS verification, verify=
MSP	pycentral/msp/msp_base.py	no token logging
Classic	pycentral/classic/*.py, pycentral/classic/sample_scripts/*	headers; sample scripts moved from sample_scripts/
Packaging	pyproject.toml	oauthlib 4, sample-script excludes
CI	.github/workflows/{pip-audit,release}.yaml	dependency audit; artifact action bump
Docs	docs/requirements.txt, SECURITY.md, CONTRIBUTIONS.md	docs build CVEs, security policy, branding
Release	RELEASE-NOTES.md, pycentral/__init__.py, .gitignore	2.0a27