🤖 I have created a release beep boop

4.28.0 (2026-07-08)

Features

• cli: add x-pp-example extension to override endpoint help examples (#3380) (2b45036)
• generator: composite-aware ReconcilePartition seen-set + cascade (#3376) (8d0983b)
• generator: header-driven rate limiter, parallel per-parent fan-out, membership skip, composite path-param fix (#3429) (d4910e6)
• generator: surface sub-resources in MCP context taxonomy (#3478) (b7598b3)

Bug Fixes

• clamp sync page size to pagination param's declared maximum (#3441) (1df157c), closes #3440
• cli: back off before retrying transient network errors (#3424) (f4118a3)
• cli: bump Go toolchain floor to 1.26.5 (#3506) (c48a046)
• cli: calibrate GraphQL generator checks (#3413) (8601d16)
• cli: defang full-shape example credentials in secret-scrubbing reference (#3480) (e089073)
• cli: gate partial failure helpers by emitted callers (#3470) (f5a4795)
• cli: harden publish artifact staging (#3414) (4a2b023)
• cli: honor directly-held env bearer in OAuth2 authcode AuthHeader (#3490) (7301f67)
• cli: honor plan-mode dry runs (#3410) (93c3442)
• cli: implement PKCE for secretless OAuth authorization-code login (#3460) (6e43fd5)
• cli: keep local datastore MCP off HTTP endpoints (#3411) (d9a82a9)
• cli: order path-param positionals by URL path, not declaration order (#3390) (a64d829), closes #3369
• cli: remove vendor-specific profile wording (#3430) (ea8d6fb)
• cli: route browser cookie auth through jar path (#3408) (d30d066)
• cli: skip soft lookup error probes (#3468) (6037ad2)
• cli: support array request bodies from stdin (#3484) (956c095)
• generator: mark generated security suppressions (#3485) (f05a0fd)
• generator: stop mid-word truncation of root Short/Long (#3363) (6c4d9c4)
• skills: block proposal PR fallback for real artifact work (#3412) (95636bf)
• skills: preflight Go currency and disk space (#3409) (ff9e58e)
• skills: raise supported version floor (#3498) (3b1f7c3)

This PR was generated with Release Please. See documentation.