[kernel-internal]

Automated Release PR

0.131.0 (2026-10-26)

Features

• Arm vault passkeys in browsers and sign WebAuthn requests in metro-api (1f8dbc1)

---

This pull request is managed by Stainless's GitHub App.

The semver version number is based on included commit messages. Alternatively, you can manually set the version number in the title of this pull request.

For a better experience, it is recommended to use either rebase-merge or squash-merge when merging this pull request.

🔗 Stainless website
📚 Read the docs
🙋 Reach out for help or questions

---

Note

Medium Risk
New vault passkey/WebAuthn operation types affect security-sensitive credential flows; CLI coverage workflow changes alter branch rewrite and force-push behavior on kernel/cli.

Overview
Release 0.131.0 bumps the package version and changelog; the substantive API change is vault passkey browser operations on credential vault items.

Clients can call VaultItem.PerformOperation with new request variants arm_passkey, register_passkey, and disarm_passkey (browser session + optional field), and handle PasskeyVaultItemOperationResult (armed / disarmed, optional rp_id). Available-operation metadata and passkey field docs now point to these operations instead of page fill. api.md lists the new param and response types.

Separately, the update-cli-coverage workflow rebases cli-coverage-update onto main, regenerates bot-only branches from main on rebase conflicts, snapshots diffs against main_sha (not a post-merge agent base), applies publish changes on a fresh branch from main, and pushes with --force-with-lease; security tests were updated to match.

^{Reviewed by Cursor Bugbot for commit eecefc9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit eecefc9. Configure here.}

[cursor]

Force-push discards reviewer branch commits

Medium Severity

The publish job always recreates cli-coverage-update from MAIN_SHA and force-pushes. Human commits that rebase cleanly are squashed into a bot commit, and the allowlist drops reviewer files outside go.mod, go.sum, and .go under cmd/ and pkg/. The human-author check only runs when rebase conflicts.

Additional Locations (2)

• .github/workflows/update-cli-coverage.yml#L472-L475
• .github/workflows/update-cli-coverage.yml#L127-L138

 

^{Reviewed by Cursor Bugbot for commit eecefc9. Configure here.}

[rgarcia]

Release 0.131.0: vault passkey operations (arm_passkey, register_passkey, disarm_passkey) from kernel/kernel#4767.

[kernel-internal]

🤖 Release is at https://github.com/kernel/kernel-go-sdk/releases/tag/v0.131.0 🌻