v7.0.0-rc

7.0.0-rc (2026-07-29)

⚠ BREAKING CHANGES

• creative: FormatId is removed from the normal root API in favor of LegacyFormatId and explicit legacy modules. BuildCreativeRequest/Response and PreviewCreativeRequest/Response variants are renamed to Legacy*; ADCPClient build_creative/preview_creative and list_creative_formats move to *_legacy methods. Product and creative filters no longer expose format_ids, and generic primary execution rejects legacy-only creative tasks.

Features

• creative: make canonical models primary in v7 (#994) (b5c6f16)
• protocol: support AdCP 3.1.8 schemas (#992) (0efb159)

Bug Fixes

• security: harden SDK auth transports (a2610a5)
• server: unify divergent host normalizers behind one helper (#997) (6fb1b72)
• signing: block CGNAT and 6to4 relay ranges in SSRF validation (#974) (0207429)
• signing: canonicalize both origins in the brand.json jwks gate (#998) (b7ef1df)
• signing: idna-normalize hosts in etld+1 binding (#995) (827e4f4), closes #988
• signing: preserve a trailing empty query in @target-uri (#987) (afa0454)
• signing: reject malformed authorities, convert IDN hosts to A-labels (#985) (be233e4)
• signing: reject malformed structured-field input at step 1 (#993) (6518c2d)
• webhooks: bracket and structurally validate DockerLocalhostRewrite rewrite_to (#996) (013c06c)