v1.6.0

1.6.0 (2026-03-19)

Features

• consolidate security-sensitive code — SSRF protection and OAuth normalization (#1125) (a683f86)

Bug Fixes

• coerce AnyUrl to str before passing to yarl.URL() (#1106) (#1118) (641ee9e)
• creative agent TextContent fallback for adcp SDK 3.6.0 (#1135) (d83ed14)
• normalize admin UI to canonical /admin routes (0283124)
• persist platform_line_item_ids in execute_approved_media_buy (#1126) (6a9776d)
• remove unauthenticated /init-api-key endpoint and harden control-plane auth (#1103) (3a336ef)
• resolve forked Alembic migration graph and prevent recurrence (#1144) (a4cd866)
• restore pre-#1066 admin routes via flask fallback mount (4b919f3)
• Skip format validation when creative agent returns no formats (#1137) (1173473)

Code Refactoring

• complete delivery schema extraction from _base.py (#1121) (46624e9)
• Eliminate get_db_session() from business logic — complete repository pattern adoption (#1097) (1965f1d)
• extract shared delivery helpers and migrate all adapters (#1124) (e8a9b8a)