fix: backport SSO Profile custom_attributes to 5.9.x (5.9.1)

[claude]

Requested by Adam Jenkins · Slack thread

Draft PR — backport of the SSO Profile custom_attributes field as a 5.9.1 patch release.

Description

What / why

A customer is pinned to SDK 5.9.0 and cannot easily upgrade to 5.20.0, where the SSO Profile custom_attributes field was added. This backports just that field as a 5.9.1 patch so they can read custom_attributes (the replacement for the deprecated raw_attributes) without taking a major version upgrade.

How

• Clean cherry-pick of PR Add custom_attributes field to SSO Profile #434 ("Add custom_attributes field to SSO Profile") onto the v5.9.0 tag — zero conflicts.
• Adds custom_attributes to the SSO Profile model and makes raw_attributes optional. This is the one behavioral note, and it is backward-compatible for reads.
• Directory Sync already shipped custom_attributes in 5.9.0, so no changes are needed there.
• Bumps the package version 5.9.0 -> 5.9.1 in workos/__about__.py.

This PR targets a new maintenance branch 5.9.x (created from the v5.9.0 tag) rather than main.

Testing

python -m pytest tests/test_sso.py -> 26 passed.

Documentation

Does this require changes to the WorkOS Docs? E.g. the API Reference or code snippets need updates.

[ ] Yes

If yes, link a related docs PR and add a docs maintainer as a reviewer. Their approval is required.

[greptile-apps]

Greptile Summary

This PR backports SSO profile custom attributes to the 5.9.x branch. The main changes are:

• Adds optional custom_attributes to the SSO Profile model.
• Makes deprecated raw_attributes optional for profile responses.
• Updates SSO test fixtures to include custom_attributes.
• Bumps the package version from 5.9.0 to 5.9.1.

Confidence Score: 5/5

The changes are narrowly scoped to a model field backport, fixture updates, and a patch version bump, with no issues identified.

The implementation aligns with the described compatibility goal and the touched files are limited to the SSO profile type, tests, fixtures, and package metadata.

T-Rex Logs

What T-Rex did

• Compared the base and head Profile construction to verify that head now has has_custom_attributes True and that custom_attributes are serialized in dict() and model_dump() alongside preserved raw_attributes.
• Compared test runs and observed that the base run exited with ValidationError for missing raw_attributes, while the head run exited with code 0 and showed raw_attributes serialized variably with exclude_none settings.
• Compared package-version logs and confirmed the base commit printed about_version=5.9.0 while the head commit printed about_version=5.9.1.

_{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "chore: bump version to 5.9.1" | Re-trigger Greptile}