Upgrade StripeSAFE

Battle-tested Claude Code, OpenAI Codex, Cursor configs, plugins, hooks and agents with Kimi, MiniMax and GLM API support.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: upgrade-stripe
description: >-
  Guide for upgrading Stripe API versions, webhook endpoints, server-side SDKs,
  Stripe.js, and mobile SDKs
license: MIT
---

# Upgrading Stripe Versions

## Choose a target API version

If the user specifies a target API version, use it. Otherwise, look up the current version on docs.stripe.com with any documentation or web tool available to you, for example `stripe docs /api/versioning` with the Stripe CLI. The [API versioning](https://docs.stripe.com/api/versioning.md) page states it in the sentence that begins “The current version is”.

Bundled fallback API version: `2026-08-26.dahlia`. This value is only a snapshot from the last time this skill was generated, on 2026-10-01. Version identifiers start with their release date in YYYY-MM-DD format and new stable versions are released monthly, so a fallback version dated more than a month ago is probably stale. Use it only when you can’t reach docs.stripe.com. Never guess about a newer version number.

Before making changes, compare the target with each API version the integration pins: client configuration, per-request overrides, and webhook endpoints. Unless the user explicitly asks for it, don’t move any pin to an older version or a stable pin to a preview version. If a pin already matches the target, report it as unchanged. State the selected target and its source. If live verification fails or is unavailable, say that the latest version remains unverified, and don’t claim the integration is on the latest version.

When reviewing webhook endpoints and event destinations, distinguish snapshot events from thin events. Thin event payloads are unversioned, so they don’t need to be upgraded when you change your API version. API calls that retrieve the full event or related resource remain versioned.

For SDKs that support explicit API version overrides, use the selected target in client configuration and per-request overrides. Use it in curl `Stripe-Version` test headers, too. Replace bundled API versions shown in those examples with the selected target before copying or running them. For Java, Go, and .NET, select an SDK release that targets the selected API version instead of overriding the SDK’s fixed version. Preview targets need the matching `beta` SDK release in every language; see [SDK versioning](https://docs.stripe.com/sdks/versioning.md).

## Understanding Stripe API Versioning

Stripe uses date-based API versions (e.g., `2026-08-26.dahlia`, `2025-08-27.basil`, `2024-12-18.acacia`). Your account’s API version determines request/response behavior.

Starting with the 2024-09-30.acacia release, Stripe releases new API versions monthly with no breaking changes. Twice a year, a new major release (for example, Basil) starts with an API version containing breaking changes. You can safely upgrade to any monthly release without updating your code.

### Types of Changes

**Backward-Compatible Changes** (don’t require code updates):

- New API resources
- New optional request parameters
- New properties in existing responses
- Changes to opaque string lengths (e.g., object IDs)
- New webhook event types

**Breaking Changes** (require code updates):

- Field renames or removals
- Behavioral modifications
- Removed endpoints or parameters

Review the [API changelog](https://docs.stripe.com/changelog.md) for all changes between versions. See [API upgrades](https://docs.stripe.com/upgrades.md) for the full upgrade guide.

## Server-Side SDK Versioning

See [Set a Stripe API version for your SDK](https://docs.stripe.com/sdks/set-version.md) for details on setting an API version in code.

### Dynamically-Typed Languages (Ruby, Python, PHP, Node.js)

These SDKs offer flexible version control:

**Global Configuration:**

```python
import stripe
stripe.api_version = '2026-08-26.dahlia'
```

```ruby
Stripe.api_version = '2026-08-26.dahlia'
```

```javascript
const stripe = require('stripe')('sk_test_xxx', {
  apiVersion: '2026-08-26.dahlia'
});
```

**Per-Request Override:**

```python
stripe.Customer.create(
  email="[email protected]",
  stripe_version='2026-08-26.dahlia'
)
```

### Strongly-Typed Languages (Java, Go, .NET)

These use a fixed API version matching the SDK release date. Don’t set a different API version for strongly-typed languages because response objects might not match the strong types in the SDK. Instead, update the SDK to target a new API version.

### Best Practice

Always specify the API version you’re integrating against in your code instead of relying on your account’s default API version:

```javascript
// Good: Explicit version
const stripe = require('stripe')('sk_test_xxx', {
  apiVersion: '2026-08-26.dahlia'
});

// Avoid: Relying on account default
const stripe = require('stripe')('sk_test_xxx');
```

## Stripe.js Versioning

See [Stripe.js Versioning](https://docs.stripe.com/sdks/stripejs-versioning.md) for details.

Stripe.js uses an evergreen model with major releases (Acacia, Basil, Clover, Dahlia) on a biannual basis.

### Loading Versioned Stripe.js

**Via Script Tag:**

```html
<script src="https://js.stripe.com/dahlia/stripe.js"></script>
```

**Via npm:**

```bash
npm install @stripe/stripe-js
```

Major npm versions correspond to specific Stripe.js versions.

### API Version Pairing

Each Stripe.js version automatically pairs with its corresponding API version. For instance:

- Dahlia Stripe.js uses `2026-08-26.dahlia` API
- Acacia Stripe.js uses `2024-12-18.acacia` API

You can’t override this association.

### Migrating from v3

1. Identify your current API version in code
2. Review the changelog for relevant changes
3. Consider gradually updating your API version before switching Stripe.js versions
4. Stripe continues supporting v3 indefinitely

## Mobile SDK Versioning

See [Mobile SDK Versioning](https://docs.stripe.com/sdks/mobile-sdk-versioning.md) for details.

### iOS and Android SDKs

Both platforms follow **semantic versioning** (MAJOR.MINOR.PATCH):

- *

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (3)

.claude/output-styles/adhd-explanatory.md

AGENTS.md

GEMINI.md

Gates applied: no_behavioural_pass.