upgrade-stripe

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

llm/ai-sdk/LICENSE

llm/token-meter/LICENSE

tools/modelcontextprotocol/LICENSE

tools/typescript/LICENSE

Audit 0.4.1 · source sha c368a98b4768 · 26 Oct 2026Report an issue or request a re-scan

• Publisherstripe GitHub organizationOwner of the repository this skill is read from
• Source folderstripe/ai/skills/upgrade-stripeThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdictc368a98b4768A new audit runs when the source changes
• Repository statusNot archivedPushed today
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Guide for upgrading Stripe API versions, webhook endpoints, server-side SDKs, Stripe.js, and mobile SDKs

---
name: upgrade-stripe
description: >-
  Guide for upgrading Stripe API versions, webhook endpoints, server-side SDKs,
  Stripe.js, and mobile SDKs

---

# Upgrading Stripe Versions

## Choose a target API version

If the user specifies a target API version, use it. Otherwise, look up the current version on docs.stripe.com with any documentation or web tool available to you, for example `stripe docs /api/versioning` with the Stripe CLI. The [API versioning](https://docs.stripe.com/api/versioning.md) page states it in the sentence that begins “The current version is”.

Bundled fallback API version: `2026-09-30.endive`. This value is only a snapshot from the last time this skill was generated, on 2026-10-26. Version identifiers start with their release date in YYYY-MM-DD format and new stable versions are released monthly, so a fallback version dated more than a month ago is probably stale. Use it only when you can’t reach docs.stripe.com. Never guess about a newer version number.

Before making changes, compare the target with each API version the integration pins: client configuration, per-request overrides, and webhook endpoints. Unless the user explicitly asks for it, don’t move any pin to an older version or a stable pin to a preview version. If a pin already matches the target, report it as unchanged. State the selected target and its source. If live verification fails or is unavailable, say that the latest version remains unverified, and don’t claim the integration is on the latest version.

When reviewing webhook endpoints and event destinations, distinguish snapshot events from thin events. Thin event payloads are unversioned, so they don’t need to be upgraded when you change your API version. API calls that retrieve the full event or related resource remain versioned.

For SDKs that support explicit API version overrides, use the selected target in client configuration and per-request overrides. Use it in curl `Stripe-Version` test headers, too. Replace bundled API versions shown in those examples with the selected target before copying or running them. For Java, Go, and .NET, select an SDK release that targets the selected API version instead of overriding the SDK’s fixed version. Preview targets need the matching `beta` SDK release in every language; see [SDK versioning](https://docs.stripe.com/sdks/versioning.md).

## Understanding Stripe API Versioning

Stripe uses date-based API versions (for example, `2026-09-30.endive`, `2025-08-27.basil`, `2024-12-18.acacia`). Your account’s API version determines request/response behavior.

Starting with the 2024-09-30.acacia release, Stripe releases new API versions monthly with no breaking changes. Twice a year, a new major release (for example, Basil) starts with an API version containing breaking changes. You can safely upgrade to any monthly release without updating your code.

### Types of Changes

**Backward-Compatible Changes** (don’t require code updates):

- New API resources
- New optional request parameters
- New properties in existing responses
- Changes to opaque string lengths (for example, object IDs)
- New webhook event types

**Breaking Changes** (require code updates):

- Field renames or removals
- Behavioral modifications
- Removed endpoints or parameters

Review the [API changelog](https://docs.stripe.com/changelog.md) for all changes between versions. See [API upgrades](https://docs.stripe.com/upgrades.md) for the full upgrade guide.

## Server-Side SDK Versioning

See [Set a Stripe API version for your SDK](https://docs.stripe.com/sdks/set-version.md) for details on setting an API version in code.

### Dynamically-Typed Languages (Ruby, Python, PHP, Node.js)

These SDKs offer flexible version control:

**Global Configuration:**

```python
import stripe
stripe.api_version = '2026-09-30.endive'
```

```ruby
Stripe.api_version = '2026-09-30.endive'
```

```javascript
const stripe = require('stripe')('sk_test_xxx', {
  apiVersion: '2026-09-30.endive'
});
```

**Per-Request Override:**

```python
stripe.Customer.create(
  email="[email protected]",
  stripe_version='2026-09-30.endive'
)
```

### Strongly-Typed Languages (Java, Go, .NET)

These use a fixed API version matching the SDK release date. Don’t set a different API version for strongly-typed languages because response objects might not match the strong types in the SDK. Instead, update the SDK to target a new API version.

### Best Practice

Always specify the API version you’re integrating against in your code instead of relying on your account’s default API version:

```javascript
// Good: Explicit version
const stripe = require('stripe')('sk_test_xxx', {
  apiVersion: '2026-09-30.endive'
});

// Avoid: Relying on account default
const stripe = require('stripe')('sk_test_xxx');
```

## Stripe.js Versioning

See [Stripe.js Versioning](https://docs.stripe.com/sdks/stripejs-versioning.md) for details.

Stripe.js uses an evergreen model with major releases (Acacia, Basil, Clover, Dahlia, Endive) on a biannual basis.

### Loading Versioned Stripe.js

**Via Script Tag:**

```html
<script src="https://js.stripe.com/endive/stripe.js"></script>
```

**Via npm:**

```bash
npm install @stripe/stripe-js
```

Major npm versions correspond to specific Stripe.js versions.

### API Version Pairing

Each Stripe.js version automatically pairs with its corresponding API version. For instance:

- Endive Stripe.js uses `2026-09-30.endive` API
- Acacia Stripe.js uses `2024-12-18.acacia` API

You can’t override this association.

### Migrating from v3

1. Identify your current API version in code
2. Review the changelog for relevant changes
3. Consider gradually updating your API version before switching Stripe.js versions
4. Stripe continues supporting v3 indefinitely

## Mobile SDK Versioning

See [Mobile SDK Versioning](https://docs.stripe.com/sdks/mobile-sdk-versioning.md) for details.

### iOS and Android SDKs

Both platforms follow **semantic versioning** (MAJOR.MINOR.PA

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

npm install @stripe/stripe-js

git clone https://github.com/stripe/ai
git -C ai checkout c368a98b4768

Works in

1. 2026-10-26
   !CAUTION B 89 / 100

   first audit · source c368a98b4768

Questions about upgrade-stripe

• github.com/stripe/ai/tree/main/skills/upgrade-stripe — the audited source at commit c368a98b4768 and every finding aboveObserved · 26 Oct 2026

Spotted something wrong? Report a correction · Methodology