chore: release 4.2.0

[TexasCoding]

Summary

Minor version bump 4.1.0 → 4.2.0 covering the two changes merged since 4.1.0.

• fix: spec drift — settlement_sources on Event + lifecycle strike fields (#451) #452 (closes Nightly spec-drift: strict contract tests failing (since 2026-06-18) #451) — additive response fields reconciling in-place upstream spec drift: Event.settlement_sources and WS MarketLifecyclePayload.{strike_type, cap_strike, custom_strike}.
• chore(deps): update cryptography requirement from <49,>=43 to >=43,<50 #448 — cryptography dependency ceiling widened <49 → <50.

Why minor (not major or patch)

Follows the 4.1.0 precedent: that release added MarginPosition.subaccount — a spec-required response field — as a minor, with a note that direct constructors must now include it. Event.settlement_sources is the identical case, so it's additive-minor with the same note, not a breaking-major (those are reserved for real API breaks, e.g. the SCM rename in 4.0.0). New readable model surface rules out a patch.

Changes

• pyproject.toml version → 4.2.0
• kalshi/__init__.py __version__ → 4.2.0
• CHANGELOG.md — new ## 4.2.0 — 2026-06-19 entry (Added: the new fields; Changed: cryptography cap + the held-at-104-ops spec note)

Verification

• uv run ruff check . — clean
• uv run mypy kalshi/ — clean
• import kalshi; kalshi.__version__ → 4.2.0, matches pyproject.toml

Note

A docs: 100% accuracy pass for v4.2.0 pass (mentioning the new fields in docs/resources/events.md and the WS lifecycle docs) typically follows as a separate PR, per the 4.0.0/4.1.0 cadence — not included here to keep this PR to the release bump.

🤖 Generated with Claude Code

[claude]

Code Review — chore: release 4.2.0

Overview: Clean release bump merging two already-landed PRs (#448, #452). Only the three expected files are touched: CHANGELOG.md, kalshi/__init__.py, pyproject.toml. Both PRs confirm as merged before this was opened.

---

What's correct

• Version consistency — __version__ and pyproject.toml both read 4.2.0. No drift.
• CHANGELOG quality — covers Added, Changed, and the upstream-spec-glitch note clearly. The note about direct constructors needing settlement_sources is exactly the right place to warn downstream users.
• Semver reasoning — the minor-not-patch call is well-justified (new public model surface) and the minor-not-major call is defensible given the 4.1.0 precedent for MarginPosition.subaccount. Documented in the PR body, which is good for the release history.
• Blast radius — this PR touches nothing executable; no logic, no tests. Zero regression risk.

---

Minor observations (no blockers)

• settlement_sources is spec-required — the CHANGELOG note is there, but it's worth considering whether this warrants the same treatment the 4.1.0 note got: a bolded "Note:" line in the CHANGELOG explaining exactly what breaks (direct Event(...) construction without the field). The current note is accurate but easy to skim past.
• No git tag in the diff — expected for this workflow (tag presumably follows merge), but confirm the tag push is part of the release process and not accidentally skipped.
• docs/ follow-up — the PR body mentions a follow-up accuracy pass for docs/resources/events.md and the WS lifecycle docs. Consider opening the tracking issue now (if not already) so it doesn't slip.

---

Verdict

LGTM. The diff is exactly what it should be for a release PR. The two concerns above are polish-level, not blockers. Safe to merge once CI is green.