[vgoat21]

Stack: #178 → #179 → #180 → this. Merge in order, or retarget as each lands.

Why

4.72.2 marks 85 operations deprecated, up from 25. Eight of the nine the plugin called now emit a DeprecationWarning at call time and have a v3 successor.

Every v2 operation returned a BaseResponseX envelope with a .data attribute; every v3 operation returns a flat *OutputBody. So each migration is: swap the method, drop the .data unwrap, remap fields.

v2 (deprecated)	v3
ConfigApi.get_config	ConfigApi.v3_get_config
AnalysesCoreApi.get_analysis_status	AnalysesCoreApi.v3_get_analysis_operation
AnalysesCoreApi.get_analysis_function_map	FunctionsCoreApi.v3_get_analysis_func_maps
AnalysesCoreApi.list_analyses	AnalysesCoreApi.v3_list_analyses
AnalysesCoreApi.upload_file	BinariesApi.v3_upload_file
SearchApi.search_binaries	BinariesApi.v3_search_binaries
SearchApi.search_collections	CollectionsApi.v3_list_collections
FunctionsAIDecompilationApi.upsert_ai_decompilation_rating	…v3_upsert_ai_decompilation_rating

The non-obvious ones

SearchApi is now deprecated in its entirety — zero non-deprecated operations. Binary search moves to GET /v3/binaries, collection search to GET /v3/collections; both swap page/page_size for limit/offset. CollectionListItemBody renames six fields off CollectionSearchResult (scope→collection_scope, last_updated_at→updated_at, created_at→creation, owned_by→collection_owner, tags→collection_tags, size→collection_size).

Analysis status moves to the long-running-operation endpoint GET /v3/operations/analyses/{analysis_id} — the docs describe it as "Polls the status of an Analysis-creation operation". CreateMetadata.status carries the same platform status string v2 returned (the SDK's field validator pins it to Uploaded|Queued|Processing|Complete|Error), so the Complete/Error state machine is unchanged rather than redesigned around done/error.

v3_upload_file drops packed_password. That parameter was dead plumbing: declared on _upload_file_req and upload_user_file and threaded between them, but never supplied — both internal callers omit it and nothing outside the module calls upload_user_file. Archive passwords moved to the sandbox side of the platform (SandboxConfig.archive_password), so it is removed rather than reimplemented. Note UploadOutputBody.file_type is a plain str where v2's was the UploadFileType enum.

New types_applied stream event. 4.72.2 added EventTypesApplied to the StreamAiDecompilation200ResponseInner oneOf. The hand-rolled SSE parser keys off event names and had no branch for it, so those events were being dropped silently. Enabling the new type_suggestions/apply_types params on create_ai_decompilation is a product decision and is deliberately not in this PR.

What stays on v2

AnalysesCoreApi.create_analysis — POST /v2/analyses is deprecated but has no v3 successor in the live v4.73.0 spec (verified against docs.reveng.ai/openapi.json; no POST /v3/analyses exists). v2-create + v3-poll is the platform's current flow. After this PR it is the only deprecated SDK call left in the plugin.

The other remaining /v2 calls are not deprecated and have no /v3 paths in the spec, so they are correctly left alone: IAMUsersApi.get_me and the seven ConversationsApi operations.

That audit was done mechanically, not from memory — AST-extracting every method carrying warnings.warn(..., DeprecationWarning) from the vendored SDK, then grepping plugin source, then cross-checking each hit against the live spec's deprecated flag. Worth noting "is on /v2" and "is deprecated" are not the same predicate: 11 v2 operations carry no deprecation marker at all.

Verification

538 passed, 3 skipped     (baseline 511 — +27 new tests across both PRs)
ruff: All checks passed!  (on the 27 changed files)

The repo's drift guards (test_sdk_call_signatures.py, test_endpoint_auth.py, the nine test_sdk_schemas.py files) all pass with their pins updated to the v3 methods and models. Response-shape tests construct real pydantic models rather than MagicMocks, so they fail if a field path drifts.

🤖 Generated with Claude Code