[Justin Hammond (Justintime50)]

Description

Preps v8.9.0 for release: bumps the version and dates the CHANGELOG entry.

• Adds surcharges property and model to Rate object
• Removes the deprecated, unusable addCreditCardToUser function
  • Stripe has disabled the ability to pass plain credit card details over the wire and now requires using Stripe.js/Elements/Checkout. Follow the Decentralized (EasyPost-Manage Billing) Guide for more details on the new flow to use.
  • Makes referralCustomer.retrieveEasypostStripeApiKey public to help facilitate adding credit cards using Stripe.js
• Caps HTTP response bodies at 10 MB to prevent heap exhaustion from oversized responses. Responses that declare or stream more than this now throw an HttpError instead of being read into memory without limit
• Redacts the API key in the Authorization header passed to request and response hooks. Hooks now receive only the last four characters of the key (eg: Bearer ****WXYZ) instead of the full key; the outgoing request is unchanged
• Adds support for FedexDefaultAccount, GofoWalletAccount, UpsDapAccount, UniUniWalletAccount, and VehoWalletAccount by properly routing carrier-account create requests to the /carrier_accounts/open endpoint.
• Also pins CI runners from ubuntu-latest to ubuntu-24.04: ubuntu-latest moved to Ubuntu 26.04, which dropped older language versions from our test matrix, so this keeps CI on 24.04 until a later modernization effort.

Testing

Pull Request Type

Please select the option(s) that are relevant to this PR.

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Improvement (fixing a typo, updating readme, renaming a variable name, etc)

Reviewer notes

• The removal of the deprecated, unusable credit-card function ships as a minor release, following the easypost-go v5.10.0 precedent (which removed AddReferralCustomerCreditCard in a minor).
• The 10 MB response-body cap now throws HttpError for oversized responses, and request/response hooks now receive a redacted API key (Bearer ****WXYZ). Both are behavior changes that could be considered breaking; confirm a minor bump is acceptable.