chore(main): release 4.0.0

[release-please]

🤖 I have created a release beepboop

4.0.0 (2026-03-11)

⚠ BREAKING CHANGES

• transfer_manager: Blobs that would resolve to a path outside the destination_directory are no longer downloaded. While this is a security fix, users relying on the previous behavior to write files outside the target directory will see a change.

Features

• Add system test for cross-region buckets (810441c)
• Add time based benchmarks (09b1d9d)
• Add time based benchmarks (#1749) (09b1d9d)
• Triger bidi conformance tests (8dd0a80)
• Triger bidi conformance tests (#1757) (8dd0a80)

Bug Fixes

• Don't flush at every append, results in bad perf (ab62d72)
• Don't flush at every append, results in bad perf (#1746) (ab62d72)
• Init mp pool & grpc client once, use os.sched_setaffinity (a9eb82c)
• Init mp pool & grpc client once, use os.sched_setaffinity (#1751) (a9eb82c)
• Pass token correctly, '&' instead of ',' (d8dd1e0)
• Pass token correctly, '&' instead of ',' (#1756) (d8dd1e0)
• transfer_manager: Prevent path traversal in download_many_to_path (#1768) (700fec3)
• transfer_manager: Prevent path traversal in download_many_to_path (700fec3)

---

This PR was generated with Release Please. See documentation.

[Pulkit0110]

/gcbrun

[chalmerlowe]

📢 Migration Notice: 📢 This library is moving to the google-cloud-python monorepo soon.

We kept this PR open due to recent activity. We would like to finalize this PR so it can be merged if it is critical.

If we don't hear from the PR author, we will close this PR in the next few days. The PR can then be re-opened in the monorepo once the migration is complete and work can continue there.