Release 3.2.3: agentscore-py 2.8.2, fastapi 0.159.1, uv 0.13.5, pypi-publish v1.14.3 (#167)

## Summary

Release 3.2.3, from the 2026-10-22 maintenance sweep.

- **`agentscore-py` floor: `>=2.8.1` to `>=2.8.2`**, the SDK release
from this sweep.
- **`uv lock --upgrade`:**
  - fastapi 0.159.1
  - httpx2 and httpcore2 2.16.0
  - a2a-sdk 1.2.3
  - pydantic-settings 2.16.1
  - sentry-sdk 2.73.0
  - setuptools 84.2.1
  - bitarray 3.12.3
  - ty 0.0.90
- python-dateutil 3.0.0, which arrives through cdp-sdk, whose range
admits it
- **CI:** setup-uv v10.3.2, uv 0.13.5 and pypi-publish v1.14.3.
  - uv 0.13.4 and later fix GHSA-hq85-5cpj-mr62 (the emSign roots).
- pypi-publish 1.14.3 fixes GHSA-5xjx-3w67-w9x9 (critical, in the
Sigstore chain that Trusted Publishing relies on).
- **aiohttp floored at `>=3.14.4`** in the `mppx` and `aiohttp` extras
and the dev group.
- pympp 0.14.0 exact-pins `yarl==1.24.5` and `propcache==0.5.2`, and the
only aiohttp compatible with those is 3.14.3, which has 8 advisories
fixed in 3.14.4.
- Our lock never showed this, because it resolves pympp 0.11.0. But a
merchant's fresh `pip install agentscore-commerce[mppx]` could take the
pympp 0.14 path.
- Proof: forcing `pympp==0.14.0` against the old manifest resolves
aiohttp 3.14.3 (osv: 8 known vulnerabilities). With the floor, that
combination is unsatisfiable, so pympp stays at 0.11 or lower, where it
already was.
- **Held back: `web3<8`.** pympp 0.14.0 (the latest) still requires
`eth-abi<6` for its tempo and stripe extras.
- **Prereleases:** the only ones in the lock are OpenTelemetry's
`0.66b1` semantic-conventions packages, which have never published a
stable release. `prerelease = "if-necessary"` admits exactly those.

Worked with Varun.

## Type of change

- [x] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [ ] Docs, tests, or internal maintenance only

## Public API

Unchanged.

## Test plan

- `uv sync --frozen --all-extras --all-groups`, then ruff check, ruff
format, ty and vulture pass.
- `pytest`: 1674 passed, 4 skipped.
- `osv-scanner` on `uv.lock`: no issues found.

## Checklist

- [ ] Tests cover the new behavior, and the suite passes locally (no new
behavior; the existing suite passes)
- [x] Lint, format, and type checks pass
- [ ] Docs and README examples updated if the public surface changed
(the public surface did not change)
- [x] No secrets, credentials, or personal data in the diff or the tests

Author: vvillait88

.github/workflows/ci.yml

@@ -22,9 +22,9 @@ jobs:
       - uses: useblacksmith/checkout@v1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v10.3.0
+        uses: astral-sh/setup-uv@v10.3.2
         with:
-          version: "0.13.1"
+          version: "0.13.5"
 
       - name: Set up Python
         run: uv python install 3.15
@@ -69,9 +69,9 @@ jobs:
       - uses: useblacksmith/checkout@v1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v10.3.0
+        uses: astral-sh/setup-uv@v10.3.2
         with:
-          version: "0.13.1"
+          version: "0.13.5"
 
       - name: Set up Python
         run: uv python install ${{ matrix.python }}

.github/workflows/publish.yml

@@ -19,17 +19,17 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: astral-sh/setup-uv@v10.3.0
+      - uses: astral-sh/setup-uv@v10.3.2
         with:
-          version: "0.13.1"
+          version: "0.13.5"
 
       - name: Set version from tag
         run: sed -i "s/^version = .*/version = \"${GITHUB_REF_NAME#v}\"/" pyproject.toml
 
       - run: uv build
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@v1.14.2
+        uses: pypa/gh-action-pypi-publish@v1.14.3
 
       - name: Create GitHub Release
         run: gh release create "$GITHUB_REF_NAME" --generate-notes

.github/workflows/security.yml

@@ -39,9 +39,9 @@ jobs:
     timeout-minutes: 5
     steps:
       - uses: useblacksmith/checkout@v1
-      - uses: astral-sh/setup-uv@v10.3.0
+      - uses: astral-sh/setup-uv@v10.3.2
         with:
-          version: "0.13.1"
+          version: "0.13.5"
       - uses: actions/setup-python@v7
         with:
           python-version: "3.15"

pyproject.toml

@@ -4,15 +4,15 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentscore-commerce"
-version = "3.2.2"
+version = "3.2.3"
 description = "Agentic commerce SDK for Python: identity middleware (FastAPI, Flask, Django, AIOHTTP, Sanic, ASGI) + payment helpers + 402 builders + discovery + Stripe multichain. The full merchant-side toolkit for AgentScore-powered agentic commerce."
 readme = "README.md"
 license = "MIT"
 requires-python = ">=3.11"
 keywords = ["agentscore", "agentic-commerce", "agentic-payments", "402", "x402", "mpp", "machine-payments-protocol", "fastapi", "starlette", "flask", "django", "aiohttp", "sanic", "middleware", "kyc", "identity", "stripe", "tempo", "solana", "base", "ai-agent"]
 dependencies = [
     "httpx>=0.25.0,<1.0.0",
-    "agentscore-py>=2.8.1",
+    "agentscore-py>=2.8.2",
 ]
 classifiers = [
     "Development Status :: 5 - Production/Stable",
@@ -36,7 +36,7 @@ starlette = ["starlette>=0.27.0"]
 fastapi = ["fastapi>=0.100.0"]
 flask = ["flask>=2.0.0"]
 django = ["django>=4.0"]
-aiohttp = ["aiohttp>=3.8.0"]
+aiohttp = ["aiohttp>=3.14.4"]
 sanic = ["sanic>=23.0.0"]
 stripe = ["stripe>=11.0.0"]
 # Payment-protocol peer deps for create_x402_server / create_mppx_server.
@@ -46,7 +46,10 @@ stripe = ["stripe>=11.0.0"]
 # https://api.cdp.coinbase.com/platform/v2/x402 with a CDP-JWT auth provider;
 # `cdp-sdk` is the JWT minter. Install via the `coinbase` extra when needed.
 x402 = ["x402[evm,fastapi]>=2.9,<3"]
-mppx = ["pympp[server,tempo,stripe]>=0.6,<1"]
+# aiohttp is floored here too: pympp 0.14 exact-pins yarl and propcache at versions that resolve
+# aiohttp 3.14.3, which carries advisories fixed in 3.14.4, so a fresh install of this extra
+# would otherwise land the vulnerable one.
+mppx = ["pympp[server,tempo,stripe]>=0.6,<1", "aiohttp>=3.14.4"]
 coinbase = ["cdp-sdk>=1.0,<2"]
 ucp = ["joserfc>=1.0.0,<2"]
 redis = ["redis>=5.0,<9"]
@@ -69,7 +72,7 @@ dev = [
     "fastapi>=0.100.0",
     "flask>=2.0.0",
     "django>=4.0",
-    "aiohttp>=3.8.0",
+    "aiohttp>=3.14.4",
     "sanic>=23.0.0",
     "sanic-testing>=24.0.0",
     "pytest-cov>=6.0",